Zenzy Privacy Policy

ZENZY PRIVACY POLICY

Last Updated: 26th Aug 2026

Thank you for choosing Zenzy (hereinafter referred to as "Zenzy" or "this App"). Zenzy is managed and operated by BeeRupii Innovation Private Limited (hereinafter referred to as "we" or "us" or "our"). Zenzy is a platform that provides you access to various services as set out in the Terms of use. We collect and use your personal information and sensitive personal data and information, as defined under the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 including its amendments from time to time read with the Digital Personal Data Protection Act, 2023 and the rules, standards and directions framed thereunder, as and when notified and to the extent in force, (hereinafter referred to as "personal data"), when you use our website, this App and/or products and services made available on the App, either by us or through any of our partners. 

In this Privacy Policy, we explain the purposes, method and scope of the collection and use of your personal data by this App, your rights in relation to your personal data, and the security measures we take to protect it. 

REGULATORY COMPLIANCE STATEMENT 

This Privacy Policy has been prepared in strict compliance with: 

Information Technology Act, 2000 (IT Act) and corresponding rules
Digital Personal Data Protection Act, 2023 (DPDP Act) and corresponding rules
Reserve Bank of India Digital Lending Guidelines and Directions, to the extent applicable to the Company
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
Other applicable acts, regulations and guidelines issued by regulatory authorities including the RBI

OPERATING MODELS 

The App operates on two distinct models, which may run in parallel: 

1. H5 REFERRAL LINKS AND BANNERS

Under this model, the App functions as a lead-generation and traffic platform. When you express interest in a product or service (including credit products offered by our partners), you are redirected to the concerned partner's own journey, application or webpage (including through H5 or similar integrations). Each such partner independently carries out its own customer onboarding, verification, processing, underwriting, credit decisioning and servicing, and independently determines the purposes and means of processing your personal data in that journey. In this model, we facilitate discovery and referral. We do not share your personal data with the partner and only provide the redirection, as described in this Privacy Policy. 

2. LOAN MARKETPLACE MODEL 

Under this model, the App enables you to access the Company's Platform and, subject to the Company determining that it is appropriate, submit an application for a loan ("Loan Application") to one or more regulated lending entities that have partnered with the Company (each a "Regulated Entity" or "Marketplace Partner"). We collect certain information from you within the App and share such information with the relevant Marketplace Partner, to the extent required, solely to enable your Loan Application and to facilitate matching with the Marketplace Partner's minimum eligibility criteria. The Marketplace Partner independently carries out its own verification, underwriting, credit assessment, loan approval or rejection, sanction, disbursement, collection and loan servicing, and independently determines the purposes and means of processing your personal data for these subsequent steps. We do not take, and are not responsible for, any credit or lending decision.

DATA FIDUCIARY ROLES UNDER DPDP ACT 2023 

For the purposes of the Digital Personal Data Protection Act, 2023 ('DPDP Act'), the party that determines the purpose and means of processing depends on the model and stage involved:

a) We act as a Data Fiduciary for the personal data we collect and process at our end, including to operate the App and provide you services. Certain of our technology, verification and operations service providers process such data as Data Processors engaged by us, solely on our instructions.

b) Each Third party Partner or Marketplace Partner acts as an independent Data Fiduciary in respect of underwriting, credit decisioning, disbursement and loan servicing, and the Marketplace Partner's own privacy policy will additionally govern the processing carried out by it. We recommend you go through the privacy policies of such third parties. Under the H5 Referral Links and Banners model, the concerned partner is the independent Data Fiduciary in respect of all personal data collected from you within its own journey.

YOUR CONSENT & ACCEPTANCE 

Before using this App, please read this Privacy Policy carefully to learn our practices for the protection of users' personal data. If you do not agree with the terms of this Privacy Policy, you can turn off Zenzy by clicking "Exit APP" and we will not be able to provide you with the services related to this App. If you click "Agree to the above", it means that you fully and clearly understand and expressly consent to the following terms regarding, amongst other things mentioned herein, data collection and usage, your rights to your personal data, and our sharing and processing practices. Your continued access to or use of the App following any update to this Privacy Policy shall also be deemed to constitute your acceptance of such updated terms, to the maximum extent permitted by applicable law. 

