Your right to withdraw consent
You have the right to withdraw consent for processing of your personal data by KredSetu (a brand of Resilience Engineering Private Limited) at any time, subject to applicable law and the terms of any binding agreement already in effect.
1. What withdrawal means
Withdrawing your privacy consent means you are requesting that KredSetu stop processing your personal data for purposes that rely on your consent as the legal basis. This does not affect processing that is required by law, regulation, or the performance of a contract you have already entered into.
- Consent-based marketing communications will be stopped.
- Non-essential analytics tied to your identity will be ceased.
- Processing required for active loan servicing, KYC obligations, or legal compliance cannot be stopped solely on consent withdrawal.
2. How to submit a withdrawal request
To withdraw your privacy consent, contact the KredSetu support team with the following information:
- Your registered mobile number or email address
- A clear statement that you wish to withdraw consent for data processing
- Specify the scope of withdrawal if you wish to limit it to a particular type of processing (e.g., marketing only)
Contact channels:
- Email: support@kredsetu.in
- Escalation: grievance@kredsetu.in
3. What happens after your request
- Your request will be acknowledged within 1 business day.
- Processing of your request will be completed within 30 days, or as required by applicable law.
- You will receive written confirmation once the withdrawal has been actioned.
- Where certain data must be retained for legal, regulatory, or contractual reasons, you will be informed of the basis for continued retention.
4. Account deletion
If you wish to delete your KredSetu account and associated data in addition to withdrawing consent, you can submit a deletion request through the account deletion page or via the support channel above. Note that deletion of records may be limited where retention is legally mandated.
5. What happens to data already collected — detailed effects
Before confirming a withdrawal, please understand the following effects, as required under the Digital Personal Data Protection Act, 2023 and applicable RBI regulations:
| Category | Effect of withdrawal |
|---|---|
| Marketing, promotional, and behavioural analytics data | Deleted or anonymised within 30 days of request. |
| KYC records (PAN, Aadhaar reference, address proof) | Retained for 8 years from the date of the last transaction or closure of loan, as mandated by PMLA, 2002 and RBI KYC Master Directions. Cannot be deleted earlier. |
| Loan application and sanction records | Retained for the minimum period required by the lending partner and RBI audit rules (typically 8 years from loan closure). |
| Credit bureau consent and credit report pulls already performed | Historic pulls remain on the bureau record and are governed by the Credit Information Companies (Regulation) Act, 2005. Withdrawal stops future pulls but does not remove past enquiries. |
| Transaction and repayment data (UPI mandate, eNACH, NPCI records) | Retained as long as any loan account is active, and subsequently for the regulatory retention window. Withdrawal cannot cancel a live repayment mandate — that must be revoked separately through your bank. |
| Grievance and complaint records | Retained for at least 3 years as per RBI grievance handling rules. |
6. Effect on an active loan or ongoing application
- If you have a live loan account with the NBFC lending partner, withdrawal of consent will not discharge your repayment obligations under the signed loan agreement.
- If you are mid-application at the time of withdrawal, the application will be cancelled and no further data will be shared with the lending partner; data already shared remains subject to the partner's retention rules.
- The RBI-registered NBFC partner (Narainsons Investments Finance and Consultancy Pvt. Ltd.) holds data for the loan account under its own privacy framework. KredSetu will pass on your withdrawal request to the partner and confirm the partner's response within 10 business days.
7. Revoking credit bureau consent specifically
If you wish to revoke only the credit bureau data-pull consent, you can specify this in your withdrawal request. Future credit enquiries on your behalf will stop, but:
- Credit reports already retrieved cannot be un-retrieved.
- Historic enquiry records on the bureau side are governed by CIC (R) Act, 2005 and are retained by the bureau, not by KredSetu.
- Revocation may make it impossible to process any pending loan application that has not yet reached the sanction stage.
8. Important notes
- Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- If you have an active loan application or loan account, withdrawal may affect your ability to use certain services.
- Data shared with regulated lending partners under their own policies may be subject to their separate data retention and consent frameworks.