Data Protection & Security Policy
RupayFin (operated by LSP CAPGROWTH FINTECH PRIVATE LIMITED) is deeply committed to the responsible, lawful, and secure handling of all customer data. We implement industry-leading information security safeguards to protect user privacy throughout the digital credit journey.
Foundational Data Protection Principles
1. Purpose Limitation
Customer data is collected solely for specified, explicit, and legitimate lending facilitation and verification purposes.
2. Data Minimisation
Only information that is reasonably necessary for identity authentication and credit assessment is requested.
3. Transparency
Clear notices explain what data is collected, why it is needed, and how it will be processed and shared.
4. Bank-Grade Security
State-of-the-art encryption protocols (SSL/TLS 256-bit) protect data in transit and at rest in secure cloud datacenters.
5. Access Control
Access to customer records is restricted strictly to authorized personnel on a least-privilege, need-to-know basis.
6. Retention Control
Data is never retained longer than required, strictly respecting regulatory and statutory retention limits.
Third-Party Processing & Partner Oversight
Where third-party technology providers (such as cloud servers, credit bureaus, or payment gateways) process data on our behalf, stringent non-disclosure agreements, data processing agreements, and periodic security evaluations apply.
Customer Security Responsibilities
Security is a shared responsibility. Customers are strongly encouraged to:
- Keep passwords, MPINs, and OTP verification codes strictly confidential;
- Never share login credentials or sensitive banking details over phone calls, SMS, or unverified channels;
- Interact with RupayFin solely through our official domain (rupayfin.com) and official channels;
- Immediately report any suspicious communication or unauthorized account activity to support@rupayfin.com.
Security Incident Management
If a security or data privacy incident affecting customer records is identified, our specialized response protocol is activated immediately to contain the issue, notify affected parties, and report to relevant authorities in compliance with applicable law.