Privacy Notice

1. INTRODUCTION

1.1 SBI Cards and Payment Services Limited (“SBIC”, “we”, “our” or “us”), is a leading non-banking financial company registered under Reserve Bank of India, having its registered office at Unit 401 & 402, 4TH Floor, Aggarwal Millennium Tower, E 1,2,3, Netaji Subash Place, Wazipur, New Delhi – 110034 and its corporate office at 2nd Floor, Tower B, DLF Infinity Towers, DLF Cyber City, DLF Phase 2, Gurgaon-122002, Haryana.

1.2 This Privacy Notice (hereinafter referred to as the "Notice") applies to our website, mobile application, customer portals, onboarding journeys, customer support interactions, marketing communications and all products and services offered by us.

1.3 This Privacy Notice explains how we handle and process Personal Data within SBIC.

"Personal Data" refers to any data about an individual who can be identified by or in relation to such data."

2. APPLICABILITY

2.1 This Notice applies to (a) applicants of our credit card products; (b) existing and former customers; (c) visitors to our website or apps; (d) users interacting with us digitally or offline; (e) and individuals whose information is shared with us in connection with our product or services.

Please note that our website / mobile app / digital properties enable you to access several other websites through redirection, embedded links etc. on which SBIC has no control. SBIC is not responsible for the content and the privacy practices of such other websites. SBIC encourages the user to examine each website’s privacy statement. SBIC does not owe any responsibility to any user for the access to other websites and its contents thereof, which are detailed/specified on the SBIC’s website/mobile app / digital properties.

3. PERSONAL DATA WE COLLECT

We collect Personal Data from you directly or through our partner, representatives etc. This may include without limitation:

(a) Identity, Contact Information and KYC

Example: your name, date of birth, gender, date of birth, user IDs, signature, email addresses, phone numbers, contact details, KYC/identity documents like Aadhaar and PAN, biometric data, communications with us, device and location data, previous names, maiden names, marital status, related person information, nomination, medical condition, domicile, origin, citizenship, nationality, residence, photograph or any other data that identifies you (whether directly or indirectly), such as information you provide on any forms, surveys, online applications or similar online fields, or demographic information that you provide and aggregated or de-identified Data.

(b) Financial Information

Example: bank account details, financial information, payment credentials, transaction data (credit details such as amounts, lending history, and repayments, credit history, income details, payment information, such as credit or debit card information, including the name of the cardholder, card number, billing address, and expiry date through our payment processing system etc., investments history, credit/debit card details, prepaid payment instrument details, any other instrument/ modality/ function details, UPI handles, income details, history in relation to these, employment / occupational information, residential status under banking, general and tax laws, spending/saving/investing/payments/receipts/borrowing history, risk profile, financial objectives, financial knowledge and experience, preferences, information collected when you make or receive payments or any other information relating to occupation and financial situation such as employer’s name and address, if self-employed, type of account, and nature and volume of anticipated business dealings, with the conventional bank licensee, income proof, bank statements, income tax returns, salary slip, contract of employment, passbook, expenditure, assets and liabilities, source of wealth and signature.

(c) Device and Technical Information

Example: any device and technical information obtained during your usage of our website, such as IP addresses, cookie identifiers, or other unique identifiers, like mobile carriers, time zone setting, operating system, platform, geolocation, etc.

(d) Marketing, Communication and Interaction Data

Example: your preferences relating to receiving marketing messages from us and our service providers, your communication preferences, knowing customer preferences, such as spending patterns, preferences, interests etc.

(e) Third Party Products Data

Example: Data about you is obtained from other sources with your consent (such as email service providers, public databases, joint marketing partners, social media platforms, as well, credit information companies/ credit reference agencies, risk management and fraud prevention agencies, national and government databases etc.

You must ensure that all Personal Data that you provide to us is accurate, up-to-date, and true. You will be responsible for any errors, discrepancies, or inaccuracies in the Personal Data that has been shared with us, except for such Personal Data that has been verified through KYC processes set out by applicable law and backed by documentary proof.

4. HOW WE COLLECT PERSONAL DATA

The type of Personal Data we collect depends on the product or service you request, inquire or use. In some cases, you provide us with this information directly. You disclose information such as your name, date of birth, address, phone number, and email when you:

• Apply for an SBI Card product or service online.
• Access our mobile app or online services.
• Make a purchase through your SBI Card.
• Interact with our customer services, representatives or any digital touchpoints customer services
• Enroll in any SBI Card offer, participate in a promotion, or take one of our surveys.
• During due diligence and KYC process from credit bureaus etc.

Cookies and Similar Technologies

We also collect information through Cookies and similar technologies when you use our online services or access content online through our website and mobile application.

