(i) HEPL collects only those need-based data as per the regulations and guidelines issued by the Reserve Bank of India and other appropriate authorities from time to time and ensures that no biometric data is collected or stored in the process of providing its services. Pursuant to the above rules and regulations, HEPL collects only the following types of personal information:

a. Information voluntarily provided by the customer:

• Full Name, Address, Date of Birth, Gender
• Contact details such as mobile number, Email ID, etc.
• PAN, Aadhaar Number and/or other KYC documents
• Bank Account Details and IFSC Code
• Employment Details and Income Proof
• Loan-related documents for Fintech purposes
• Any other information voluntarily provided by the customer

• IP address, device information, browser type
• Cookies and similar tracking technologies
• Location data with the prior and explicit consent of the user

• Credit Information Companies
• Payment aggregators
• Partners or agents authorized by the user

(ii) HEPL shall collect the personal data of the customers only for the following lawful purposes:

• To verify customer identity
• To assess the creditworthiness and loan eligibility of the customers
• To comply with legal and regulatory obligations
• To improve the user experience and services of HEPL
• For marketing and promotional communication, with the prior and explicit consent of the customer

1. HEPL shall always obtain the explicit consent of its customers and/or users prior to the collection of any personal data for the purposes listed in Para 2(ii) of this Policy.
2. The customers and/or users have the right to revoke such consent at any time by writing to us at legal@hepl.com or by contacting the Grievance Redressal Officer specified in Para 16 of this Policy.
3. HEPL duly refrains itself from accessing mobile phone resources such as files, media, call logs, contact lists and the like, without evaluation of necessity of processing such data and ensures obtaining clear user consent before proceeding into processing of such data.
4. HEPL shall not transfer, sell, let out or rent or cause to transfer, sell, let out or rent any personal data of the customers and/or users to any third parties for any commercial or other purposes.

HEPL shall not share or disclose any personal data provided by the customers and/or users except with the following agencies or organisations:

• Banks and Non-Banking Finance Companies duly categorised as Regulated Entities (REs) in accordance with the Regulations and Guidelines issued by the Reserve Bank of India
• Credit Information Bureaus for the purpose of credit profiling and credit assessment
• Technology service providers under strict terms of confidentiality and restriction of usage and processing
• Government authorities, as required under law

HEPL undertakes to ensure that:

1. No biometric data of customers and/or users shall be stored/collected in our systems, except permitted under extant statutory guidelines.
2. All personal data of customers and/or users is stored securely in servers located within India.
3. The retention of the personal data of customers and/or users is exercised only as long as necessary for the purposes stipulated in Para 2(ii) of this Policy or as required by law.

HEPL has in place, reasonable measures to protect and safeguard the information provided by the User on its interface in accordance with the Information Technology Act, 2000 and its allied Rules and Regulations. HEPL implements security protocols that are regarded as high standard in the industry, for the purpose of safeguarding your data. Such protocols may include:

• Encryption measures such as AES-256 or its equivalent (in transit and at rest)
• Role-based access control
• Secure APIs and firewalls
• Regular vulnerability assessments and penetration testing
• Employee confidentiality agreements
• Compliance with ISO/IEC 27001 standards (if applicable)
• Service Level Agreements, Escalation Matrix and contractual agreements with third parties

As a data principal, the customers have the following rights under Chapter III of the Digital Personal Data Protection Act, 2023:

• Right to access the personal data shared by the customers and seek any other information related to such personal data
• Right to seek information about the identities of all other organisations with whom the personal data of the customers has been shared by HEPL
• Right to correct or update inaccurate information
• Right to withdraw consent and erasure of personal data
• Right to nominate any other person to exercise the above rights on behalf of the customer
• Right to lodge complaints with relevant authorities and seek redressal

The customer or user may exercise these rights by contacting HEPL at legal@hepl.com.

he Customer/User may at any point in time choose to deny/revoke consent for use of his Personal Data or restrict disclosure to third parties, data retention or revoke consent already granted to collect personal data. However, in case customer/user choose to opt for any such revocation/restriction, HEPL may not be able to offer or serve the customer/user with various products or services that need to have user consent for using/storing/sharing Personal Data in accordance with this Policy and in such case, HEPL may have to stop such products/services being availed by the user. The user may by sending a mail to legal@hepl.com may revoke his consent to use his personal data being used by lending partners or other associates or third parties for their selling or promotion of their products.