I. HOW AND WHAT TYPES OF PERSONAL DATA WE PROCESS 

We collect personal data for providing you with the service(s) made available on this App, more efficient operation(s) and to improve and evolve the user experience. Our channels to collect personal data include: (1) data directly provided by you to us; (2) data obtained during your use of this App; and/or (3) data obtained about you from third parties. The data we collect depends on the products and services you apply for, avail or use, the environment in which you interact with us, the choices you make (including permissions) and the products and features you use. However, we will not collect, store, use, process, transfer and/or disclose your transaction information/data and/or your personal data in any manner in which we are prohibited by the NPCI, RBI and other applicable regulations and laws. 

1.1 REGISTRATION & ACCOUNT CREATION DATA 

To use Zenzy, you need to register first. During the registration process, you only need to provide your mobile phone number and complete the registration by using the verification code/OTP. We collect this information to provide you with login services and protect your account security. We may also require additional verification information where we consider it reasonably necessary to prevent fraud, unauthorized access or misuse of the App. 

Data Category	Purpose	Mandatory/Optional	Consent Type
Mobile Number	Login, OTP, Account Recovery	Mandatory	Recurring
Email Address	Communication, Account Verification	Mandatory If Services Availed	Recurring
Name	Account Identification	Mandatory If Services Availed.	Recurring
Device Id	Security, Identity Verification	Mandatory	Recurring

1.2 PERSONAL INFORMATION COLLECTED

Zenzy is a Loan Marketplace that has partnered with Regulated Entities to facilitate access to their lending products. Zenzy helps you connect with these Marketplace Partners, thereby enabling you to avail products offered by them, such as loans and other financial products, which shall vary from partner to partner. We may collect the following information from you with your explicit consent for processing and matching eligibility of your Loan Application with our partners:

Name,
Gender,
Date of birth,
Address and postal code,
PAN,
Education details,
House ownership details,
Salary account details,
Name of the bank where you have a primary account,
Details regarding your employment, comprising years of experience,
Details of income,
Name of current and previous employers,
Details regarding the years/months completed with the current employer.

1.3 FINANCIAL & TRANSACTION SMS DATA 

We collect and monitor only your financial/transaction SMS, to assess your indicative eligibility against the minimum eligibility criteria of our Marketplace Partners and to facilitate your Loan Application. No personal SMS data is read or stored. We may use this information collected from your mobile device to carry out data analytics to improve the user experience, enhance performance, and accomplish desired results. 

Key SMS Data Handling Principles: 

a. Financial SMS Only: We collect only transaction-related SMS, NOT personal messages 

b. Data Retention: Maximum 90 days post collection, after which automatic deletion occurs 

c. One time Consent: SMS access is sought as a one-time permission at the time of when granted and is not accessed on a recurring or ongoing basis thereafter, unless necessary

d. Data Anonymization: When we use your data for analytics, data is pseudonymized/anonymized to uphold your privacy 

e. User Control: Users can revoke SMS consent anytime through app settings 

1.4 LOCATION & GEOLOCATION DATA 

This app collects your location details to verify serviceability, determine eligibility for financial services, and detect unusual activity to prevent fraud. Location data is used only at the time of verification and is NOT collected when the app is running in the background. No collection occurs until you provide explicit consent. 

Critical Location Privacy Guarantees: 

1. One-Time Collection: Location is collected only once at registration for serviceability check 

2. No Background Collection: Location data is NOT collected when app is running in background 

3. Specific Use Case: Location is used only for serviceability verification and fraud detection 

4. Explicit Consent Required: No implicit or default collection - user must actively grant permission 

5. Revocable Anytime: Users can revoke location consent through device settings anytime 

1.5 DEVICE & HARDWARE INFORMATION 

To provide you with notification and push functions, we may collect your device information including your device model, operating system version, etc. The Notification and Push services include App update and installation, sales and promotion data, etc. You can stop receiving data through "Settings" on your device. 

Platform-Specific Data Collection: 

Permission	Android	Purpose
SMS Access	Mandatory	Transaction Analysis
Device ID	Mandatory	Identity Verification, Fraud Prevention.
Location	Mandatory (One-Time)	Serviceability, Fraud Detection
Camera	Mandatory	To Facilitate Document upload

For cyber security protection, ensuring normal operation of this App and your account security, and improving and optimizing your service experience, we may collect data about your device and how you and your device interact with this App, such as device brand, device model, device ID, network status, operating system version, App version, App information (App name, APK name, update time, etc.) and other device data. We will also record the operational behaviours of your account after login (including changing the password, modifying the bound mobile phone number/email address, complaints record, etc.), time and duration of your use of this App, search query terms entered through the service, and software event data (such as reboots, upgrades, errors, crashes, etc.). 

