1. Policy Purpose and Regulatory Scope
This Data Retention & Detention Policy ("Policy") defines the operational principles applied by Stellarpath Horizons Private Limited for its digital credit platform TheCredPe (thecredpe.com) regarding the collection, retention duration, archiving, and secure destruction of personal and financial information.
This Policy is enacted in strict conformance with:
- Section 8 of the Digital Personal Data Protection Act, 2023 (Data Fiduciary obligations regarding data erasure).
- Section 12 of the Prevention of Money Laundering Act, 2002 (PMLA) read with Rule 3 of the PML (Maintenance of Records) Rules, 2005.
- Section 128 of the Companies Act, 2013 and Section 44AB of the Income Tax Act, 1961.
- The Reserve Bank of India Master Direction - Know Your Customer (KYC) Direction, 2016 and Digital Lending Guidelines.
2. Core Principles of Data Detention
We govern our data lifecycle using four foundational tenets:
- Purpose Limitation: We collect and retain only the minimal data elements necessary to perform statutory credit appraisal, comply with AML/KYC laws, and execute loan administration.
- Storage Limitation: Personal data is not kept in identifiable format longer than required for the purposes for which it was processed or mandated by statutory legislation.
- Confidentiality & Cryptographic Security: All archived datasets are separated from production networks, encrypted via AES-256 standards, and restricted by zero-trust identity controls.
- Irreversible Erasure: When retention schedules expire, data is securely sanitized using cryptographic erasure without leaving un-shredded digital traces.
3. Detailed Data Retention Schedule
The table below summarizes the specific categories of records, lawful retention periods, and the underlying regulatory justification:
| Data Category | Records Included | Retention Period | Statutory Basis |
|---|---|---|---|
| KYC & Identity Data | Aadhaar e-KYC logs, PAN verifications, voter ID/passport copies, photographs, address proofs. | 5 Years following the formal closure or settlement of the loan account. | PMLA, 2002 & RBI KYC Master Directions. |
| Loan Contracts & Sanction Letters | Digitally e-signed Loan Agreements, Key Fact Statements (KFS), sanction letters, terms acceptance logs. | 8 Years from the conclusion of the financial year in which the loan was settled. | Indian Contract Act, 1872 & Limitation Act, 1963. |
| Financial & Repayment Ledgers | Disbursement UTR records, monthly EMI bank debit receipts, e-NACH mandate logs, bounce notices, foreclosure NOCs. | 8 Years from the end of the relevant financial year. | Income Tax Act, 1961 & Companies Act, 2013. |
| Credit Inquiries & Bureau Reports | CIBIL/Experian credit pull responses, risk scoring algorithms, debt-to-income evaluation outputs. | 3 Years from the date of credit assessment. | Credit Information Companies (Regulation) Act, 2005. |
| Customer Support & Grievance Logs | Recorded telephone interactions, ticketing history, email communications, and Ombudsman resolution records. | 3 Years from ticket closure date. | RBI Consumer Grievance Guidelines. |
| Rejected / Abandoned Applications | Incomplete forms, preliminary phone validations where no credit line or disbursal occurred. | 180 Days from application drop-off date, unless required for ongoing fraud investigation. | DPDP Act, 2023 (Data Minimization). |
4. Secure Data Storage & Segregation Protocol
- Active Storage: Data required for active servicing of existing loans is maintained in high-availability, 256-bit encrypted PostgreSQL / MongoDB clusters hosted strictly in ISO/IEC 27001 certified data centers within India.
- Cold Archive Vault: Once a loan is closed, records are cryptographically sealed, decoupled from active public-facing web servers, and moved to an immutable, write-once-read-many (WORM) compliant archival vault.
- Access Control: Access to archived data requires dual authorization from the Chief Compliance Officer and Chief Technology Officer, and is logged into an immutable SIEM audit trail.
5. Data Deletion and Right to be Forgotten
In accordance with Section 12 of the DPDP Act 2023, data principals have the right to request erasure of their personal information.
Statutory Precedence Exception
Please note that if you have an active loan or if your loan was closed within the last 5 years, Stellarpath Horizons Private Limited is legally compelled under statutory guidelines to retain your transaction and KYC records. During this mandatory statutory period, your data cannot be erased, but it will be placed in restricted access mode and will never be used for marketing or non-compliance purposes.
Upon expiration of statutory retention windows, borrowers may submit a formal deletion request by emailing privacy@thecredpe.com with subject line "Data Erasure Request - [Loan Account Number]".
6. Secure Disposal & Purging Protocols
When the designated retention duration lapses, the digital records are expunged using National Institute of Standards and Technology (NIST SP 800-88 Rev. 1) certified media sanitization techniques:
- Cryptographic Shredding: Destruction of the individual cryptographic keys used to encrypt the user's specific data partitions, rendering the underlying ciphertext permanently undecipherable.
- Database Purge: Zero-filling and cryptographic block deletion of corresponding records and electronic archives.
- Certification: Generation of an automated Certificate of Data Erasure countersigned by our Data Protection Officer.
7. Review and Contact
This Data Retention & Detention Policy is reviewed annually by our Board Risk Management Committee. If you have questions regarding our data detention schedules or retention protocols, please write to our Data Protection Office:
Email: dpo@thecredpe.com
Address: Office No. 721-A, Jaina Tower-II, Distt Centre, Janak Puri, Janakpuri B-1, West Delhi, New Delhi, Delhi, India, 110058