Privacy Policy

PRIVACY NOTICE

Effective Date (Approval Date): Aug 07, 2026

Approved By: CA Krishnan R (Director and Chief Executive Officer)

Version: 1.0 (Digital Personal Data Protection Act, 2023 Compliant)

Last Updated: July 10, 2026

Wizzmoni Financial Services Limited (“Company”, “we”, “our”, or “us”) is strongly committed to protecting the privacy, confidentiality, and integrity of the personal data of our customers, registered members, and platform visitors (“Data Principal”, “you”, or “your”). This Privacy Notice governs your access to and use of www.wizzmoni.com and its associated mobile applications (collectively referred to as the “Platform”) and social media platforms.

This Privacy Notice outlines our practices in relation to the collection, storage, use, processing and disclosure of Personal Data. It applies to customers of our Gold Loan, Foreign Exchange, Forex Card, Prepaid Wallet, Domestic and International Money Transfer, Travel & Holidays, Visa Services and Insurance Distribution businesses, as well as prospective customers, website visitors, mobile application users and any individual whose Personal Data is processed in connection with our products or services.

We do collect your personal information and process your Personal Data in accordance with the Digital Personal Data Protection Act, 2023 and other applicable laws, regulations and regulatory directions, including those issued by the Reserve Bank of India, where applicable.

1. Definitions and Key Terms
2. Child/Children: means individual/s who has not completed eighteen (18) years of age.
3. Cookies: A small file placed on your device by our websites or the Platform when you either visit or use certain features of our websites or the Platform. It allows the websites to remember your actions or preference for a certain period.
4. Data Fiduciary: means any person who alone or in conjunction with other person(s) determines the purpose and means of processing of Personal Data.
5. Data Principal: means the individual to whom the Personal Data relates and where such individual is a Minor or Person with Disability includes the parents or lawful guardian of such Minor or Person with Disability.
6. Data Processor: means any person who processes Personal Data on behalf of a Data Fiduciary.
7. Personal Data: means any data about an individual who is identifiable by or in relation to such data.
8. Processing: in relation to Personal Data means an automated operation or set of operations performed on digital Personal Data, and may include operations such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
9. Consent Manager: means a person registered with the Data Protection Board of India, who acts as a single point of contact to enable a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform, in accordance with the provisions of the Digital Personal Data Protection Act, 2023.
10. Digital Personal Data: means Personal Data in digital form, including Personal Data that is collected in digital form or collected in non-digital form and subsequently digitized for processing, storage, transmission, or other lawful purposes.
11. Personal Data Breach: means any unauthorized processing of Personal Data or accidental disclosure, acquisition, sharing, use, alteration, destruction, loss of access to, or compromise of Personal Data that compromises its confidentiality, integrity, or availability.
12. Specified Purpose: means the specific, lawful, and clearly communicated purpose for which the Data Principal has voluntarily provided Personal Data to the Company, or for which the Company is otherwise permitted to process such Personal Data under the Digital Personal Data Protection Act, 2023 or any other applicable law.

2. How we collect Personal data
3. Information that you provide to us with your Consent: We receive and store any information you enter on our platform. Where processing is based on your consent, we will obtain your free, specific, informed, unconditional and unambiguous consent before processing your Personal Data. We collect your Personal Data for its intended purposes only and take reasonable steps to keep the Personal Data accurate and updated. You may withdraw your consent at any time by contacting us or through available digital channels. Withdrawal of consent shall not affect processing already carried out before such withdrawal and shall not apply where processing is required under applicable law or for legitimate uses permitted under the DPDP Act, 2023.
4. Automatic Information We Collect: We use Software Development Kits (SDKs), pixels, and web analysis methods to monitor performance, safeguard account security, and customise user experiences. The cookies are processed only after you provide your consent to ensure that your preferences are respected and upheld. You can also manage your cookie preferences for each kind of cookie used on our platform through our Cookie Settings. We attempt to provide clear information and options regarding cookies and privacy preferences for each cookie that our platform requests your browser to store. You may also be able to control or limit the collection of technical data through your browser or device settings.