With your consent, we may collect information about the applications installed on your device. This is limited to identifying payment-related applications (such as UPI or wallet apps) already available on your device. This helps us provide you with more accurate and relevant payment method options through our partners. We do not collect, store, or use this information for any purpose other than improving your payment experience. We may, however, generate aggregated statistics on usage of such payment methods which do not identify you personally. 

Zenzy will access the clipboard content when you click on a certain coupon code in coupon center. Clipboard data is accessed only for the limited purpose of enabling the coupon-related functionality and is not retained beyond what is strictly necessary for that purpose. 

1.6 PURPOSES OF PROCESSING

We process your personal data only for the purposes set out below and, where required under applicable law, on the basis of your consent:

to create, verify and maintain your account and to enable you to access and use the App;
to enable you to discover products, offers and services of our Marketplace Partners and other partners, including through H5 referral links and banners displayed on the App;
to enable the submission of your Loan Application to a Marketplace Partner and to match the information provided by you against that Marketplace Partner’s minimum eligibility criteria;
to verify serviceability and to prevent, detect and investigate fraud, security incidents, unauthorised access and other misuse of the App;
to provide customer support and to respond to your queries, requests and grievances;
to send you service and transactional communications and, unless you opt out, promotional communications;
to carry out analytics on a pseudonymised or aggregated basis in order to improve the App and our services; and
to comply with applicable law and to establish, exercise or defend legal claims.

We do not carry out any underwriting, credit assessment, credit decisioning, sanction, disbursement, servicing, collection or recovery in respect of any credit facility, and we do not process your personal data for any of those purposes.

II. HOW WE RETAIN YOUR PERSONAL DATA 

Your personal data that is collected or generated in India will be stored on our server located within India only. The retention period of the personal data we collect is the minimum amount of time required to achieve the purposes of collection stated in this Privacy Policy, unless otherwise required by laws or regulations. We may also retain data for such additional periods as may be necessary for the establishment, exercise or defense of legal claims, for audit, regulatory or compliance purposes, or for legitimate business purposes as permitted by applicable law. 

SPECIFIC RETENTION PERIODS: 

Marketplace Users (No Loan Availed): 6 years from date of registration or last activity, whichever is later
Marketplace Users (Loan Availed): 10 years from date of last service completion or last activity, whichever is later
Financial SMS Data: Maximum 90 days from collection date, then automatically deleted

If we stop operating some or all of our products or services for special reasons, we will promptly inform you and stop the collection and processing of personal data by the related products or services, and we will delete or anonymize the personal data we hold that is related to the said products or services, unless required for migration/transfer purposes or otherwise required by laws and regulations. 

III. HOW WE SHARE YOUR PERSONAL DATA 

We may, from time to time, share and transfer some personal data with our affiliates, processors, service providers and the partners that work with us to provide products and services, in order to provide the products or services you request. We do not sell your personal data, but we may share it, only on a need basis, in accordance with this section for our legitimate business purposes and those of our partners, subject to applicable law and to the extent required.

1. Affiliates. We may share your personal data with our affiliates in India. We will only share necessary personal data, and only for the purposes stated in this Privacy Policy. If we or our affiliates change the use and processing purpose of personal data, we will seek your authorization again. Our affiliates shall be bound by confidentiality and data protection obligations no less protective than those described here.

2. Service Providers. Some of our services are provided jointly by us and third-party service providers solely for the purposes stated in this Privacy Policy. We may entrust such third parties to process your personal data on our behalf — for example, companies that send text messages, WhatsApp messages, RCS or emails, and provide technical support on our behalf. These companies may use your personal data solely to provide services to you on our behalf. We require such service providers to implement appropriate security measures and to process your personal data only in accordance with our written instructions and applicable law.

3. Marketplace Partners. We share your personal data with our Marketplace Partners, to the extent required, solely to enable your Loan Application and to facilitate matching with the Marketplace Partner's minimum eligibility criteria, as further described in this Privacy Policy. You authorize us and the relevant Marketplace Partner to contact you via phone, SMS, RCS, WhatsApp, or email for informational purposes related to your Loan Application. You further authorise the relevant Marketplace Partner to evaluate your creditworthiness, including by obtaining your credit information from credit information companies. Such Marketplace Partners are responsible for their own compliance with applicable data protection and telecommunication laws when contacting you, and their own privacy policy will additionally govern the processing carried out by them. We recommend you review the privacy policies of such Marketplace Partners. Under the H5 Referral Links and Banners model we do not share your personal data with the partner; you are redirected to the partner’s own platform, where the partner collects your personal data directly from you under its own privacy policy.

