1. About this policy
This Privacy Policy (“Policy”) explains how Sagarmala Finance Corporation Limited (“SMFCL”), under the Ministry of Ports, Shipping & Waterways, Government of India, collects, processes, uses, stores, shares and protects personal data through the Interest Incentivization Fund (IIF) portal ("Portal").
This Policy applies to individuals who access or use the Portal including borrowers and their authorised representatives, lenders (banks and financial institutions) and their authorised representatives, SMFCL officers and administrators and authorised users of the Ministry of Ports, Shipping and Waterways users.
This Policy should be read together with the Portal's Terms of Use, Cookie Policy and other applicable scheme terms, guidelines and notices.
Where applicable, personal data is processed in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the rules made under it, and other applicable laws, regulations and governmental requirements, as amended or replaced from time to time.
Where processing is based on consent, consent will be obtained in the manner required by applicable law. Where processing is permitted or required on another legal basis, including for compliance with law, performance of a statutory or governmental function, or other permitted purposes, processing may take place without relying on consent.
By registering for or using the Portal you confirm that you have read and understood this Privacy policy and consent to the processing of your personal data in accordance with this Policy and applicable law.
2. Personal data we collect
The personal data collected will depend on your role and your interaction with the Portal.
Account and registration (borrowers)
We may collect:
- Name and contact details, including email address, mobile number.
- Login credentials, with passwords stored only in appropriately protected form such as cryptographic hashes
- Organisation details, including ownership type, organisation name, PAN and GST number.
- Up to three contact persons with name, designation, mobile number and email address.
- Corporate and communication addresses, including address lines, city, district, state/UT, PIN code).
Lender information
For authorised lender users, we may collect:
- Bank or Financial institution name and category, branch and office address, nodal officer or authorised representative name, contact number, email address, PIN code, state/UT and district and information required to authenticate and administer lender access.
Applications, claims and compliance
In connection with an IIF application or related activity, we may collect and process
- Project and Financing details loan and loan account information, details you submit, including loan account number and IFSC code, and bank account details required for processing used eligible for subvention or another scheme.
- Documents and information submitted you upload with applications, queries, compliance submissions and claims, and supporting records, verification information obtained from authorised government the decisions, remarks, correspondence, workflow records and status history relating to applications and claims.
- information required for audit, monitoring, inspection, reporting and administration of the IIF scheme.
- You should provide only information that is required or reasonably necessary for the relevant Portal function or scheme process.
Technical Security Information
When you access or use the Portal, we may automatically record certain technical and security information, including
- Login history, time of sign-in, IP address and browser, operating system and device information, user agent information.
- Session identifiers and security-related information, authentication and access logs and information generated through cookies and similar technologies, as described in the Cookie Policy.
3. How We Use Personal Data
- SMFCL may process personal data for the following purposes:
- Creating, verifying and administering user accounts;
- Authenticating borrowers, lenders and other authorised users;
- To register and verify borrowers and to create and manage lender accounts.
- Receiving, processing, assessing, approving e, querying or rejecting applications, processing compliance submissions, claims, reimbursements and subvention claims under the IIF scheme.
- verifying information provided by users through authorised government or third-party services;
- communicating with users regarding registration, authentication, applications, approvals, queries, rejections, claims, compliance requirements and other scheme-related matters;
- Sending one-time passwords, account-verification messages and service emails, such as account verification, approval or rejection, lender account creation and application status updates.
- To keep the Portal secure: authentication, preventing misuse and investigating suspicious activity.
- For audit, reporting and monitoring of the scheme, and to meet legal and regulatory obligations.
- carrying out internal and external audits, inspections and reviews;
- complying with applicable law, regulatory requirements, court orders and directions of competent authorities;
- responding to lawful requests from Government authorities and other authorised bodies; and
- Establishing, exercising or defending legal rights and claims.
We do not sell personal data collected through the Portal for targeted advertising or commercial advertising unrelated to the administration of IIF Scheme.
4. Who May Access or Receive Personal Data
Personal data may be accessed or disclosed, on a need-to-know basis and subject to applicable access controls,
- SMFCL officers and administrators
- Authorised SMFCL personnel may access borrower, lender, application, claim and compliance information to the extent necessary to administer, monitor, audit and operate the IIF scheme.
- Authorised Lenders may access the information relating to borrowers, projects, loans applications, claims and compliance matters with which they are legitimately associated to the extent required for processing and administering the IIF Scheme.
- Authorised users of theMinistryof Ports, Shipping & Waterways and other Competent Government authority’susers may access information for oversight monitoring, audit, policy, reporting or other authorised governmental purposes.
- SMFCL may engageService providers and technology partners to operate, maintain, secure and support the Portal and related services.
- Depending on the service, such providers may process information including
- That help us run the Portal, for example the GST verification service (receives the GST number you enter), PIN Code or address information for location or address validation and the email delivery service (receives your email address and message) or and other information strictly necessary for the service they provide.
- Government, Regulatory and legal authorities:Personal data may be disclosed where required or authorised under applicable law, including pursuant to a court order, statutory requirement, governmental direction, audit, investigation or lawful request.
