Last updated
Last updated: 1 July 2026
This policy explains what Finoxa Finance ("Finoxa", "we", "us") does with your information. It applies to this website and to any interaction you have with our advisory team. Please read it alongside our Terms & Conditions.
1. Who is responsible for your data
Finoxa Finance, 4th Floor, Trade Centre, Bandra Kurla Complex, Mumbai, Maharashtra 400051, is the data fiduciary for the personal data described here. Our grievance officer's contact details are in section 11.
2. What we collect
2.1 Information you give us
- Identity and contact details: name, phone number, email address, city, PIN code.
- Financial information: monthly income, employment type, employer name, existing EMI obligations, requested loan amount and tenure, self-declared credit score.
- Identity documents, where you proceed with an application: PAN, Aadhaar (subject to statutory restrictions on its collection and use), address proof, income proof, bank statements, and property documents for secured loans.
- Correspondence: the content of enquiries, messages and call notes.
2.2 Information we collect automatically
- IP address, browser type, device type and operating system.
- Pages visited, time on page, and the referring URL.
- UTM campaign parameters where you arrive from an advertisement or link.
Our first-party analytics stores a salted daily hash of your IP address and user agent rather than the values themselves, so we can count unique visitors without retaining information that identifies you.
2.3 Information from third parties
Where you expressly authorise us to submit a loan application, the lending institution may access your credit information report from a credit information company (CIBIL, Experian, Equifax or CRIF High Mark). We do not access your credit report without that specific authorisation, and submitting an enquiry on this website does not trigger a credit check.
3. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Assessing your eligibility and advising you | Your consent, given when you submit an enquiry |
| Submitting applications to lenders you nominate | Your consent, given for each specific lender |
| Contacting you about your enquiry by phone, email, SMS or WhatsApp | Your consent |
| Sending the newsletter | Your separate consent, withdrawable at any time |
| Fraud prevention, security and rate limiting | Our legitimate interest in protecting the service |
| Meeting statutory record-keeping and KYC obligations | Legal obligation |
4. Who we share it with
We share your information only with:
- Lending institutions you specifically authorise. We name the lender before sharing anything, and we do not circulate your file to lenders you have not agreed to.
- Service providers who host our infrastructure, deliver our email and process documents, bound by contract to use the data only for that purpose.
- Regulators, courts or law enforcement, where we are legally obliged to disclose.
We do not sell your data. We do not share it with third parties for their own marketing, and we do not operate a lead-resale arrangement of any kind.
5. How long we keep it
- Enquiries that do not proceed: 24 months from last contact, then deleted.
- Disbursed loan files: retained for the period required by applicable KYC and record-keeping rules, currently a minimum of eight years.
- Newsletter subscriptions: until you unsubscribe, plus 30 days.
- Analytics records: 26 months, in hashed form.
6. How we protect it
Data is transmitted over TLS and stored on servers with access restricted to authorised personnel on a need-to-know basis. Passwords are stored as bcrypt hashes and are never recoverable in plain text. Administrative access is role-based and every change to a record is logged with the user and timestamp. We apply rate limiting, CSRF protection, input validation and content security policies across the application.
No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the Data Protection Board as required by law.
7. Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- Access a summary of the personal data we hold about you and how it has been processed.
- Correct inaccurate, incomplete or outdated data.
- Erase data we no longer need, subject to our statutory retention obligations.
- Withdraw consent at any time. Withdrawal does not affect processing already carried out, and may mean we can no longer progress an application.
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
- Complain to our grievance officer, and thereafter to the Data Protection Board of India.
To exercise any of these, write to the address in section 11. We respond within 30 days.
8. Cookies and tracking
We use strictly necessary cookies for session management and CSRF protection, which cannot be disabled without breaking the site. Where enabled, we also use Google Analytics 4 and Facebook Pixel to understand traffic and measure advertising. You can block these through your browser settings or a content blocker; the site functions normally without them.
9. Marketing communications
If you submit an enquiry we will contact you about that enquiry — that is the purpose of submitting it. Newsletter subscription is separate and opt-in, and every newsletter carries a one-click unsubscribe link. We do not add enquiry contacts to the newsletter without a separate opt-in.
10. Children
Our services are not directed at anyone under 18, and we do not knowingly collect data from children. Education loan enquiries for a minor student must be submitted by a parent or guardian.
11. Contact and grievances
Grievance Officer: Meera Raghunathan
Email: grievance@finoxafinance.com
Post: 4th Floor, Trade Centre, Bandra Kurla Complex, Mumbai, Maharashtra 400051
We acknowledge grievances within 48 hours and resolve them within 30 days. If you are unsatisfied with our response you may escalate to the Data Protection Board of India.
12. Changes to this policy
We will update this page when our practices change and revise the "last updated" date. Where a change materially affects how we use data you have already given us, we will notify you directly.