Privacy Policy

1. Who We Are & Regulatory Framework

DSA Plus ("Platform", "we", "us") provides business software tools for loan intermediaries, DSAs, and financial consultants. This policy adheres to the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023.

2. Our Role: Data Processor for Loan Applicants

When a registered DSA Subscriber adds an Applicant's details or initiates a credit check, the DSA acts as the Data Fiduciary who determines the lawful purpose. DSA Plus acts solely as a Data Processor handling automated queries on the DSA's explicit instructions.

Subscribers must obtain valid, informed applicant consent prior to requesting credit reports or KYC fetches.

3. Information We Collect

• Account & Business Profile: Name, mobile number, email, business name, firm address, PAN, GSTIN, and custom branding logo.
• KYC & Applicant Data: Name, date of birth, photo, PAN details, masked Aadhaar verification tokens, bank statements, ITR, GST records, and loan case files provided by the DSA.
• Credit Information: Credit information reports and scores retrieved from authorized credit bureaus (TransUnion CIBIL, CRIF High Mark, Experian, Equifax).
• Payment Information: Handled securely by Razorpay. DSA Plus does not store debit/credit card CVVs, net-banking passwords, or UPI PINs.

4. How We Use Data

We process information solely to:

• Provide lead, case, document, and pipeline management tools to subscribers.
• Execute verification checks explicitly triggered by the user with third-party providers.
• Maintain prepaid wallet ledgers, tax invoices, and package subscriptions.
• Ensure platform auditability, prevent fraud, and comply with legal requirements.

5. Security Standards & Encryption

We enforce industry-standard security including Transport Layer Security (TLS 1.3), AES-256 database encryption, multi-factor authentication (MFA TOTP), and strict role-based access control.

6. Data Retention Policy

• Active account data is maintained throughout the active subscription cycle.
• Financial and tax transaction records are retained up to 8 years as required by Indian taxation statutes.
• Audit and security trail logs are preserved for 180 days in compliance with CERT-In directives.