Cookie Categories

• Essential Cookies: Critical for maintaining user sessions, identity verification, and fraud prevention. Disabling these cookies will impair platform functionality.
• Analytical & Performance Cookies: Help us compile anonymous traffic statistics, calculate ad impression ratios, and track click-through behaviour to optimise platform design.
• Preference Cookies: Used to remember user settings, regional parameters, and language selections for an efficient online experience.

Additionally we may use the following third-party services for these purposes to enhance your browsing experience, improve the functionality and security of our digital platforms, analyse website and application usage, and provide relevant content and advertisements:

• Google Analytics: to analyse website traffic, user interactions, and improve the performance of our digital services.
• Meta Pixel: to measure the effectiveness of advertising campaigns, understand user engagement, and deliver relevant advertisements on Meta platforms.
• Firebase: to support mobile application functionality, performance monitoring, analytics, crash reporting, authentication, and security.
• Microsoft Clarity: to understand user behaviour through session recordings, heatmaps, and usage analytics, enabling us to improve the usability and performance of our website.

These service providers may collect information such as your IP address, browser type, device information, operating system, pages visited, session duration, referring URLs, and interactions with our website or mobile application. The information collected is processed in accordance with applicable law and the respective privacy practices of these service providers.

3. Public Records: Information lawfully available in public records where required for compliance or due diligence
4. Others: Information Collected from payment service providers, legally authorized sources, credit information, authorized vendors, payment service providers with your consent.
5. Mobile Application: Our Mobile Application may request access to your device's camera, storage, location, microphone, biometric authentication, or notifications solely to provide requested services, comply with regulatory obligations, improve security, and enhance user experience. You may manage these permissions through your device settings; however, disabling certain permissions may affect the availability of some services.

Personal data may also be collected through branch visits, CCTV, mobile applications, customer care, travel partners, insurance partners, banking partners, payment gateways, mobile devices, APIs, and customer interactions.

3. Purpose of Data Collection and Processing

4. Lawful basis of Processing

Depending upon the nature of the processing activity, we process Personal Data based on the consent of the Data Principal, legitimate uses permitted under the Digital Personal Data Protection Act, 2023, and in compliance with applicable legal and regulatory obligations.

We are dedicated to safeguarding individuals’ privacy and ensure that Personal Data is collected and processed for specific, legitimate uses as prescribed under Section 7 of Digital Personal Data Protection Act, 2023 (DPDP Act). These include:

1. Voluntary sharing of Personal Data for specified purposes by the data principal.
2. Performance of functions by the state as per applicable laws or ensuring national security, sovereignty, and integrity of India.
3. For fulfilling any obligation under any law.
4. For compliance with any judgment or decree or order issued under any law.
5. For taking measures to provide medical treatment or health services to any individual during an epidemic.
6. Responding to health and other emergencies.
7. Employment related processing.
8. Processing during disasters and breakdown of public order.

Any changes to data processing purposes (mentioned in clause 3) will be communicated to individuals in advance.

5. Processing by Data Processors

We may engage authorized Data Processors to process Personal Data on our behalf. Such Data Processors are contractually bound to process Personal Data only on our documented instructions, implement appropriate technical and organizational security measures, maintain confidentiality, and comply with applicable data protection laws. They are not permitted to use Personal Data for their own independent purposes. We perform due diligence and periodic reviews of Data Processors before sharing personal data.

       Links to external websites: This Service may contain links to other sites (add-on service). If you decide to click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites before proceeding.  

6. Permissible to Children

We do not knowingly collect, process, or track the personal data of children without verifiable parental or guardian involvement. When children utilise our Platform (e.g., for educational travel or family banking products), processing requires verifiable parental or legal guardian consent. Where required under applicable law, we shall undertake reasonable measures to verify that consent has been provided by the parent or lawful guardian before processing the Personal Data of a child.

7. Sharing of Data

Additionally, for the purpose of complying with applicable statutory and regulatory obligations, we may share your personal data required under applicable laws with competent regulatory authorities, government agencies, law enforcement authorities, statutory bodies and other self-regulatory organizations strictly to the extent necessary for compliance with applicable legal and regulatory requirements.

8. Cross-Border Transfers

All cross-border transfers are subject to strict contractual provisions requiring recipients to enforce security controls equivalent to our own. Where Personal Data is transferred outside India for processing, such transfers shall be carried out in accordance with the Digital Personal Data Protection Act, 2023, notifications issued by the Central Government, applicable regulatory requirements, and appropriate contractual safeguards.

9. Rights and Duties as Data Principal

Depending on the laws of the country that applies to you, you may have different rights regarding the data we hold about you. You may be entitled to the following rights in relation to your data:

9.1 Right to Access Information: You have the right to obtain, upon request, information regarding the Personal Data we process about you, including a summary of such Personal Data, the processing activities undertaken, the identities of Data Fiduciaries and Data Processors with whom your Personal Data has been shared (where applicable), and any other information as prescribed under the Digital Personal Data Protection Act, 2023 and the rules made thereunder.

9.2 Right to correction and erasure: You have the right to request corrections to any inaccurate or incomplete data we hold about you. You also have the right to request the erasure of your data in specific situations. You have the option to give, manage, review, or withdraw your consent through an authorized Consent Manager as well. The withdrawal of consent does not affect the legality of processing carried out prior to the withdrawal. Furthermore, if processing is mandated by statutory obligations (such as RBI-mandated KYC preservation), we are legally required to retain the data despite a consent withdrawal request.

9.3 Right of grievance redressal: You have the right to access appropriate grievance redressal mechanisms to ensure timely and effective resolution of any complaints or concerns regarding the Processing of your Personal Data.

9.4 Right to Nominate: You may nominate an individual to exercise your data rights in case of your incapacity or death. This person can manage, access, or request changes to your Personal Data on your behalf, subject to proper verification.

Duties of Data Principals: You are expected to provide accurate, verifiable authentic and up-to-date information to us to facilitate proper data Processing. You should cooperate with us to ensure compliance with applicable data protection norms and exercise your rights responsibly, keeping in mind our legitimate uses and legal obligations. Where required by law, you must provide informed consent for the processing of your Personal Data. 

We request you to ensure that the Personal Data provided is accurate, complete and up to date. Where inaccuracies are identified, reasonable steps will be taken to update or correct such Personal Data.

10. Social Media

We manage channels, pages, and accounts on various social media platforms such as Facebook and Instagram to share information and engage with employees, vendors, clients, and the public. We may monitor and record comments and posts made about us on these platforms to help improve our products and services.

We advise you to use official and authorized channel only for communication purposes. Please be aware of communicating with us through publicly accessible social media sites with the following information:

10.1. Content that is inappropriate, offensive, or insulting toward individuals.

10.2. Any content that is unlawful, harmful, threatening, abusive, harassing, defamatory, obscene, vulgar, invasive of privacy or publicity rights, hateful, or otherwise offensive based on race, ethnicity, or other grounds.

10.3. Information that infringes on the rights of others, including intellectual property rights.

10.4. Confidential or Personal Data, such as financial details, bank account information, and transaction records.

10.5. Personal Data that may cause significant harm if disclosed, including:

• Personal information such as racial or ethnic origin, political opinions, religious beliefs, biometric identifiers, health information, or other confidential information that individuals should avoid posting on public social media platforms.
• Confidential or personal information such as financial information, government-issued identification numbers, health information, biometric identifiers, or other information that may expose you to risk if publicly disclosed.

We are not accountable for any content shared on third-party social media platforms unless it is officially published by our authorized representatives. Our responsibility is limited solely to the Personal Data we lawfully collect from these platforms, which is processed only for legitimate business purposes in accordance with applicable data protection laws.

