Basel Investments Limited is the data fiduciary for personal data processed in connection with a loan it makes. This policy applies to this website, to the Digital Lending Applications through which Basel lends, and to any other channel through which Basel collects personal data.
Who this policy covers
This policy covers borrowers and applicants, visitors to this website, and anyone who contacts Basel through a form on it. Where a Lending Service Provider collects data on Basel’s behalf, it does so under contract and to the standard set out here; Basel remains responsible for that data. The Lending Service Providers engaged are named on our Digital Lending Disclosures page.
What we collect, and why
We collect only what is needed to assess an application, to make and service a loan, and to meet obligations the law places on us. Each category below is collected for a stated purpose, and is not used for a different one.
| Category | Purpose |
|---|---|
| Identity: name, date of birth, PAN, Aadhaar-based identity data | To identify you and meet know-your-customer obligations under law. |
| Contact: mobile number, email address, address | To verify you, to deliver your loan documents, and to communicate about your account. |
| Photograph or selfie | To confirm that the person applying is the person identified, by comparison against the identity record. |
| Bank account details | To verify the account by penny-drop, to disburse the loan and to collect repayments. |
| Bank statements, where you choose to share them | To assess affordability. Sharing statements is optional and is asked for separately. |
| Credit information from credit information companies | To assess creditworthiness, and to report your loan and its conduct as the law requires. |
| Loan and repayment records | To service the loan, maintain the ledger and issue statements and closure certificates. |
| Device and technical data necessary to operate the application securely | To detect fraud, to keep sessions secure, and to diagnose faults. |
Consent, and how to withdraw it
Your consent is taken before data is collected, not inferred from your use of an application. Consent is specific to the purpose stated, and is recorded with the version of the notice you were shown.
You may withdraw consent at any time. Withdrawal is not retrospective, so it does not undo processing already carried out lawfully, and it may mean we can no longer service an application or a live loan. We will tell you plainly what the consequence is before you act on it. Withdrawing consent does not extinguish a debt you owe, and does not stop us processing data we are required by law to retain or report.
What we do not collect
- We do not access your contact list, your call log, your photo gallery or your files for the purpose of assessing or recovering a loan.
- We do not collect or store biometric data, except where the law expressly requires it.
- We do not ask for your OTP, your card PIN, your CVV, your net-banking password or your full card number, in any form, on any channel, at any time. Anyone who does is not acting for Basel.
- We do not sell personal data, and we do not share it for any third party’s own marketing.
Who your data is shared with
Your data is shared only with:
- Lending Service Providers engaged by Basel, to the extent needed to perform the functions published on our Digital Lending Disclosures page. They store the minimum necessary and are contractually bound to this policy.
- Service providers performing identity verification, bank account verification, payments, communications and technology hosting, under contract and only for the purpose for which they are engaged.
- Credit information companies, as required by law, including reporting of your loan and its repayment conduct.
- Regulators, courts and law enforcement, where disclosure is required by law or by a lawful order.
- Professional advisers and auditors, under a duty of confidentiality.
The Lending Service Providers and Digital Lending Applications permitted to collect or receive your personal information are named, with what each one does, on our Digital Lending Disclosures page. That list is updated whenever a partner is added, changed or discontinued.
Where data is stored and for how long
All personal data collected in connection with lending is stored on servers located in India. Where a service provider processes data outside India, any such arrangement is subject to the restrictions the Reserve Bank of India imposes, and data is returned to storage in India as required.
Data is retained for as long as your loan is live and afterwards for the period required by law, including record-keeping obligations under the Prevention of Money Laundering Act, 2002 and the Companies Act, 2013, and for so long as it may be needed to defend a legal claim. After that it is deleted or anonymised.
- Know Your Customer records (identity and address documents, and the records of their verification): five years after your relationship with Basel ends, as the Prevention of Money Laundering Act, 2002 and the rules under it require.
- Transaction records, including repayments: five years from the date of the transaction, under the same law.
- Loan account records and books of account: eight years from the end of the financial year they relate to, as the Companies Act, 2013 requires.
- Enquiries made through this website that do not become a loan: three years from your last contact with us about them, after which they are deleted.
- Grievance records: five years from the date the complaint is closed.
Where a record is needed to bring or defend a legal claim, it is kept until that claim is finally disposed of, even if a period above has passed.
Security
Basel applies technical and organisational measures appropriate to the sensitivity of the data it holds, including access control on a need-to-know basis, encryption of data in transit and at rest, logging of access, and periodic review. No system is perfectly secure, and we do not claim otherwise. Where a personal data breach occurs, Basel will notify affected individuals and the relevant authority as the law requires.
Your rights
- To be told what personal data of yours we hold and how it is processed.
- To have inaccurate or incomplete data corrected.
- To have data erased where we are no longer required to keep it.
- To withdraw consent, subject to the consequences described above.
- To nominate another person to exercise these rights on your behalf.
- To complain, first to us, through the grievance route, and then to the relevant authority if you are not satisfied.
This website
This website collects only what you submit through a form on it: your name, contact details and your message. That is used to respond to your enquiry and for no other purpose. The forms carry hidden fields used solely to filter out automated submissions.
This website does not set advertising or cross-site tracking cookies. Where any analytics or cookie is introduced, this section will name it, state its purpose and describe how to refuse it, before it is deployed. As at the date of this policy, this website sets no analytics, advertising or cross-site tracking cookie of any kind. The only cookie it sets is the session cookie used to keep Basel’s own staff signed in to the administration area, which a visitor never receives.
Children
Basel does not lend to persons under 18 and does not knowingly collect the personal data of a child. Where we learn that we have, it is deleted.
Changes to this policy
This policy is approved by the board and reviewed periodically. Where a change materially affects how your data is used, you will be told before the change takes effect, and where the law requires it, fresh consent will be taken.
How to contact us
Questions about this policy, or a request to exercise any right in it, may be sent to Basel at [email protected] or to the registered office at SCF 80, Back Side, 2nd Floor, Sector 47-D, Chandigarh 160047, India.
Questions about how your personal data is processed are answered by Basel’s Grievance Redressal Officer, whose name, email address, telephone number and postal address are published on the Grievance Redressal page. Write to that officer, marking your message “personal data”. If Basel is later required to designate a Data Protection Officer, that person’s contact details will be published here.