Privacy Policy

At Finsec AA Solutions Private Limited (henceforth "OneMoney", "our," "us" "Company" and "we") we want to ensure that you have complete control over the means and manner in which you wish us to process your data. When you choose to use "OneMoney" website ("Website"), you provide us certain data, the processing of which will be governed under this Privacy Policy. Reference to the term "Website" in this Privacy Policy shall include the mobile application "OneMoney", and / or any other software / application, as the case maybe, through which you (a) access the Website, or (b) avails online services from Company. Reference to the terms "User", "you" "your" and "yours" shall mean any individual who accesses, uses, or registers on our Website including but not limited to individuals whose data is collected, received, stored, processed, or otherwise handled by us as per the Applicable Law.

We are committed to complying with all Applicable Law(s) while collecting, processing, storing, and transferring your personal data. This includes adherence to the Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016 ("Master Directions") as issued and updated by the Reserve Bank of India, the technical standards issued by ReBIT for the Account Aggregator framework, and all other relevant laws, regulations, and guidelines in force from time to time, the Information Technology Act, 2000, the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, the Digital Personal Data Protection Act, 2023 and rules as amended from time to time.

This Privacy policy, along with the "Terms of Use" constitutes an "electronic record" in the form of an "electronic contract" as defined under the Information Technology Act, 2000 between "Company" and the User of this Website. This Privacy Policy does not require any physical, electronic or digital signature.

This Privacy Policy forms an integral part of the "Terms of Use" of the Website. If you do not agree with the terms of this Privacy Policy please do not use this Website. By visiting this Website you (a) unconditionally accept, and agree to be bound by the "Terms of Use" of the Website, read with this Privacy Policy; (b) expressly consent to the collection, receipt, possession, storage, usage, dealing, handling or transfer of your personal information by Company in accordance with the terms of this Privacy Policy.

This Privacy Policy is only applicable to our Website and not to any other Products as owned by or other Business applications and websites that you may access through our Website, each of which may have data collection, storage, and use policies that are different from our Privacy Policy.

ABOUT US

OneMoney is licensed by the Reserve Bank of India ("RBI") to provide Account Aggregator ("AA") services, whereby OneMoney facilitates passage of financial information such as details of bank deposits, SIPs, Commercial Papers, equity shares, securities etc. of the User, in an encrypted manner as per the Master Directions from entities known as Financial Information Providers ("FIPs"), which are institutions that hold or manage the User's financial information. OneMoney then transfers such information, in encrypted form and only as per the User's explicit consent for an Financial Information User ("FIU"), or explicit self-consent where the User chooses to view, or store on a device of her choice or use in any manner she deems fit her own information in accordance with the Master Directions ("Services"). OneMoney cannot view, read or store the User's financial information.

NATURE, CATEGORIES OF COLLECTED DATA AND ITS PURPOSE

You provide and we collect the following data from you, in order to provide you our Services. The data referred to below may be collected or received by Company (a) directly from the User, when the user either provides any specific information on the Website; or (b) from use of the Website by the User; or (c) from FIP who have collected any Information relating to the User, and who have shared it with Company based on the consent of the User; or (d) from the FIU through which you access OneMoney, such as your mobile number and the identifiers of the FIPs where your accounts may be held.

• Account Information: When you log in to the OneMoney Website, we collect your mobile number to facilitate secure sign-up and authentication and to maintain the account of the User. If you choose to add an alternate mobile number for discovering and linking your accounts, we collect that number as well. Both numbers are linked to your Virtual User Address (VUA). Further, any additional user information that may be required by ReBIT (Reserve Bank Information Technology Private Limited) or any other regulatory authority shall also be collected to ensure compliance with Applicable laws.
• Profile Information: We may collect your name and, where you choose to provide it, your email address (verified through OTP), to maintain your account profile and send you service communications. Sensitive details are shown in masked form in your profile.
• Account Discovery Identifiers: To help you find your accounts, you need to provide your PAN or date of birth along with your mobile number. These are used only to discover your accounts with the selected FIPs, are not stored by OneMoney in readable form, and are retained only in masked form for audit purposes.
• FIP Identifiers from the FIU: Where the FIU that redirected you to OneMoney passes the identifiers of specific FIPs, FIPs will discover your accounts in their systems and share the information with OneMoney, as per the Sahamati redirection guidelines, within the framework of RBI regulations and ReBIT guidelines. These identifiers are used only for account discovery in your current journey.
• Browsing Information: We may collect information such as the internet protocol ("IP") address of your computer, the type of browser, operating system of the user's device and details of usage of the Website. This information is collected through various ways including by placing "cookies", i.e. text files placed on your computer, to help the Website analyze how users use the site. To ensure a secure web session and prevent unauthorized access to your information, a browser fingerprint is created from attributes such as operating system, browser type and version, screen resolution, time zone and keyboard layout. It is linked to your session to confirm that the session continues on the same browser and device. If the fingerprint changes, the session ends and you will need to log in again; access from a new browser or device may require additional verification.
• SIM and Device Binding (Mobile App): As required under the Account Aggregator framework and ReBIT standards, OneMoney binds your account to your registered mobile number(s), SIM and device so that only you can access it. We will ask for your consent in the app before SIM and device binding begins.
  • SIM binding: With your permission, the app sends a one-time SMS containing a unique verification code from your registered mobile number to OneMoney. We then send an OTP to that number, which the app reads automatically; manual OTP entry is not allowed. Standard SMS charges from your mobile operator may apply. Mobile data must be switched on during this step. If you add an alternate mobile number, it is also SIM-bound to the same device.
  • Device binding: We create a unique device identifier derived from the app ID, device ID and your registered mobile number, and link it to your OneMoney profile. We also record the device model and operating system version.
  • Device integrity: We check whether your device is rooted or jailbroken, and do not allow the app to be used on such devices, to protect your data.
  • Change of SIM or device: If you change your SIM or device, the earlier binding is removed and you will need to verify again through OTP before continuing.

• Viewing, Using or Storing Your Own Financial Information (Self-Consent), where available: OneMoney platform may allow you to fetch and view your own financial information from your FIPs. In this case you act as the FIU, and the following applies:
  • You can create a consent request based on the selected parameters (such as accounts, data range and duration). The consent request shall be approved by You and Data is fetched only based on the approved consent parameters.
  • The encryption keys are generated on your device. Your financial information is decrypted only on your device and remains on your device. OneMoney's servers cannot access, read or store it.
  • If you download your information, the file is protected with a password or similar security feature, carries a watermark or some differentiator showing it was downloaded through OneMoney, and personal details in the profile section are partially masked.
  • You will receive a notification on your activity timeline for each successful data fetch. We keep a record only of the fact that a fetch, view or download occurred (date, time and status), never its content.
  • Downloaded files are stored on your device under your control; OneMoney is not liable for the security of the files, as Onemoney shall not access, store or delete the files.
• Notification Token: If you use the OneMoney mobile app, we store a notification token issued by Google or Apple to send you alerts about your consents and account. Notifications do not contain your financial information.

Device identifiers, SIM binding data and browser fingerprints are encrypted before transmission and storage, and are used only for authentication, fraud prevention and securing your account. They are never shared with FIUs or third parties. We do not use device identifiers, browser fingerprints or any other technologies for tracking or advertising purposes. All data is processed in accordance with applicable data protection laws, and we take appropriate technical and organizational measures to protect it from unauthorized access or misuse.

• Geographical Information: We may collect the geographical location of the User to help detect and prevent security-related issues, unauthorized access, or potential fraud. This information is used solely to enhance the security and integrity of our services. By using our services, you consent to the collection and use of location data for these security purposes.
• Aggregated Information: Anonymized and Aggregated information of Users is collected solely for the purpose of conducting service delivery related analytics and statistics, within the framework of Master Directions and the Digital Personal Data Protection Act, 2023 and any other applicable laws, to enhance the quality and relevance of services provided. Such information is not used to identify or track information about individuals, but is used on an aggregate level to enhance our services, improve the on-line experience, enhance your use of the Website, compile efficiency reports on online activity, provide other services relating to Website activity etc., within the framework of Master Directions, Digital Personal Data Protection Act, 2023 and any other applicable laws.

In addition to the purposes as aforementioned, the above mentioned data is collected for the following purposes:

• To fulfil/complete your requests for the services offered, subscribed or availed by you on the Website.
• To bind your account to your registered mobile number(s), SIM and device, authenticate your account and secure your sessions, as required under the Account Aggregator framework;
• To share journey status updates (the action attempted and its success or failure only) with the FIU that redirected you, so that the FIU can assist you in completing your journey;
• Where available, to enable you to fetch to view or store on a device of your choice or use in any manner you deem fit your own financial information on your device under a consent you create and approve;
• Respond to any inquiries posed by the User;
• To deliver to you any administrative notices, money alerts, advice, notifications and communications relevant to your use of services on the Website;
• To analyse Website usage and improve the services offered;
• Customization, administration etc. of the Website, location of errors, Website testing, data analysis for the Website etc;
• Provision of various services on the Website through Company and its partners;
• To protect integrity of the Website, improve our platform, prevent or detect fraud or abuse of our Website;
• To conduct analytical studies on various aspects including user behavior, user preferences etc.
• To trace computer resources of any person for the purposes of determining compliance with the provisions of the Information Technology Act, 2000 and / or any other law for the time being in force.

DATA SHARING

Your encrypted data is securely processed through us strictly in accordance with the purpose for which you have provided consent. As an Account Aggregator, we operate on a consent-centric model and facilitate the sharing of your financial information solely between the FIP and the FIU, based on your explicit consent. Other than enabling this regulated and consent-driven data flow between FIPs and FIUs, we do not share your data with any third party. We do not sell, rent, or trade your data. Any other sharing occurs only with your explicit consent in certain limited circumstances as described below:

• Business Transfers: In the event of a merger, acquisition, restructuring, sale of assets or business, or insolvency, or partnerships to promote Account Aggregator services within the framework of applicable regulations and laws, your information may be transferred as part of the transaction. We will take reasonable steps to enjoin that the recipient of such information uses and protects your data in a manner consistent with this Privacy Policy. Any such third party will have the right to continue using your information as per the terms in place at the time of transfer.
• Government and Legal Obligations: We may disclose your information to government authorities or other third parties if required by applicable law, legal process, or pursuant to valid requests such as court orders, or government demands. This includes disclosures necessary to comply with legal obligations or protect our rights, interests, or safety, or those of our users or others.

Journey Status Updates to the FIU: To help the FIU that redirected you understand where your journey is pending or was not completed, OneMoney shares journey status updates with that FIU. These contain only the action you attempted and whether it succeeded or failed (for example, account discovery attempted, accounts discovered, accounts linked, OTP verified, etc). These updates never include the names of your FIPs, your account details, OTPs, API responses or any other sensitive information.

DATA RETENTION

We process your data in accordance with Applicable Regulations and Laws. The data is processed in infrastructure that meets industry-standard security practices and is located within India, as mandated by applicable regulations. All data is processed or temporarily stored within India, as required under the AA regulatory framework. Your data is retained only for the duration necessary to fulfil the purposes for which you have given consent and as long as you continue to avail our Services. Where you view, or store on a device of your choice or use in any manner you deem fit your own financial information through self-consent, that information is decrypted and kept only on your device and is not retained by OneMoney. SIM and device binding data is retained while the device remains registered to your account, and is deleted when you remove the device or close your account, except where retention is required under Applicable Law. If you choose to withdraw consent or stop using our Services, you may revoke your consents and delete your data, related to what is shared when you downloaded our application, through the "Delete Your Data" section of this Privacy Policy.

PRIVACY CONTROLS

We believe in empowering you with full control over your data. To ensure transparency and control, we provide the following tools and mechanisms on our Website

• Review Your Data: You can view the data you have shared with us, your consents, and the history of actions and data fetches under each consent. This information is accessible via your user dashboard on our Website. Where self-consent is available, you can also view your own financial information within the Website or store such information on a device of your choice or use in any manner you deem fit; such information is decrypted and displayed only on your device.
• Manage Your Devices: You can view all devices registered to your OneMoney account and remove any old or unrecognised device from the OneMoney mobile app. A limit applies to the number of devices that can be registered to an account.
• Delete Your Data: If you no longer wish to use our Services, you may choose to delete your data by sending a mail to [email protected]. In furtherance to such action, any data retained will no longer be further processed in any manner and such data shall only be retained if the same is necessary for compliance with any Applicable Law, regulatory requirements and RBI Master Directions. Please note, however, that any data you have explicitly consented to share with FIUs or other regulated entities for a specific purpose is governed by their own Data Policies and Terms of Use. The Company is not responsible for deletion of data stored or processed by such FIUs or third parties.

OPERATION AND TRANSFER OF DATA

The Company does not engage in cross-border transfer of personal data, nor does it share your data with internal departments or external third-party vendors outside of India. The only data sharing that occurs is the regulated and consent-based transfer between FIPs and FIUs, as per your explicit consent. Any future changes in our data transfer practices will be notified to you, and such changes will take effect only upon your review and consent.

DATA SECURITY

In order to make every effort to ensure that your experience on the Website is secure, we use encryption technology to protect you against the loss, misuse or alteration of your personal information. When you fill out any contact forms or access your account, a secure server encrypts all of your information through the use of Transport Layer Security (TLS) version 1.2 or above. Device identifiers, SIM binding data and browser fingerprints are encrypted before transmission and storage. For self-consent, encryption keys are generated and kept on your device, so only your device can decrypt your financial information.

Company follows the International Standard IS/ISO/IEC 27001 on "Information Technology - Security Techniques - Information Security Management System – Requirements" for ensuring protection of user Information in its possession.

CHANGES TO PRIVACY POLICY

We process your data based on the consent you expressly grant to us at the time we collect such data for a specified purpose. In case we change our Privacy Policy which further changes the way we process and manage your data, we will notify and give you an opportunity to review the revised Policy before you choose to proceed with our Services.

COMPLAINTS

In order to ensure compliance with these policies, Company has appointed a Grievance Redressal Officer to oversee all aspects of its privacy policies and practices. If you are dissatisfied with Company's privacy policies or practices, you should send a written request or complaint to the Grievance Redressal Officer at the address below.

Grievance Redressal Officer

Address: 3rd Floor Tower 40 The Loft, Nexity Hyderabad, Knowledge city Layout Raidurgam Village Serilingampally, Mandal, Hyderabad, Telangana, India, 500081.

Name: Usha Kiran

Phone: +91-90100-98899

Email: [email protected]

Time: 10:30 am to 5:30 pm

The Grievance Redressal Officer will investigate the matter and respond to your request within 30 (Thirty) days. In the event that you become aware that the information we have about you is incorrect, you should notify the Grievance Redressal Officer, who will ensure the information is updated. In case of a complaint, the Grievance Redressal Officer will take corrective action (if necessary) and will advise you of the steps taken to correct the problem. In case your query is not responded even after 30 days or resolved to your satisfaction then as per the RBI Regulation you can escalate the issue to RBI directly. Complaint may be lodged online with the RBI Ombudsman through the portal designed for the purpose (https://cms.rbi.org.in) by RBI in terms of the RBIOS Scheme 2021.