Privacy Policy

This document explains how Bharat Co-operative Bank (Mumbai) Ltd. ("Bharat Bank" or the "Bank") manages and processes your information. We take your data privacy seriously and encourage you to review this policy in detail.

Key Definitions

To help you understand this policy, we use the following defined terms:

• Bank / Bharat Bank: Refers to Bharat Co-operative Bank (Mumbai) Ltd.
• Covered Person(s) / You: Any natural person whose personal data is processed by the Bank, including customers, authorized signatories, or representatives.
• Data: A collective term including your personal information, sensitive data, KYC details, and any "Derivative Data" created through analysis or profiling.
• Derivation: The internal or external process used to create "Derivative Data".
• Derivative Data: Information we generate from your data, such as credit scores, behavioral projections, or analytical reports created by software and algorithms.
• Processing Entity: Any person or organization with whom we share your data for processing, including service providers, vendors, and affiliates. 
• Product(s): All banking and financial services offered or distributed by the Bank, such as accounts, loans, cards, UPI services, and insurance.
• Specified Purposes: The collective reasons we process your data, including:
  • Risk & Credit: Assessing creditworthiness, risk analysis, and obtaining credit reports.
  • Security: Fraud detection, crime prevention (including terror funding), and verifying documents.
  • Compliance: Background checks, KYC/AML verifications, and regulatory reporting.
  • Operations: Customer service, debt recovery, legal proceedings, and enforcing the Bank's rights.

Applicability

This Privacy Policy governs the personal data of any individual ("Covered Person" or "You") processed by or on behalf of Bharat Bank, whether the information is in physical or digital form.

The policy covers a wide range of "Products" and services offered by the Bank, its subsidiaries, or affiliates. This includes, but is not limited to:

• Banking & Credit: Savings and current accounts, loans, credit/debit cards, and credit assessments.
• Payments & Transfers: UPI services, payment gateways, wallets, POS services, remittance, and currency exchange.
• Intermediary Roles: Services where the Bank acts as an agent, sponsor bank, Payment Service Provider (PSP), or Third Party Application Provider (TPAP).
• Other Financial Services: Insurance, investment products, advisory services, and cash management.

This policy applies regardless of whether you have a direct relationship with the Bank or interact with us indirectly through an intermediary or third-party entity. It also extends to individuals acting as authorized signatories or representatives for non- individual customers.

Please Note: This Privacy Policy works alongside the specific terms and conditions of your chosen Products. It does not replace or limit those specific agreements or any other consents you have provided to Bharat Bank. We recommend reading those product-specific terms in conjunction with this policy.

Who We Are

In this policy, the terms “we,” “us,” “our,” and “ours” refer specifically to Bharat Bank.

“Bharat Bank” or the “Bank” refers to Bharat Cooperative Bank (Mumbai) Ltd.. Our primary locations and contact details are as follows:

• Registered Office: Mohan Terrace, 64/72, Mody Street, Fort, Mumbai 400001.
• Central Office: ‘MARUTAGIRI’, Plot No. 13/9 A, Samant Estate, Sonawala Road, Goregaon (East), Mumbai 400063, India.
• Official Website: https://www.bharatbank.bank.in/

Data

The personal data collected or received falls into various categories as under:

Identity & contact information

• Name, address, signatures, biometric data, date of birth, copies of identity cards (ID), contact details including email id and phone number, address, previous names, maiden names, marital status, relatives information, nomination, medical condition, domicile, origin, citizenship, nationality, residence, any legal or other identifiers like Permanent Account Number (PAN)/ Taxpayer Identification Number (TIN)/ Aadhaar/ National ID/ Social Security Number/ or its equivalent, Photograph and Gender.
• Data that identifies (whether directly or indirectly) a particular individual, such as information you provide on any forms, surveys, online applications or similar online fields.
• Demographic information that you provide and aggregated or de-identified Data.

Financial details/circumstances

• Bank account details, investments history, credit/debit card details, prepaid payment instrument details, any other instrument/ modality/ function details, UPI handles, income details, history in relation to these.
• Employment / occupational information. 
• