Privacy Policy

LendShield Technologies Private Limited ("LendShield", "we", "us", or "our") is a technology company incorporated as a private limited company under the Companies Act, 2013 (CIN: U62011GJ2026PTC180383), with its registered office in Ahmedabad, Gujarat, India. We develop and operate lending technology platforms for regulated financial institutions across India.

This Privacy Policy ("Policy") governs the collection, processing, storage, transfer, and deletion of Personal Data and Sensitive Personal Data or Information (SPDI) as defined under applicable Indian laws. It applies to:

• Visitors to our website at lendshield.in
• Prospective and current institutional clients (NBFCs, Banks, HFCs, Fintechs)
• Individuals whose data is processed through our platforms on behalf of our institutional clients
• Employees, contractors, and consultants of LendShield
• Any person who contacts us via email, form, or other communication channels

Our privacy practices are designed to comply with the following laws, regulations, guidelines, and directions issued by competent authorities in India:

We collect only the minimum data necessary for the purposes described in this Policy (data minimisation principle). The categories of data we process include:

We do not directly collect Aadhaar numbers, biometric data, or financial account credentials from end-borrowers through our website. Such data, where processed through our platform on behalf of institutional clients, is governed by the client's consent framework and their obligations under applicable law.

Under the DPDPA 2023 and IT (SPDI) Rules 2011, we process personal data only for specified, explicit, and legitimate purposes. The table below sets out each lawful basis, the precise trigger for its application, and the activities it covers:

We share personal data only in the following circumstances and only to the extent necessary:

We do not transfer personal data outside India except where required by law or expressly consented to. All cross-border transfers (if any) comply with applicable RBI data localisation requirements and the DPDPA 2023 framework.

We retain personal data only for as long as necessary to fulfil the stated purposes, or as required by applicable law:

Upon expiry of retention periods, data is securely deleted or anonymised in accordance with our data destruction procedures.

We implement reasonable security practices and procedures as required under Rule 8 of the IT (SPDI) Rules, 2011 and consistent with the DPDPA 2023. Our technical and organisational measures include:

• Encryption at rest and in transit — All data stored and transmitted using AES-256 and TLS 1.2+ encryption standards.
• Access controls — Role-based access control (RBAC) with principle of least privilege; multi-factor authentication (MFA) for all administrative access.
• Data residency — All data is stored on servers located within India, in compliance with RBI data localisation requirements.
• Audit trails — Immutable logs of all data access, modifications, and deletions maintained for regulatory inspection.
• Incident response — Documented breach detection, containment, and notification procedures in place.
• Employee training — Regular data protection and security awareness training for all staff with access to personal data.
• Vendor assessments — Third-party service providers are assessed for security compliance before onboarding and contractually bound to equivalent standards.
• Secure development — Security is embedded into our software development lifecycle (SDLC) including code reviews and dependency scanning.

Under the DPDPA 2023 and IT (SPDI) Rules 2011, individuals whose data we process directly have the following rights:

To exercise any of the above rights, write to office@lendshield.in with the subject line "Data Principal Rights Request". We will respond within 30 days of receipt of a valid request.

Where we process your data as a Data Processor on behalf of an institutional client, please direct your rights requests to that institution (the Data Fiduciary). We will support our clients in responding to such requests.

Our website (lendshield.in) uses the following types of cookies and tracking technologies:

• Strictly Necessary Cookies — Essential for the website to function (session management, security). These cannot be disabled.
• Analytics Cookies — Used to understand how visitors interact with our website (pages visited, session duration). We use privacy-respecting analytics tools with data stored in India where possible.
• Preference Cookies — Remember your settings and preferences to improve your experience.

We do not use advertising or behavioural tracking cookies. We do not share website visitor data with ad networks or data brokers. You can manage cookie preferences through your browser settings.

In accordance with the Information Technology Act, 2000 and the DPDPA 2023, LendShield has designated a Grievance Officer to address privacy-related concerns. Any grievance related to this Policy should be submitted in writing to:

If your grievance is not resolved to your satisfaction within 30 days, you may escalate to the Data Protection Board of India (once constituted under DPDPA 2023) or seek recourse under applicable Indian law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" at the top of this Policy
• Post a notice on our website for a minimum of 30 days
• Send an email notification to registered users and active clients where the change materially affects them

Your continued use of our services after the effective date of the updated Policy constitutes acceptance of the revised terms.

For any questions, requests, or concerns related to this Privacy Policy, please contact us at: