Data Privacy Policy

(Version 7.0)

CLASSIFICATION: PUBLIC
This document is the sole property of Utkarsh Small Finance Bank Limited (USFBL). Any
use or duplication of this document without the express permission of USFBL is strictly
forbidden and illegal.

Page 1 of 5
 Table of Contents

1. Privacy Commitment.….………………………………………………………….………….......................3
2. Definitions.………………………………………………………………………………...............................3
3. Applicability of the Policy………………………………………………………….………………..............3
4. Accuracy…………………….………………………………………………………...……………………….4
5. Purpose of Collection and Use of Personal Information/Sensitive Personal Data or Information...4
6. Disclosure of Personal Information.…………………………………………….………………………….4
7. Reasonable Security Practices and Procedures.….……………………………….………...….…….....4
8. Cookie Policy...…………………….……………………………………………….……………………….…4
9. Social Media…….……………….…………………………………………….……………………...……....5
10. Notice of Change……...…………………………………………………………………………….……......5

Page 2 of 5
1. Privacy Commitment

Utkarsh Small Finance Bank Limited (The Bank) recognizes the expectations of its customers
with regard to privacy, confidentiality and security of their personal information that resides
with the Bank. It is the policy of the Bank to keep the personal information of customers secure
and use the same solely for the activities related to the Bank. The Bank has adopted the privacy
policy aimed at protecting the personal information provided by/ disclosed by the customers
(the Policy). This Policy governs the way in which the Bank collects, uses, discloses, stores,
secures and disposes of personal information and sensitive personal data or information.

2. Definitions

(i) Personally identifiable information (PII)

“Personally identifiable information” (PI) means any information that relates to a natural
person, which either directly or indirectly, in combination with other information available or
likely to be available with the Bank, is capable of identifying such person.

Some examples of PII are

a) Name
b) Date of birth
c) Gender
d) Bank account or credit card number

(ii) Sensitive personal data or information (SPDI)

“Sensitive personal data or information” (SPDI) of a person means such personal information,
which consists of information relating to:
a) Password;
b) Financial information such as Bank account or credit card or debit card or other
payment instrument details;
c) Physical, physiological and mental health condition;
d) Sexual orientation;
e) Medical records & history;
f) Biometric information;
g) Any detail relating to the above clauses as provided to body corporate for providing
service;
h) Any of the information received under above clauses by body corporate for
processing, stored or processed under lawful contract or otherwise.

Provided that, any information that is freely available or accessible in public domain or
furnished under any law for the time being in force shall not be regarded as sensitive personal
data or information for the purposes of this policy.

3. Applicability of the Policy

This Policy is applicable to the personal information and sensitive personal data or information
collected by the Bank or its affiliates directly from the customer or through the Bank’s online
portals, mobile apps and electronic communications as also any information collected by the
Bank’s server from the customer’s browser.

Page 3 of 5
4. Accuracy

The Bank shall have processes in place to ensure that the personal information residing with it
is complete, accurate and current. If at any point of time, there is a reason to believe that
personal information residing with the Bank is incorrect, the customer may inform the Bank in
this regard. The Bank shall correct the erroneous information as quickly as possible.

5. Purpose of Collection and Use of Personal Information/ Sensitive Personal Data or

Information

The Bank collects the PI and SPDI from its customers and uses the same for specific business
purposes or for other related purposes designated by the Bank or for a lawful purpose to
comply with the applicable laws and regulations. The Bank shall not divulge any personal
information collected from the customer, for cross selling or any other purposes, without the
written consent of the customer.

The authenticity of the personal information provided by the customer shall not be the
responsibility of the Bank. The Bank shall not be responsible for any information that is freely
available or accessible in public domain or furnished as per law for the time being in force.

6. Disclosure of Personal Information

The personal information collected by the Bank shall not be disclosed to any other organization
except:
a. Where the disclosure has been agreed in a written contract or otherwise between the
Bank and the customer;
b. Where the Bank is required to disclose the personal information to an affiliate/ third
party/ service provider on a need-to-know basis, for providing services/ related
activities, provided that in such case the Bank shall inform such affiliate/ third party /
service provider of the confidential nature of the personal information and shall keep
the same standards of information/ data security as that of the Bank.
c. To statutory and regulatory authorities on their specific request as per rules in force.

7. Reasonable Security Practices and Procedures

The security of personal information is a priority and is protected by maintaining physical,

electronic and procedural safeguards that meet applicable laws. The Bank shall take reasonable
steps and measures to protect the security of the customer’s personal information from misuse
and loss, un-authorized access, modification or disclosure. The Bank maintains its security
systems to ensure that the personal information of the customer is appropriately protected
and follows the extant standard protection norms followed for the transmission of information.

8. Cookie Policy

The Bank’s digital platforms may use various third party analytical tools. These tools may use
cookies, which are downloaded to the customer’s device when the customer visits a website
in order to provide a personalized browsing experience. Cookies are used for other purposes
like remembering the customer’s preferences & settings, provide personalized browsing
experience and analyze site operations. These cookies collect information about how users
use a website. By using the Bank’s website, the user agrees that these types of cookies can be
placed on his/ her device. User is free to disable/ delete these cookies by changing his/ her
device/ browser settings. The Bank is not responsible for cookies placed in the device of user/s
by any other website and information collected thereto.

Page 4 of 5
 9. Social Media

Social media applications/ sites are owned by third parties unaffiliated with Utkarsh Small
Finance Bank Limited. The customers shall independently be guided by their privacy policies
and Bank has no control over them. Utkarsh Small Finance Bank Limited, is not responsible
for the privacy or security at these applications/ sites or other third party sites that may be
linked to/ from within our social media channels. Utkarsh Small Finance Bank Limited, does
not endorse and is not responsible for any content, products, ads, advice, recommendations,
opinions or other material of third party sites that may be promoted via advertising within any
social media properties.

10. Notice of Change

The Bank may, from time to time, change/ update this Policy.

-------------------------------------XXX----End of document----XXX--------------------------------------

Page 5 of 5