- Such service providers may process personal data only for authorised purposes and subject to applicable contractual, security and legal requirements.
5. Role-Based Access and Data Security
- SMFCL implements reasonable technical and organisational safeguards appropriate to the nature and risks of the personal data processed through the Portal.
- Depending on the applicable system and risk assessment, safeguards may include:
- cryptographic protection and secure storage of passwords;
- encryption or other appropriate protection for sensitive identifiers and data in storage and transmission;
- role-based access controls;
- authentication and access-management mechanisms;
- session timeout and session-management controls;
- CAPTCHA or equivalent controls where appropriate;
- protection against common web application vulnerabilities, including cross-site request forgery;
- logging and monitoring of access and security events;
- periodic review of access privileges; and
- Measures designed to detect, prevent and investigate unauthorised access, misuse or security incidents.
- Access to personal data is restricted according to user roles and operational requirements.
- No electronic transmission, storage or security system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their credentials and should promptly report suspected unauthorised access or misuse through the Portal's designated grievance or helpdesk channel.
Where required by applicable law, SMFCL will take appropriate steps in response to a personal data breach, including any required notification to the competent authority and affected individuals
6. Data Retention
- Personal data will be retained only for as long as reasonably necessary for the purposes for which it was collected or otherwise processed, including:
- maintaining user accounts and scheme records;
- processing applications and claims;
- administering and monitoring the IIF scheme;
- completing audits, inspections and investigations;
- meeting statutory, regulatory, accounting, financial and record-keeping requirements;
- resolving disputes and grievances; and
- Establishing, exercising or defending legal rights.
- Certain records, including application, financing, payment, audit and compliance records, may be required to be retained for specified periods under applicable law, Government requirements, audit requirements or the governing documents of the IIF scheme.
- When personal data is no longer required to be retained, SMFCL will take reasonable steps to securely delete, anonymise or otherwise dispose of it in accordance with applicable law and its retention requirements.
7. Your rights
Subject to applicable law and any applicable exemptions or restrictions, individuals may have rights in relation to their personal data, including the Digital Personal Data Protection Act, 2023, you may:
- obtain information regarding the personal data being processed and the purposes of processing, where applicable
- request correction or updating of inaccurate or incomplete personal data;
- request erasure of personal data where permitted by applicable law;
- withdraw your consent, where processing is based on consent;
Raise a grievance regarding the processing of personal data; and
- These rights are subject to applicable statutory requirements and exceptions. For example, SMFCL may be required or permitted to retain certain records for scheme administration, audit, legal, regulatory, fraud-prevention or other lawful purposes.
- Requests relating to personal data should be submitted through the grievance or helpdesk channel specified in Section 10. SMFCL may require reasonable information to verify the identity or authority of the person making a request before acting on it.
- Where a request cannot be fully complied with, SMFCL may provide an explanation to the extent permitted by applicable law.
8. Third-party services
The Portal may use third party or external services for functions such as GST verification, PIN code or address lookup, email delivery, hosting security, authentication, software libraries and web fonts.
When such services are used, the relevant service provider may receive personal or technical information necessary to provide the service. Their processing may also be subject to their own privacy policies and applicable contractual arrangements.
The Portal may contain links to external websites or services. SMFCL does not control the privacy practices, security or content of third-party websites and is not responsible for their privacy practices. Users should review the privacy policies and terms applicable to those websites before providing information to them.
The use of cookies and similar technologies is described in the Portal's Cookie Policy
9. Changes to this policy
SMFCL may update this Policy from time to time to reflect changes in law, regulations, Government requirements, the IIF scheme, Portal functionality, technology or data-processing practices.
The "Last updated" date at the beginning of this Policy indicates when it was most recently revised.
Where required by applicable law, material changes will be communicated through the Portal, email or another appropriate channel.
Continued use of the Portal after an updated Policy is published will be subject to the revised Policy, to the extent permitted by applicable law.
10. Contact and grievances
For questions concerning this Policy, requests relating to personal data, withdrawal of consent where applicable, or privacy grievances, please contact SMFCL through the official grievance or helpdesk channel published for the IIF scheme.
The Portal will publish the applicable contact details and, where required by law, details of the designated person or officer responsible for receiving and addressing privacy-related grievances.
11. Saving, Severability and Applicable Law
This Policy shall be governed by the laws of India and shall be subject to all applicable laws, rules, regulations, notifications, directions and Government requirements, including, where applicable, the Digital Personal Data Protection Act, 2023 and rules made thereunder.
If any provision of this Policy is held invalid, illegal or unenforceable, it shall be severed or modified to the minimum extent necessary, without affecting the validity of the remaining provisions.
Nothing in this Policy shall limit, waive or prejudice any right, power, remedy, protection or obligation available to SMFCL under applicable law, the IIF Scheme or any Government or regulatory instrument. SMFCL may process or retain personal data to the extent required or permitted by applicable law.
In case of any conflict between this Policy and applicable law or any mandatory Government or regulatory requirement, the latter shall prevail to the extent of the conflict.