4. Law Enforcement & Regulatory. We may disclose your personal data to third parties as required by law or if we reasonably believe that such action is necessary (a) to comply with a subpoena or other legal proceedings, legal actions or government agency requests, (b) when we believe in good faith that disclosure is necessary to comply with the law and reasonable requests of law enforcement, (c) to protect and exercise our legal claims, rights and property, (d) to protect your rights, property or personal safety or that of others, (e) to investigate fraud, or (f) to protect the security or integrity of our services.

5. Otherwise with Your Consent. After obtaining your explicit consent, we may disclose the personal data you have authorized to certain other third parties. You may withdraw such consent as described in this Privacy Policy; however, withdrawal will not affect processing already carried out based on your prior consent.

IV. HOW WE PROTECT YOUR PERSONAL DATA 

We have taken reasonable and feasible technical security and organizational measures to protect the data collected in relation to the services. We have adopted security measures to protect the personal data you provide, and to prevent unauthorized access, public disclosure, use, modification, damage or loss of the data. We will take all reasonable and practical steps to protect your personal data, including: 

We will use SSL and other mainstream security technologies to encrypt many of our services
We will examine our practice of data collection, storage, and processing (including physical security measures) on a regular basis to prevent unauthorized access to or tampering with various systems
We will strictly control access to personal data, and only allow our representatives who need to know the personal data to help us process such data, and personnel of companies authorized to handle the services on our behalf to access such personal data
These employees and personnel are required to fulfil strict contractual confidentiality obligations.
Access logs of personal data will be kept and periodically audited
We will adopt encryption and other security measures to transmit and store your personal data of particular types

We will adopt reasonable standards to protect your personal data and actively seek relevant security and privacy protection certifications. However, to the maximum extent permitted by applicable law, we do not guarantee that our security measures will prevent all unauthorized access, and we shall not be liable for any loss or damage caused by any unauthorized access or use that is beyond our reasonable control. 

However, please note that while we have taken reasonable steps to protect your data, no website, Internet transmission, computer system, or wireless connection is absolutely secure. In the event of a personal data security incident, we will act in accordance with the requirements of relevant laws and regulations and, where required, inform you by appropriate means. 

V. YOUR RIGHTS TO YOUR PERSONAL DATA 

We respect your rights to your personal data. Subject to the applicable law in your jurisdiction, you may have specific rights regarding your personal data, including the right to be informed, to access, to correct, to delete, to cancel your account, to withdraw consent and to complain. 

We may decline to act on a request where we are unable to verify your identity, where the request is manifestly unfounded or excessive, or where we are required or permitted by law to retain the relevant data. 

Exercising your rights may affect the availability or quality of certain services or features; to the extent permitted by law, we are not responsible for any inability to provide services arising from your decisions regarding your rights. 

YOUR RIGHTS UNDER THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 

Subject to and in accordance with the DPDP Act, you (as a Data Principal) have the following rights in respect of the personal data for which we are the Data Fiduciary: 

Right to access information: to obtain from us a summary of the personal data being processed and the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom your personal data has been shared, along with a description of the data so shared
Right to correction and erasure: to seek correction, completion or updating of your personal data, and to seek erasure of personal data that is no longer necessary for the purpose for which it was processed, unless retention is required by law
Right of grievance redressal: to have a readily available means of registering a grievance with us in respect of any act or omission regarding the processing of your personal data or the exercise of your rights, which we will respond to within the period prescribed under applicable law
Right to nominate: to nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity
Right to withdraw consent: to withdraw your consent at any time, with the withdrawal being as easy as giving consent. You may give, manage or withdraw your consent through the consent mechanisms provided within the App (including, where applicable, through a registered Consent Manager). Withdrawal of consent will not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal, and, where a credit facility has already been availed, certain data may continue to be processed and retained by the Marketplace Partner as required to service the facility and to comply with law

In addition, in relation to any credit facility facilitated through the App, you have the right to give or deny consent for the use of specific personal data (including the right to restrict its disclosure to third parties), to revoke previously granted consent, and to require us to delete the personal data collected from you, in each case in accordance with applicable law and subject to any legal or regulatory requirement to retain such data. 

If you are not satisfied with the resolution of your grievance, you may make a complaint to the Data Protection Board of India in the manner provided under the DPDP Act. You may exercise your rights, and register any grievance, by contacting our Grievance Officer / Data Protection Officer using the details set out in the sections titled 'Grievance Redressal, Data Protection Officer and Nodal Officer' and 'Contact Us' below. We may require information reasonably necessary to verify your identity before acting on a request. 

