Privacy Policy

Last updated: 7 September 2026

1. Introduction

1.1. This Privacy Policy explains how Summarum Media Oy (“Summarum Media”, “we”, “us”), the owner and operator of the RupeeFinder brand and the website rupeefinder.com, collects, uses, shares and protects the personal data of visitors to and users of the India section of the website at rupeefinder.com/in/ (“the Website”).

1.2. Summarum Media Oy is a limited company registered in Finland with business ID FI28230174, whose registered address is Säästöpankinranta 10, 00530 Helsinki, Finland. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) Summarum Media is the Data Fiduciary that determines the purpose and means of processing your personal data, and you are the Data Principal.

1.3. This Policy is published in accordance with the DPDP Act and the rules made under it, and with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”). It should be read together with our Terms and Conditions.

2. Purpose of this Policy

2.1. RupeeFinder is an online loan comparison service. To show you indicative offers and to pass your request to the lender you choose, we need to collect and process certain personal data about you. We collect only the data needed for that purpose.

2.2. We are committed to respecting and protecting your privacy. We treat your personal data as confidential, process it lawfully, fairly and transparently, take reasonable steps to keep it accurate and up to date, and protect it with appropriate security measures.

2.3. RupeeFinder is not a lender. Once your request has been passed to a lender, that lender processes your personal data as an independent Data Fiduciary under its own privacy policy, which you should read before proceeding.

3. Personal data we collect

3.1. Data you give us in the application form, which may include:

  • identity data: name, date of birth or age, gender;
  • contact data: email address, mobile number, residential address, city and PIN code;
  • loan request data: requested loan amount, repayment term and purpose of the loan;
  • financial and employment data: employment status, employer, monthly income, existing loan obligations and other details a lender needs to assess your request;
  • identification data, where a lender requires it to process your application, such as your Permanent Account Number (PAN). We do not ask you to submit your Aadhaar number on the Website;
  • your consents and preferences, such as your acceptance of the Terms and Conditions and your choice about marketing messages.

3.2. Data we collect automatically when you use the Website: IP address, device and browser type, operating system, pages visited, the date and time of your visit, the website you came from, and identifiers set by cookies and similar technologies (see section 11). Where you arrive at the Website from an advertisement or a partner site, we may also record the campaign or click identifier associated with that link.

3.3. Data from communications: the content of emails, messages and calls between you and us, including support requests and complaints.

3.4. Data from third parties: confirmation from a lender about the status of your application (for example, whether an offer was made or accepted); the result of email deliverability or fraud checks; and, where a lender requires it, information from identity verification or credit information companies obtained on the lender’s behalf.

3.5. Financial information and identifiers such as PAN are “sensitive personal data or information” under the SPDI Rules. We process them only with your consent and for the purposes described in this Policy.

4. Consent and lawful basis

4.1. We process your personal data primarily on the basis of your consent, which you give by ticking the consent box and submitting the application form. Your consent is free, specific, informed and unambiguous, and covers only the purposes described in section 5.

4.2. You may withdraw your consent at any time by contacting us (section 15). Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent before your request has been forwarded to a lender, we will not be able to provide the comparison service. If you withdraw consent afterwards, we will stop our own processing, but the lender to whom your request was sent will continue to process your data under its own privacy policy, and you should also contact the lender directly.

4.3. In addition, the DPDP Act permits us to process personal data without separate consent for certain legitimate uses, including where you have voluntarily provided data for a specified purpose, where processing is required to comply with a law or a court order, and where it is needed to protect against fraud or security threats. We rely on these grounds only where the law allows.

5. How we use your personal data

5.1. We use your personal data for the following purposes:

  • to receive and evaluate your loan request and present you with indicative offers from partner lenders;
  • to forward your request and the details you provided to the lender or lenders you choose, so that they can contact you and process your application;
  • to contact you about your request, including where you have started but not completed an application, and to provide customer support;
  • to send you information and offers about RupeeFinder’s comparison services and financial products by email, SMS or telephone, where you have opted in (section 6);
  • to prevent, detect and investigate fraud, abuse and security incidents, including verifying that the email address and phone number you provide are genuine;
  • to measure and improve the Website, our services and our marketing, including through aggregated statistics and analytics;
  • to keep records, handle complaints and disputes, and enforce our Terms and Conditions;
  • to comply with legal and regulatory obligations and to respond to lawful requests from courts, regulators and law enforcement.

5.2. We do not use your personal data to make decisions about you that are based solely on automated processing and that have a legal or similarly significant effect on you. Credit decisions are made by the lender, not by RupeeFinder.

5.3. Where we use data for statistical or research purposes, we use data that no longer identifies you.

6. Direct marketing

6.1. We send marketing messages by email, SMS or telephone only if you have opted in by ticking the marketing checkbox in the application form. Marketing messages may include information about RupeeFinder’s services and about financial products offered by our partners.

6.2. You can opt out at any time by using the unsubscribe link in any email, replying STOP to an SMS where that option is offered, or contacting us at the address in section 15. We will act on your request without undue delay. Opting out of marketing does not affect service messages about a request you have submitted.

