← Back to Home
Privacy Policy
Last updated: 29 September 2026
Tomasri Fintech Private Limited ("Tomasri", "we", "our" or "us") helps customers apply for gold
loans with lenders regulated by the Reserve Bank of India. We are a loan referral partner: we
collect your application details and pass them to the lender you choose. We do not lend
money ourselves; the lender decides on your loan and holds your loan account.
This policy explains what personal data we collect, why, who we share it with, how long we keep
it, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
It applies to our website, our mobile app (used by our authorised agents), and our admin systems.
1. Whose data this covers
- Customers: people who apply, or enquire, for a gold loan through us.
- Website visitors who fill in our enquiry or "Delete my data" forms.
- Our agents and staff: employees, distributors and freelancers who use our app
and systems.
2. What we collect
Customers
- Name, mobile number and date of birth
- PAN, and name as per PAN
- Aadhaar number, if you give it. We never store your full Aadhaar number: we
keep only the last 4 digits and a one-way protected code used to spot duplicate applications.
- Pincode, city, district and state
- Loan amount and gold details
- If you ask for finance support (for example a balance transfer): bank account details and the
documents you provide, such as the lender's approval
- A record of your consent: the notice you were shown, when you agreed, and the one-time password
(OTP) verification
Website enquiries and requests
- Enquiry form: name, mobile number, pincode, gold weight and loan amount
- "Delete my data" form: name, mobile number, email and your reason (optional)
Agents and staff
- Name, contact details, employee ID, role and reporting manager
- Identity and payment details for verification and commission payouts: PAN, Aadhaar (last 4
digits stored; card images for identity verification), bank account and cancelled cheque
- Device identifier for app notifications, and login and security records (such as sign-in
attempts)
3. Why we use it
| Purpose |
Legal basis |
| Sending your loan application to the lender you choose, and following it up with you
and the lender |
Your consent, given before your OTP is verified |
| Checking for duplicate applications and preventing fraud |
Your consent, and legitimate uses permitted by law |
| Responding to your website enquiry or request |
Your consent, given when you submit the form |
| Employing and paying our agents and staff, and verifying their identity |
Employment purposes permitted under the DPDP Act |
| Keeping our systems secure (sign-in checks, account lockout, audit logs) |
Legitimate uses permitted by law |
| Keeping accounts and meeting legal, tax and regulatory obligations, and answering
lawful requests from authorities |
Compliance with law |
We do not sell your personal data, and we do not use it for advertising.
4. Who we share it with
- The lender you apply with, currently Bajaj Finance Limited. The lender is
named in the consent notice before you agree. The lender uses your details under its own
privacy policy.
- Our service providers, who process data only on our instructions:
- Google Cloud (Google Cloud India): application hosting, database and file storage, in
Mumbai, India
- Google Firebase: app notifications to our agents, and hosting of this website
- Brevo: sending emails (for example login codes and request confirmations)
- Fast2SMS: sending OTP text messages
- EmailJS: delivering website enquiry forms to our team
- Titan Email (through GoDaddy): our business mailbox, where enquiries and emails you
send us are received
- Authorities, such as courts, regulators or law enforcement, when the law
requires it.
5. Where your data is stored
Our database and files are stored in India (Google Cloud, Mumbai region). Some service providers,
such as our email and website form providers, may process limited information (for example your
name, contact details and message) outside India, only as allowed under the DPDP Act.
6. How long we keep it
- Customer application data: while your application is being processed, and
then for up to 90 days after it is closed. After that we delete it or anonymise it so it no
longer identifies you.
- Records we must keep: the loan reference, amounts and dates, without your
name or contact details, are kept for as long as accounting and tax law requires. Proof of your
consent is kept for as long as our agreement with the lender requires, so that we can show the
lender or a regulator that you agreed.
- Unverified applications (where the OTP was never verified) are deleted
automatically.
- Agents and staff: for the period of engagement, and afterwards only as long as
law or payouts require.
- Security and audit logs: for a limited period needed to keep our systems safe
and to meet audit requirements.
The lender keeps its own copy of your application under its own policy. To have the lender's copy
deleted, please contact the lender directly.
7. Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you and who we shared it with
- Correct or update data that is wrong or incomplete
- Delete your data: use our Delete my data form.
We confirm the request by email, may call you to check it is really you, and delete your data
within 15 days.
- Withdraw your consent at any time. This does not affect anything done before
you withdrew it, but we may not be able to continue with your application.
- Nominate someone to exercise these rights for you if you die or become unable
to do so
- Complain to our Grievance Officer (below), and if you are not satisfied, to the
Data Protection Board of India
To use any of these rights, write to care@tomasrifintech.com
from the mobile number or email linked to your application, or use the forms above. We may ask
you to confirm your identity first.
8. How we protect your data
- Data is encrypted in transit, and stored in access-controlled systems in India
- Full Aadhaar numbers are never stored; OTPs are stored only in protected form
- Staff see only the applications they are responsible for
- Admin sign-in needs a password and a one-time code, and accounts lock after repeated wrong
passwords
- Access to personal data is logged
If a personal data breach happens, we will inform affected people, the lender and the Data
Protection Board of India as the law and our agreements require.
9. Our mobile app
The app is used only by our authorised agents, not by customers directly. Agents must show the
consent notice to the customer and get the customer's OTP before an application is submitted.
The app may ask for:
- Camera: to photograph documents
- Storage / files: to attach documents
- Notifications: to tell agents about updates to their applications
- Internet: to send and receive application data
Permissions are used only for these purposes.
10. Website
Our website does not use advertising or analytics cookies. It loads fonts and scripts from
third-party content delivery networks (Google Fonts and jsDelivr), which receive your device's
IP address to deliver them.
11. Children
Our services are for adults. We do not knowingly collect personal data of anyone under 18. If you
believe we have, please contact us and we will delete it.
12. Changes to this policy
We may update this policy. The latest version is always on this page with its date. If a change
affects how we use data you have already given us, we will tell you before it applies where the
law requires.
13. Contact and Grievance Officer