Privacy Policy

This Privacy Policy ("Policy") describes how Orenda Financial Services Private Limited ("Orenda", "Company", "we", "us", "our") collects, uses, discloses, stores, and otherwise processes Personal Data through the website orendafinserv.com and its related dashboard, CRM, AI eligibility tools and related services (collectively, the "Platform").

This Policy applies to every person who visits, browses, or otherwise accesses the Platform, whether or not that person registers or transacts on the Platform, including without limitation: (a) individuals who register on the Platform as Direct Selling Agents, channel partners, or referral partners ("DSA Partners") under Orenda's Terms & Conditions for DSA Partners; (b) individuals and entities who submit their own loan-related information on the Platform, whether directly or through a DSA Partner ("Applicants" or "Clients"), under Orenda's Terms & Conditions for Direct Clients/Applicants; and (c) any other visitor who accesses or browses the Platform without registering as a DSA Partner or Applicant ("Visitor"). This is a single, common Policy applicable to all such persons; references to "you" apply to whichever category is relevant to the context, and, unless the context requires otherwise, a reference to "you" in a clause of general application includes a Visitor.

This Policy should be read together with the applicable Terms & Conditions (for DSA Partners or for Applicants, as the case may be), and forms part of those Terms.

This Policy constitutes a notice under Section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), given to you at or before the time your consent is requested or your Personal Data is otherwise processed.

“Applicant” or "Client" means an individual or entity whose loan-related information and documents are submitted on the Platform, whether directly or through a DSA Partner, for eligibility assessment and Lender facilitation.

“Consent” has the meaning given to it under Section 6 of the DPDP Act.

“Data Fiduciary” means Orenda, being the entity that determines the purpose and means of processing Personal Data collected through the Platform.

“Data Principal” means the individual to whom the Personal Data relates, being, as the context requires, a DSA Partner, an Applicant/Client, or another visitor to the Platform.

“DSA Partner” means a Direct Selling Agent, channel partner, or referral partner registered on the Platform under Orenda's Terms & Conditions for DSA Partners.

“Lender(s)” means the banks, NBFCs, and other financial institutions to which a Case or Application may be forwarded for consideration, as further described in the applicable Terms & Conditions.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.

“Personal Data Breach” means any unauthorised processing of Personal Data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to Personal Data, that compromises its confidentiality, integrity, or availability.

“Processing” means an operation performed on Personal Data, including collection, recording, organisation, structuring, storage, use, alteration, retrieval, disclosure, or erasure.

“Visitor” means any individual who visits, browses, or otherwise accesses the Platform, whether or not that individual registers as a DSA Partner or Applicant/Client.

Terms not defined in this Policy have the meaning given to them in the applicable Terms & Conditions.

From every Visitor, whether or not you register on the Platform: we may collect technical and usage data such as IP address, device identifiers, browser type, operating system, pages viewed, referring website, approximate location derived from your IP address, log-in timestamps, and other system-generated audit trail data recorded when you visit, browse, or otherwise access the Platform, together with cookie data as described in Clause 13.

From DSA Partners, in addition to Clause 3.1: name, mobile number (verified by OTP), email address, city, partner type, professional licences/registrations/certifications, KYC documents, PAN, GST registration (where applicable), bank account details for Commission payout, and any other information you provide during registration or in the course of using the Partner Dashboard.

From Applicants/Clients, in addition to Clause 3.1: name, contact details, date of birth, address, city, income and employment details, PAN, Aadhaar (where voluntarily provided for KYC purposes), bank statements, GST returns, existing loan/obligation details, credit history information obtained through a soft credit pull with your consent, and any other loan-related information and supporting documents submitted on the Platform, whether by you directly or by a DSA Partner on your behalf.

We do not intentionally collect any Personal Data beyond what is reasonably necessary for the purposes described in Clause 5, and we do not collect any category of sensitive personal data (such as health data, biometric data, or data revealing race, religion, or sexual orientation) except where you voluntarily provide it and it is strictly necessary for a specific loan product's eligibility assessment.

Where the Platform requests access to device permissions (such as contacts, camera, or location), we will seek your specific, one-time consent for each such permission, will only use it for the stated purpose, and will not seek continuous or background access.

Where you voluntarily provide Aadhaar details for KYC, we accept only masked Aadhaar or Offline Aadhaar XML, and do not perform Aadhaar-based authentication ourselves; any such authentication is performed directly by the Lender or an authorised KYC Registration Agency.

Directly from you, when you register on the Platform, submit a Case or Application, upload documents, or communicate with us (including through calls, emails, or the Grievance Officer).