6.3. We comply with the Telecom Regulatory Authority of India’s regulations on commercial communications. If your number is registered on the National Do Not Disturb registry, we will contact you by telephone or SMS only where you have given us explicit consent to do so.

7. Transfers of your personal data outside India

7.1. Summarum Media is established in Finland, and our systems and service providers are located primarily in the European Union. Your personal data is therefore stored and processed outside India.

7.2. The DPDP Act permits the transfer of personal data outside India except to countries or territories restricted by the Central Government. We transfer personal data only to countries that are not so restricted, and we apply the standards of protection described in this Policy wherever your data is processed. Data processed in the European Union additionally benefits from the protections of the EU General Data Protection Regulation.

7.3. Where we share your data with a partner lender in India, the lender processes it in India under its own policies.

8. Sharing and disclosure of your personal data

8.1. We share your personal data only where one or more of the following applies: you have consented; it is necessary to provide the service you requested; we are required to do so by law; or it is necessary to protect a legitimate interest of yours, ours or a third party’s, such as the prevention of fraud.

8.2. Depending on the circumstances, we may share your personal data with the following recipients, each of whom is obliged to keep it secure and confidential:

  • partner lenders: banks and NBFCs registered with the Reserve Bank of India, to whom we forward your loan request at your instruction;
  • affiliated partners who present financial products to you, where you have consented;
  • service providers acting on our behalf as Data Processors, including hosting and IT infrastructure, email and SMS delivery, email validation and fraud prevention, analytics and customer support tools;
  • companies in the Summarum Media group and our professional advisers;
  • regulators, courts, law enforcement agencies and other public authorities where required by law or a lawful order;
  • a buyer or successor in the event of a merger, sale or transfer of our business or assets.

8.3. We do not sell your personal data.

9. Information security

9.1. We implement reasonable security practices and procedures, as required by the SPDI Rules and the DPDP Act, to protect your personal data against unauthorised access, loss, misuse, alteration and disclosure. These include encryption of data in transit, access controls, logging and regular review of our systems. We bind our service providers and processors to appropriate security and confidentiality obligations.

9.2. No transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we maintain the safeguards described above and will notify you and the Data Protection Board of India of a personal data breach affecting you where the law requires.

10. Your rights

10.1. Under the DPDP Act you have the following rights in relation to your personal data:

  • the right to access: to obtain a summary of the personal data we process about you, the purposes of processing, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared;
  • the right to correction and erasure: to have inaccurate or incomplete data corrected or updated, and to have data erased where it is no longer necessary for the purpose for which it was collected, unless retention is required by law;
  • the right to withdraw consent at any time (section 4.2);
  • the right to grievance redressal: to have a complaint about our processing handled by our Grievance Officer;
  • the right to nominate another individual who may exercise your rights in the event of your death or incapacity.

10.2. To exercise any of these rights, contact us as described in section 15. We may need to verify your identity before acting on a request. We will respond within the timelines prescribed by applicable law.

10.3. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India (section 16). When exercising your rights you must provide only accurate information, must not impersonate another person, and must not make false or frivolous complaints.

11. Cookies

11.1. Cookies are small text files placed on your device by a website. The Website uses:

  • essential cookies needed for the Website and the application form to function, for example to remember your progress through the form;
  • preference cookies that remember settings such as your chosen market (India or Sri Lanka);
  • analytics cookies that help us understand how visitors use the Website, using aggregated data;
  • marketing cookies and pixels that measure the performance of our advertising and, where you have consented, allow relevant advertising to be shown to you on other platforms.

11.2. You can control cookies through your browser settings, including refusing all cookies or receiving a warning before a cookie is stored. Refusing cookies may prevent parts of the Website, including the application form, from working properly.

12. How long we keep your personal data

12.1. We keep your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Loan request data is kept for as long as needed to complete your request, to handle any follow-up or complaint, and to meet our contractual and legal obligations to partners and authorities. Marketing data is kept until you opt out. Technical logs are kept for a limited period for security purposes.

12.2. When your personal data is no longer needed, we erase it or anonymise it so that it no longer identifies you, and we instruct our Data Processors to do the same.

13. Children

The Website is intended for adults. We do not knowingly collect personal data from anyone under 18 years of age and do not offer our services to them. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in law, our services or our practices. The current version is always published on the Website with the date of the last update, and it supersedes all previous versions. Where a change materially affects how we use your personal data, we will take reasonable steps to bring it to your attention.

15. How to contact us and our Grievance Officer

15.1. If you have any question about this Policy, wish to exercise your rights, withdraw consent, or make a complaint about how we handle your personal data, please contact our Grievance Officer:

Grievance Officer, RupeeFinder India
Summarum Media Oy
Säästöpankinranta 10, 00530 Helsinki, Finland
Email: [email protected] (subject line: “RupeeFinder India privacy”)

15.2. We will acknowledge your grievance and respond within the timelines required under the DPDP Act, the rules made under it and the SPDI Rules.

16. Data Protection Board of India

If you are not satisfied with the response of our Grievance Officer, you have the right to lodge a complaint with the Data Protection Board of India established under the DPDP Act.