Frequently Asked Questions

We collect only data necessary for credit assessment and loan servicing: Identity data (name, date of birth, PAN, Aadhaar); Contact data (mobile, email, address); Financial data (income, bank statements, existing EMIs); Credit data (bureau reports from all four credit bureaus); Employment data (employer name, type, tenure); and Device/technical data (device ID, IP address — for fraud prevention only). We do not access your phonebook, photo gallery, social media profiles, or contacts. Full details are in our Privacy Policy at crestmontcapital.in/privacy-policy.

We share your data only in specific, limited circumstances: Credit Bureaus (TransUnion CIBIL, Equifax, Experian, CRIF) — mandatory for credit reporting; KYC Partners (Digitap) — for Aadhaar and PAN verification; Technology Service Providers — under signed Data Processing Agreements with strict data handling obligations; Legal or regulatory authorities — when required by law. We never sell your data to third parties, never share it for marketing purposes without your consent, and every third party must comply with our data protection standards under a DPA.

Under the DPDP Act 2023, you have the following rights as a Data Principal: Right of Access — request a summary of the personal data we hold about you; Right of Correction — request correction of inaccurate or incomplete data; Right of Erasure — request deletion of your data that is no longer necessary (subject to regulatory retention requirements, such as KYC records which must be retained for 5 years); Right to Nominate — nominate a person to exercise your data rights on your behalf. To exercise any of these rights, email service@crestmontcapital.in with the subject 'Data Rights Request'.

Retention periods vary by data type: KYC documents (PAN, Aadhaar, address proof) — 5 years after loan closure, as mandated by RBI/PMLA; Loan account records and financial data — 8 years after last transaction; Credit bureau reports — 2 years from date of pull; Communication records (emails, in-app messages) — 3 years. After the applicable retention period, data is securely deleted. You cannot request earlier deletion of data subject to statutory or regulatory retention requirements, but you may request deletion of non-regulatory data (e.g., marketing preferences, device data) at any time.

Yes. crestmontcapital.in uses essential cookies (required for the website to function — session management, security tokens), analytics cookies (aggregated, anonymised usage data to improve our website experience), and performance cookies (page load optimisation). We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings. Refusing analytics cookies does not affect your ability to use the website or apply for a loan.