From a DSA Partner, where you are an Applicant/Client whose loan requirement has been submitted by a DSA Partner on your behalf. The DSA Partner is responsible for obtaining your consent before submitting your Personal Data, as set out in the DSA Partner's own Terms & Conditions.

Automatically, from every Visitor, through your use of the Platform (technical and usage data as described in Clause 3.1), regardless of whether you register or transact on the Platform.

From third parties, such as Lenders, credit information companies (through an authorised Specified User under the Credit Information Companies (Regulation) Act, 2005), and verification agencies, to the extent such third parties share information back with Orenda in connection with your Case or Application.

We process your Personal Data on the basis of your consent, given at the time of registration, submission of a Case or Application, or otherwise on the Platform, in accordance with Section 6 of the DPDP Act.

We may also process your Personal Data for a "legitimate use" recognised under Section 7 of the DPDP Act, including where you have voluntarily provided your Personal Data for a specified purpose and have not indicated that you do not consent to its use, or where processing is necessary for compliance with any judgment, decree, or order, or for compliance with any law for the time being in force.

Orenda does not sell, rent, or trade your Personal Data to any third party for marketing or commercial consideration. Data shared with Lenders or authorized service providers is strictly need-to-know and limited to the facilitation of your specific loan Application.

Once your Personal Data has been shared with a Lender in connection with a formal loan application, that Lender's own privacy policy governs its further processing of your Personal Data, and Orenda is not responsible for the Lender's subsequent use, storage, or disclosure of that data.

Orenda isn't liable for a DSA Partner's independent misuse of your data; you can raise it with the Grievance Officer, and Orenda will act against the Partner under its own Terms, without blocking your direct claim against that Partner.

Orenda may store and process Personal Data on servers located within India or, where permitted under the DPDP Act and any rules made thereunder, in other jurisdictions. We will comply with any restriction on transfer of Personal Data outside India that is notified by the Central Government from time to time.

Notwithstanding the above, Personal Data collected in connection with a loan Application or Case shall be stored exclusively on servers located in India, in accordance with the Reserve Bank of India's applicable guidelines on digital lending, and shall not be transferred outside India.

We retain Personal Data only for as long as necessary to fulfil the purposes described in Clause 5, or as required by applicable law (including limitation periods, tax records, and RBI/KYC record-retention requirements), whichever is longer.

Where you withdraw consent or request erasure under Clause 11, we will erase your Personal Data unless retention is necessary for us to comply with a legal obligation, or is otherwise permitted under the DPDP Act.

On expiry of the applicable retention period, we will erase or anonymise the Personal Data, unless retention is necessary for a legal obligation.

We implement reasonable security safeguards, including access controls, encryption of data in transit, and OTP-based authentication, to protect Personal Data against unauthorised access, disclosure, alteration, or destruction.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and OTPs, as further described in the applicable Terms & Conditions.

In the event of a Personal Data Breach, we will take reasonable steps to contain and remediate the breach, and will notify the Data Protection Board of India and affected Data Principals, where required under the DPDP Act.

To exercise any of these rights, please contact our Grievance Officer using the details in Clause 16.

You may withdraw your consent to the processing of your Personal Data at any time by written request to our Grievance Officer. Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal, and, as set out in the applicable Terms & Conditions, may mean that we are unable to continue processing your Case or Application, or (for DSA Partners) unable to continue your registration on the Platform.

The Platform may use cookies and similar tracking technologies to remember your preferences, authenticate your session, and understand how the Platform is used. You may control cookies through your browser settings; disabling cookies may affect the functioning of the Platform.

The Platform is not intended for use by, and we do not knowingly collect Personal Data from, individuals below 18 years of age, consistent with the eligibility criteria set out in the applicable Terms & Conditions. If we become aware that we have inadvertently collected Personal Data from a person below 18 years of age, we will take steps to erase it.

We will send you transactional communications (such as Case/Application status updates and document requests) as necessary to provide the Platform's services.

Where you have provided your consent under the applicable Terms & Conditions, we, our representatives, and prospective Lenders may also send you informational and promotional communications, including loan offers, via phone calls, SMS, WhatsApp, RCS, and automated dialers, notwithstanding your registration on the National Do Not Call (NDNC) Registry or National Customer Preference Register (NCPR), for the duration stated in the applicable Terms & Conditions.

You may opt out of promotional (but not transactional) communications at any time by writing to our Grievance Officer.

For any question, request, or grievance regarding this Policy or the processing of your Personal Data, please contact:

Email:support@orendafinserv.com | Phone: 7574994463

We will endeavour to acknowledge your grievance within 48 hours and resolve it within 30 days, consistent with the grievance redressal timelines under the applicable Terms & Conditions.