HEPL shall destruct the Personal Data of the customer/user:

1. When the purpose for which such data was collected has been fulfilled; or
2. Within 90 days from the date of collection of such data, in accordance with the rules laid down as per the provisions of the Digital Personal Data Protection Act, 2023, whichever is earlier.

However, the above customer/user may choose to delete his Personal Data at any point of time by making such choice by emailing us on legal@hepl.com. With this, HEPL will no longer provide user data for external processing, cross-selling, and promotional offers of its lending partners. However, in all other cases, HEPL shall retain Personal Data of the user/customer as long as the purpose for its usage exists, after which the same is disposed of, except for the retention of any record required as per applicable law. Further, in the event of the pendency of any legal / regulatory proceeding or receipt of any legal and / or regulatory direction to that effect, HEPL may be required by the law of the land to retain user Personal Data for longer periods.

HEPL uses cookies in its website to improve user experience, and the customers and/or users may choose to disable such authorisations given to them through their browser settings, though some functionality may be affected. However, to ensure compliance with our policies, HEPL restricts the use of third-party cookies by trusted partners.

The website of HEPL may contain links to third-party websites or services. However, it is clarified that HEPL shall not be made responsible for the privacy practices or content of such third parties. Hence, the customers are advised to read the privacy policies of such third-party links before engaging with them.

All material presented on this Website, including graphical images, unless otherwise stated, belong to the Website. You are allowed to print or download extracts from the service for your personal use only. However, any copies of these pages saved to disk or to any other storage medium may only be used for viewing purposes or to print relevant extracts for personal use. You shall not (whether directly or using any software program) create a database in an electronic or structured manual by regular or otherwise downloading and storing all or any part of the information from the service. No part of the service shall be reproduced or transmitted or stored in any other website, nor may any of its information or part thereof be disseminated in any electronic or non-electronic form, nor included in any public or private electronic retrieval system or service without obtaining prior written permission from HEPL.

In the event of a data breach involving the personal data of customers and/or users, HEPL shall involve in breach containment and risk mitigation measures as outlined below:

1. Immediate assessment and containment of the breach
2. Notifying the affected users with:
   • Description of the breach
   • Data exposed
   • Steps taken to mitigate the risk
3. Notifying the Regulated Entity and reporting the incident to the Computer Emergency Response Team (CERT-In), Reserve Bank of India and/or Unique Identification Authority of India within the prescribed time limit
4. Conduct a root-cause analysis, fix vulnerabilities, and implement corrective actions
5. Maintain an incident log and audit trail for regulatory review

The customer/user agrees to protect, defend, indemnify and hold HEPL and the Website, and its affiliates, officers, agents and employees, harmless from any claim or demand and from potential claims by third parties arising from the actions of the customer/user actions including reasonable attorneys’ fees made by any third party due to the content you submit, post or transmit through the service, your use of the service, your connection to the service, your violation of the terms and conditions or your violation of any rights of another user. With these clauses, HEPL encourages customers/users to use the website responsibly and avoid actions that could lead to legal claims. By proceeding to use the website, the customer/user shall be deemed to have consented to this Privacy Policy

HEPL shall ensure applicable compliance standards on information security and understands that the confidentiality, integrity, and availability of the information of customer/user are vital to our business operations and our own success. The scope of the same includes the Management of Information Security applicable to Business Process of Loan Distribution and its Support Functions. However, no method of transmission over the Internet or method of electronic storage, is 100% secure. Therefore, we cannot guarantee its absolute security. Further, you are responsible for maintaining the confidentiality and security of your login ID and password and may not provide these credentials to any third party.

Being a socially responsible enterprise and as part of the data protection ecosystem, HEPL is committed to addressing your concerns promptly. The customers and/or users may contact the Grievance Redressal Officer of HEPL for queries/complaints regarding data usage and security practices of HEPL

Grievance Redressal Officer:

Name: Vaidya Gopikrishnan
Designation: Manager - Legal
Email ID: legal@hepl.com
Mobile No.: 63802 74238

Regd. Office:

No.12, Poonthamallee Road,
Ekkattuthangal,
Chennai - 600 032

The Grievance Redressal Officer shall resolve complaints filed by the customers and/or users within the timeline prescribed by applicable laws and regulations.

HEPL shall reserve the right to periodically update this Policy in line with the existing rules and regulations in force. Such updates shall be duly communicated on our website and the customers shall also be notified about it via email.

For any questions or concerns, please reach out to:

For any questions or concerns, please reach out to:

Hema’s Enterprises Private Limited
No.12, Poonthamallee Road,
Ekkattuthangal,
Chennai - 600 032
Email ID: info@hepl.com