Privacy policy
Last updated: 19 September 2026
This notice explains how Kredway processes digital personal data in line with the Digital Personal Data Protection Act, 2023. Kredway is a lending service provider / DSA intermediary and does not lend.
1. Who we are
Kredway is a brand operated by Lifepay Fintech Private Limited (CIN: U70200HR2023PTC116165), a company incorporated under the laws of India. Registered office: Flat No 0501, Tower No 44, Palm Hills, Sector 77, Narsinghpur, Gurugram, Haryana 122004.
Kredway acts as a lending service provider / DSA intermediary. We match MSME borrowers (Data Principals and, where applicable, persons authorised to act for a business) with RBI-registered banks and NBFCs. We do not lend money. Credit decisions, pricing and terms rest solely with the lender you choose to approach.
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Lifepay Fintech Private Limited is the Data Fiduciary in respect of personal data we determine the purpose and means of processing for. Where we process data solely on documented instructions of a lender or other third party, we may act as a Data Processor for that party — that relationship will be described in the relevant contract.
Contact for privacy requests: privacy@kredway.com. Website: https://kredway.com.
2. Data we collect
Depending on how you use Kredway, we may collect the following categories of digital personal data and related business information:
- Business details — for example entity / trade name, constitution, vintage, turnover or earnings band, product need, geography / PIN code, GST registration status, and similar profile fields you enter.
- Contact details — name of authorised person, phone number, email address, and messages you send us.
- PAN — Permanent Account Number when you provide it (including for a soft bureau check with consent).
- GST data — GSTIN and GST-related status or documents you submit or upload (for example GST returns).
- Bank statement data — current-account or other bank statements and related banking fields you upload or enter for eligibility matching.
- Credit bureau data — information returned from a soft bureau check that you have consented to (see section 4).
- Device and usage data — technical and usage information collected when you use the website (for example IP address, browser / device type, pages viewed, and approximate timestamps). See section 12 for cookies and analytics.
Aadhaar: We do not collect Aadhaar numbers through the Kredway website or loan-fit forms. If an RBI-registered bank or NBFC later requires KYC that includes Aadhaar, that collection and processing is by the lender under their own notice and consent flow — not by Kredway on this website.
We do not intentionally collect personal data of children. Kredway services are directed at businesses and adults acting for businesses.
3. Why we collect each category
We process personal data for the following stated purposes. Under the DPDP Act, processing is based on the free, specific, informed, unconditional and clear consent of the Data Principal where consent is required, and/or for other uses permitted by law (including employment is not applicable here; legitimate uses will be limited to those the Act allows).
- Business details — to assess indicative product and lender fit against lender eligibility criteria; to prepare a shortlist with written reasons; to communicate about your enquiry.
- Contact details — to identify you, respond to enquiries, send shortlist or status updates, and handle grievances.
- PAN — to run a soft credit bureau check after your explicit consent; to support matching and fraud / identity checks required for intermediary operations.
- GST data — to evaluate GST-related eligibility criteria used by lenders and to support file completeness for matching.
- Bank statement data — to evaluate banking and cash-flow signals used in indicative eligibility matching (not a sanction).
- Credit bureau data — to inform indicative score / profile insights and lender-fit messaging after soft-pull consent; not to provide credit-repair services.
- Device and usage data — to operate, secure and improve the website; to understand aggregate usage; and to support analytics described in section 12.
We do not sell personal data. We do not use personal data to guarantee loan approval or any credit-score outcome.
4. Credit bureau checks
Soft bureau checks run only after you give explicit consent (for example by ticking a consent control and submitting the form). A soft pull is not the same as a hard loan enquiry that a bank or NBFC may make at the time of a formal application or sanction.
What may be shared with the credit bureau (or bureau connectivity provider) for a soft check typically includes identifiers you provide for the check — such as your name and PAN — together with such other particulars as the bureau interface requires to return a soft report. Exact fields depend on our authorised credit-bureau connectivity partner (named in the consent flow at the time of the soft check) and the product configuration in force at the time of the check.
If you later apply to an RBI-registered bank or NBFC, that lender may run its own hard enquiry and KYC under its policies. Kredway does not control lender hard enquiries.
Bureau: Credit Information Companies registered with the Reserve Bank of India (the specific bureau used for your soft check is named in the consent flow). Connectivity / facilitation (if any): our authorised credit-bureau connectivity partner (named in the consent flow at the time of the soft check).
6. Consent
Where processing is based on consent, we take consent in a clear affirmative manner — for example unchecked consent boxes you must actively select, linked to the specific purpose (such as soft bureau check, document upload for matching, or soft-pull plus terms acknowledgement).
You may withdraw consent at any time by writing to privacy@kredway.com or the Grievance Officer (section 13), or via Cookie preferences on this website for cookie consent. Withdrawal will not affect processing already lawfully completed before withdrawal.
Effect of withdrawal: we will stop the processing that depended on that consent, subject to retention required by law, dispute handling, or legitimate records of the transaction. Withdrawal may mean we cannot continue matching, soft bureau checks, or related services that need that data. If a Consent Manager is appointed for Kredway, Data Principals may also manage consent through that Consent Manager as notified here: Not appointed.
7. Retention
We retain personal data only for as long as needed for the purposes stated, or longer if required by law, regulation, or to handle disputes. Indicative periods:
- Business and contact details (lead / enquiry file) — only for as long as needed for matching and follow-up, then delete or anonymise, unless a longer period is required by law or an open grievance from last meaningful interaction, then delete or anonymise.
- PAN and soft bureau artefacts — only for as long as needed for the soft check and matching cycle, then delete or anonymise, unless a longer period is required for audit, complaint handling or law after the soft check / matching cycle, unless a longer period is required for audit or complaint handling.
- GST and bank statement documents you upload — only for as long as needed for the matching cycle (or an active application we are supporting at your or a lender's request), then delete, unless law requires longer retention after the matching cycle closes, unless you or a lender ask us to keep them for an active application we are supporting.
- Device and usage / analytics logs — only for as long as needed for security, debugging and aggregate analytics, then aggregate or delete.
- Grievance and correspondence records — for as long as needed to evidence resolution and meet applicable legal record-keeping duties.
Basis: purpose limitation and storage limitation under the DPDP Act; contractual and regulatory record-keeping for a DSA / lending service provider as applicable to Lifepay Fintech Private Limited.
8. Deletion and correction
As a Data Principal, you may request correction of inaccurate personal data, or erasure of personal data that is no longer necessary for the stated purpose (subject to legal retention).
How to request: email privacy@kredway.com (or the Grievance Officer at grievance@kredway.com) with subject line "Data Principal request — correction" or "Data Principal request — erasure", and enough detail for us to identify your file (for example registered phone / email and GSTIN if used).
Response timeline: we aim to acknowledge within 7 business days and complete the request within 30 days, or sooner if a shorter period is mandated under the DPDP Act and rules, and in any event within timelines required under the DPDP Act and rules once notified.
9. User rights
Subject to the DPDP Act and applicable rules, Data Principals may exercise rights including:
- Right to access information about personal data processed and the processing activities.
- Right to correction and erasure of personal data (see section 8).
- Right to data portability where provided under applicable law / rules.
- Right to withdraw consent (see section 6).
- Right of grievance redressal with the Data Fiduciary (see section 13), and thereafter with the Data Protection Board of India as provided by law.
- Right to nominate another individual to exercise rights in the event of death or incapacity of the Data Principal, in the manner prescribed: send nomination details to privacy@kredway.com using a written nomination request (email privacy@kredway.com with subject "Data Principal nomination"; we will confirm the particulars we need).
10. Security measures
We implement reasonable security safeguards to protect personal data against unauthorised access, use, modification or disclosure, appropriate to the nature of the data and the risks of processing. Measures include HTTPS/TLS for data in transit, access controls and least-privilege staff access to enquiry files, separation of production credentials from public client code, and contractual processor obligations on hosting and communications providers.
No method of transmission or storage is completely secure. If we become aware of a personal data breach that requires notification under applicable law, we will notify affected Data Principals and/or the Data Protection Board as required.
11. Cross-border transfer
We primarily process and store personal data in India. Where a service provider processes personal data outside India (for example certain cloud, analytics or communications tools), we do so only as permitted under the Digital Personal Data Protection Act, 2023 and applicable rules, and under contracts that require appropriate safeguards.
13. Grievance officer
In accordance with applicable Indian law (including intermediary / IT rules where they apply, and the DPDP Act grievance mechanism), you may contact:
- Name: Ashish Kaushik
- Designation: Grievance Officer
- Email: grievance@kredway.com
- Postal address: Flat No 0501, Tower No 44, Palm Hills, Sector 77, Narsinghpur, Gurugram, Haryana 122004
- Phone (if published): +91 98701 79343
Response timeline: we aim to acknowledge grievances promptly and resolve them within 30 days, or sooner if a shorter period is mandated.
14. Last updated date
This Privacy Policy was last updated on 19 September 2026. We may revise it from time to time. The updated version will be posted on this page with a revised date. Material changes that require fresh consent will be brought to your attention as required by law.