VI. HOW WE PROCESS CHILDREN'S PERSONAL DATA 

Our products or services are mainly adult-oriented. Pursuant to the relevant laws and regulations, if you are a child, before using the relevant products or services, you shall obtain consent from your parents or legal guardians. If you are the child's guardian, you should read this Privacy Policy carefully before you assist the child with registration or usage of the products or services. We treat anyone under 18 years old (or equivalent minimum age for full legal capacity in the relevant jurisdiction) or under the age of 21 years for whom a legal guardian has been appointed as a child. 

In accordance with the Digital Personal Data Protection Act, 2023, we will not process the personal data of a child (any individual below the age of eighteen years) without obtaining verifiable consent of the child's parent or lawful guardian in the manner prescribed under applicable law. We will not undertake any processing of a child's personal data that is likely to cause a detrimental effect on the well-being of the child, and we will not carry out tracking, behavioral monitoring or targeted advertising directed at children. The credit products of Marketplace Partners accessible through the App are intended solely for individuals who are eighteen years of age or older and otherwise competent to contract. 

If you are a child, a parent or legal guardian of a child, or if you otherwise find out that we collect, store or use data that may include personal data of children, you may contact us promptly in the manner disclosed in this Privacy Policy and we will take steps to delete the relevant data as soon as possible, subject to any legal obligations to retain such data. 

VII. THIRD-PARTY SERVICE PROVIDERS AND THEIR SERVICES 

Our websites, products, applications, and services may contain links to third-party websites, products, and services. You can choose whether to visit or accept websites, products, and services offered by third parties. We have no control over third-party privacy and data protection policies as such third parties are not bound by this Privacy Policy. Before you submit personal data to third parties, please refer to their privacy policies. We are not responsible for and shall not be liable for any collection, use, sharing or other processing of your personal data by such third parties, or for the content, security or practices of any third-party sites or services. 

VIII. HOW THIS PRIVACY POLICY IS UPDATED 

This Privacy Policy is subject to updates or revisions from time to time. We will, as appropriate, send you notifications of material updates to this Privacy Policy in a form we deem appropriate and we will update the "Last Updated" date mentioned at the beginning of this Privacy Policy. This Privacy Policy allows adjustments; however, without your express consent, we will not diminish your rights under this Privacy Policy. This Privacy Policy shall come into force as of the date of update. Your continued use of the App after any such update shall, to the extent permitted by law, be deemed to constitute your acceptance of the updated Privacy Policy. 

IX. GRIEVANCE REDRESSAL, DATA PROTECTION OFFICER AND NODAL OFFICER 

We have put in place a grievance-redressal mechanism to address your questions, concerns and grievances regarding this Privacy Policy, the processing of your personal data and the exercise of your rights. You may contact: 

(i) Grievance Officer (Information Technology Rules): responsible for receiving and redressing grievances under the Information Technology Act, 2000 and the rules framed thereunder. 

Name: Jay K

Email: Grievance@getzenzy.com

Address:GoodWorks Akshay Tech Park, 3rd Floor, Plot No. 72 & 73, EPIP Zone, Whitefield, Bengaluru – 560066, Karnataka, India  

We will acknowledge your grievance and resolve it within the time prescribed under applicable law. 

(ii) Data Protection Officer / Person Able to Answer Questions (DPDP Act): the person designated to answer, on our behalf, your questions about the processing of your personal data under the Digital Personal Data Protection Act, 2023. 

Designation: Data Protection Officer
Email: Grievance@getzenzy.com

(iii)Nodal Grievance Redressal Officer : responsible for dealing with complaints and grievances relating to the credit products of Marketplace Partners accessed through the App, in accordance with the Reserve Bank of India's directions on digital lending. 

Name: Jay K

Email: Grievance@getzenzy.com

Contact number: +91 91879 79122

If your complaint or grievance relating to a credit facility is not resolved within the timelines prescribed by the Reserve Bank of India, you may escalate it to the concerned Marketplace Partner's grievance-redressal mechanism.

Contact details of the Grievance Officer, the Data Protection Officer and the Nodal Grievance Redressal Officer are also displayed within the App and on our website, and are updated from time to time. 

X. CONTACT US 

If you have any questions or concerns about our Privacy Policy or related practices, please contact us at the following address: 

Address: BeeRupii Innovation Private Limited

Email: support@getzenzy.com

Website: www.getzenzy.com 