11. Data Security

We care about keeping your Personal Data safe and secure. We also ensure that any service providers we work with protect your data in the same way we do. Our security measures include, but are not limited to, encryption, data masking, and access control.

• Encryption Standard Protocols: Data transmission over the internet is secured using industry-standard Transport Layer Security (TLS) encryption. Data at rest is encrypted using Advanced Encryption Standard (AES) 256-bit algorithms.
• Access Tokenisation: Granular, Role-Based Access Controls (RBAC) restricted via Multi-Factor Authentication (MFA) ensure that only authorised personnel can access sensitive datasets.
• Continuous Surveillance: Implementation of continuous security monitoring tools, Security Information and Event Management (SIEM) systems, threat hunting, and external Vulnerability Assessment and Penetration Testing (VAPT) protocols.

However, despite these safeguards and efforts to secure the information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, hence,  Company  cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat Company’s security and improperly collect, access, steal, or modify the information. Although Company shall do its best to protect the collected personal information, transmission of personal information to and from Company’s services is at the individual’s own risk. The customer shall only access the services from within a secure environment.

12. Data Retention

Retention periods differ based on the nature of the product or service and applicable legal and regulatory requirements. We retain Personal Data only for the period necessary to fulfil the purpose for which it was collected or as required under applicable laws, including RBI directions, the Prevention of Money Laundering Act, FEMA, tax laws, the Companies Act, and other regulatory requirements. Once the retention period expires, your data will either be deleted or archived to meet legal retention obligations or in accordance with applicable statutory limitation periods.

13. Breach Notification

Although we undertake appropriate technical and organisational measures to ensure safety and protection of the Personal Data of Users, in the event of any data breach, we shall notify you using appropriate communication channels and shall notify the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023 and applicable rules. 

14. How to Contact us

If you have any questions, concerns, or requests regarding this Privacy Notice, or if you wish to exercise your rights as a Data Principal, please contact our designated Grievance Officer / Data Protection Officer:

Attn: Grievance Officer / Data Protection Officer

Corporate Office Address: Wizzmoni Financial Services Limited, Administrative Office, Sixth Floor, Lanarth Elite Centre, Kochi Metro Pillar No. 707, MG Road, Kochi, Kerala, PIN: 682 011

Toll-Free Helpline: 1800 102 0555

Primary Contact Email: data.privacy@wizzmoni.com

Escalation Contact Email: dpo.india@wizzmoni.com

We shall acknowledge, examine, and resolve your grievances, questions, concerns, or requests in accordance with the timelines and procedures prescribed under the Digital Personal Data Protection Act, 2023, the rules framed thereunder, and any other applicable laws or regulatory requirements. If you are not satisfied with the resolution of a grievance, you may exercise such further rights or remedies as may be available under the applicable law.

15. Changes in the Privacy Notice:

15.1 From time to time, we may need to update or make changes to our Privacy Notice to ensure it remains accurate and in compliance with applicable laws and regulations.

15.2 Whenever such updates or changes are made, we will promptly upload the revised Privacy Notice to our platform.

15.3 We encourage you to periodically visit the page for the latest information on our privacy compliance. We may update this Privacy Notice from time to time to reflect changes in our business practices, technology, legal or regulatory requirements, or the services we provide. The revised Privacy Notice will be published on our Platform with the updated effective date. Your continued use of the Platform after the revised Privacy Notice becomes effective constitutes your acknowledgment of the updated Privacy Notice. However, where the Digital Personal Data Protection Act, 2023 or other applicable law requires your consent for the processing of your Personal Data or for any new or changed purpose of processing, we will obtain such consent separately in the manner prescribed by applicable law. Your continued use of the Platform shall not be construed as a substitute for any consent required under applicable law. 

15.4 You understand that you have the option to access this Privacy Notice in English or in any of the languages specified in the Eighth Schedule to the Constitution of India (you can request for the same by reaching out to us). In the event of any inconsistency or conflict between the English version and a translated version, the English version shall prevail.