A cookie is a small data file that a website transfers to your computer. Similar technologies include clear GIFs, web beacons, and pixel tags, which tend to be transparent images on websites. Our Cookies and Similar Technologies collect information about your device, operating system, and web browser. They also collect information about your use of the device.

• The operating system or type of device you use to open emails from SBI Card.
• Information related to your IP address, such as your domain, internet provider, and general geographic location.
• How you use our websites and apps, such as what you search for on our websites and apps, the pages you view, how long you stay, and how often you visit them.
• How you search for our websites or apps, which website or apps directed you to us, and, in some cases, if you’ve visited a website operated by one of our business or commercial partners.
• Ads or online content created by SBI Cards or our commercial partners that you view, access, or click.
• Whether you open our emails, which sections you click, and how often you open them.
• If you use your mobile device to access our products or services, we may collect information related to that device, such as your location.

Other Sources of Information

We may collect your information from other sources in accordance with product or service-specific privacy notices and terms and conditions that you agree to either on our website/application or our partner sites.

SBIC strives to ensure that Personal Data collected is relevant to and not excessive for the required purposes.

5. PURPOSE OF PROCESSING

1. Credit Card Services - Such as processing your application for one or more products and services, transaction processing, delivering and improving, managing your existing product and letting you know about new features and benefits such as upgrades, rewards, benefits, EMI options, loans, card variants and related products and services, process and complete transactions and for continuous improvement of our products and services.
2. Verification and authentication - Verifying your identity, address, and identity details, performing e-KYC checks in compliance with regulatory requirements, v erifying your employment status, income, and job stability to assess repayment capacity, verifying the authenticity of employment data helps prevent fraudulent applications.
3. Legal and Regulatory Compliance- Such as completion of customer due diligence, know your customer/ anti-money laundering checks, KYC checks, credit reporting, audits and assessments, and/or to initiate legal or regulatory proceedings for enforcement of our rights or defending your claims and to comply with any legal obligation that may arise under an applicable law.
4. Continued Eligibility / Creditworthiness Assessment - Analyzing your financial and credit history to determine credit eligibility, assessing your repayment capacity and calculating credit risk, by way of background checks, inspections, verifications, etc.
5. Security and Prevention –We may use automated systems to help us make certain decisions, process card applications, manage fraud, Risk analytics, and assess security risks through recognize you and your device in order to detect and prevent fraud or criminal activity for safeguarding your accounts. .
6. Customer Communication- Through responding queries and complaints, providing essential account related information, conducting research to better understand our online visitors, customers, requesting feedback or reviews about our products and services, along with those of our partners and third parties. To communicate with you through emails, chats, telephone calls, WhatsApp and other means for providing essential account-related information, security alerts etc., sending and enforcing terms and conditions and policies, to send notifications to manage our relationship with you including to notify you of changes to our Services, send you information and updates pertaining to the Services you have availed and communicate with you for the same through emails, chats, telephone calls, WhatsApp and other means.
7. Marketing and Personalisation- Such as analyzing the effectiveness of our advertising and marketing campaigns and determining your eligibility for any applicable offers, products or services of SBI card or its third parties to provide you best value from your card product and relationship with SBIC. Further to provide you with and enable your use of the Product and related services such as loyalty and rewards programs.

We sometimes Process aggregated and anonymized information that does not identify any individual for various analytic purposes. This is referred to as aggregated and anonymized information. We use aggregated and anonymized information to:

1. Analyze patterns among groups of people, such as card holders and online users.
2. Create risk and credit models, business insights or statistical research reports.
3. Improve our advertising and our business.

6. SHARING OF PERSONAL DATA

We may share your Personal Data internally and/or with external parties to provide you with offers and value-added services on your existing product and/or other products and services.

1. Service Provider and Processors who perform services for us that include printing, mail, collection agencies, courier, website hosting, data storage, software services, email services, marketing, fulfilling customer orders, providing payment services, data analytics, professional and legal advisors, customer services, advertising and marketing etc.
2. Financial and Regulatory Ecosystem Participants such as regulatory authorities, courts, and governmental agencies, credit bureaus, account aggregators etc. to comply with legal or regulatory requirements, assist in legal or regulatory investigations, and protect the rights of SBI Cards or others.
3. Third Parties: such as credit information companies, bureaus, switches, networks, card associations, settlement, transfer and processing intermediaries, payment aggregators, payment gateways, payments systems, service providers, consultants, vendors, agents, fintech entities, co-brand entities /partners, distributors, selling/ marketing agents, any partners, collaborators, co-lenders, co-originators, merchants, aggregators, lead generators, sourcing entities, clients, customers or other persons with whom the SBIC has any direct or indirect arrangement or tie-up or contract for any products or services, or other player(s)/ intermediaries in any ecosystem of which the SBIC is a part, entities managing loyalty programs, managing, generating and/or implementing any offers, discounts, cashbacks, chargebacks, features, etc., and such entities may share your personal data with their service providers, consultants, vendors, etc., for the purposes mentioned in this Notice.

