Data Security & Consent Architecture

In strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the RBI Digital Lending Guidelines, EazyMoney implements an unbundled, multi-stage consent architecture. We reject blanket, all-or-nothing consent models. Each processing milestone requires separate, affirmative agreement: 1. Stage 1: Email Verification Consent Your email address is collected strictly to dispatch a one-time verification code (OTP) and authenticate your identity. This tokenized session ensures only you can access or view your enquiry progress. 2. Stage 2: Loan Enquiry & Profile Consent After successful authentication, we request your explicit consent to store your profile details (name, city, income range, loan preferences) to generate matched loan options. Marketing communications are entirely optional and require a separate, unbundled checkbox. 3. Stage 3: Credit Assessment Consent Before performing any credit eligibility evaluation using your PAN, we present a dedicated consent notice explaining the purpose, scope, and partner agency involved. This check is conducted only after affirmative confirmation. 4. Stage 4: Lender Continuation Consent Prior to redirecting you to an RBI-registered Bank or NBFC, we present the lender's identity, applicable product terms, and Key Fact Statement links, requiring your explicit confirmation before facilitating the referral.

We apply industry-standard defense-in-depth measures to safeguard your sensitive information: • Transport Layer Security: All web communication between your browser and our servers is enforced over HTTPS utilizing TLS 1.3 encryption with strong cipher suites. • At-Rest Data Encryption: Database records containing sensitive identifiers (PAN, masked Aadhaar reference, phone numbers) are stored using AES-256 encryption. • Tokenization & Aadhaar Masking: Full 12-digit Aadhaar numbers and biometric records are NEVER stored on our servers. Aadhaar numbers entered during session verification are validated and immediately truncated to the final four digits. • Secure Cloud Infrastructure: Our database and application servers are hosted in SOC-2 compliant, high-security Indian data centers adhering to strict physical and digital perimeter security.

To ensure regulatory accountability and legal enforceability: • Every consent action is cryptographically logged with an immutable audit trail capturing the unique Enquiry ID, user identifier, exact consent text version, IP address, device telemetry, and timestamp. • These audit trails demonstrate verifiable compliance with DPDP Act obligations and RBI digital lending standards.

Consent is voluntary and revocable. You possess the continuous right to withdraw your consent or request data erasure: • Process: Send a written request from your registered email address to contact@eazymoney.shop stating your intention to withdraw consent or delete your profile. • Effect of Withdrawal: Upon receipt of a verified withdrawal request, we will cease processing your personal data for marketing and referral purposes and delete or irreversibly anonymize your enquiry records, subject only to statutory financial retention mandates (such as tax or AML audit obligations). • No Detriment: Withdrawing consent for optional services (such as promotional notifications or advisory reports) will not affect your ability to browse public website resources or use illustrative calculators.

We maintain an active Incident Response Plan. In the unlikely event of a security incident or data breach impacting your personal information: • We will notify the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India in accordance with statutory reporting deadlines. • We will promptly notify affected users via email detailing the nature of the breach, potential impact, remediation measures taken, and recommended protective actions.