7. RIGHTS OF DATA PRINCIPAL

You have several rights regarding Processing of your Personal Data by SBIC under certain circumstances. If you wish to exercise any of these rights, have concerns, or wish to raise a complaint or grievance, please contact us as per the details mentioned under Contact Us section on our Website.

8. DATA SECURITY

We ensure that all appropriate technical, physical, and organizational measures will be taken to prevent unauthorized access, unlawful processing, and unauthorized or accidental loss, destruction, or damage to your Personal Data through encryption, obfuscation, masking or the use of virtual tokens wherever appropriate.

SBIC is committed to protecting your Personal Data and implements robust technical , organizational security measures and administrative safeguards in line with the with the applicable laws including but not limited to access controls, data encryption, monitoring systems, secure authentication, tokenization where appropriate, vulnerability management and regular security assessments, control policies, manage assets effectively, maintain business continuity plans, enforce password management practices, leverage two-factor authentication, implement logging and monitoring systems, prioritize network and communication security, maintain data backups, and restore procedures, and prioritize physical and environmental security.

9. DATA RETENTION

SBIC shall retain your Personal Data collected on its systems or received through third parties for as long as necessary to provide you with services, fulfilling regulatory and legal obligations, fraud prevention, dispute resolution, audit and to enforce any contractual obligations. Personal Data will be kept only as long as it is necessary for the purposes for which it was collected and processed and in accordance with data storage requirements under various applicable local laws and SBICs Document / Record Retention & Disposal Policy.

Personal Data on declined credit card applications will be stored in SBIC ecosystem for 3 months in case of physical documents and all digital data is stored for 3 years for various analytics purposes. Retention period on certain Personal Data may continue even after the closure of card/account where required to be retained under applicable law.

10. CROSS BORDER DATA TRANSFER

SBIC stores Personal Data of its customers within the territory of India. To the extent necessary, we may transfer Personal Data to other countries with different data protection laws, in order to provide you with our products or services, unless it’s restricted by an applicable law.

11. CHILDREN’S PRIVACY

Our products and services are intended only for individuals of or above the age of 18 years. We do not collect or otherwise Process Personal Data of individuals who do not qualify the legal eligibility under the applicable law.

12. LANGUAGE AND ACCESSIBILITY

This Notice is made available to you in additional Indian languages in accordance with applicable legal requirements.

In the event of conflict, the English Version shall govern unless otherwise required by law.

13. CHANGES TO PRIVACY NOTICE

SBIC reserves the right to update this Privacy Notice periodically. SBIC ensures these changes align with any evolving legal requirements or significant modifications to SBIC’s personal information handling practices.

We encourage you to periodically review this Privacy Notice for the latest information on our privacy practices.

14. YOUR CHOICE OF COMMUNICATION

You have the power to make choices about how SBIC uses your Personal Data for marketing and advertising purposes. We work with a range of advertising partners including ad networks, ad servers, and social media platforms to serve you our ads online. Your choices may vary, depending on whether we’re serving you ads through websites, email, apps, or social media.

You can change your cookie preferences in your Browser (for example, Chrome, Safari or Internet Explorer) or your mobile device settings to limit the ways in which cookies may be used to collect and use information about you.

You can adjust how we use your Personal Data through your mobile device settings – for example, you can turn off location-based services and device ad tracking.

In order to serve you better, we may reach out to you through WhatsApp in addition to standard modes of communication. If you do not wish to receive service updates for your account though WhatsApp, you may opt out of the service. If you wish to resume the service, you may re-enrol. Please be advised that you will continue to receive updates through SMS and Email alerts.

If you do not wish to receive direct marketing communications from us, you can register for the National Do Not Call List with us in line with applicable regulations.

Keep in mind, even if you opt out of direct marketing, we’ll still communicate with you in order to service your account, fulfil your requests, or administer a promotion or program you’ve opted to be part of to the extent permitted under applicable laws.

15. CONTACT US

If you have comments, questions, issues or requests relating to this Privacy Notice, please contact our Data Protection Officer (DPO) using the Contact Us page on our website.

16. COMPLAINTS

If you have a concern with respect to the way we have handled your personal data, you have a right to approach the Data Protection Board of India (“Board”). However, we encourage you to first contact us in the manner provided in this Policy, to allow us an opportunity to address your concerns.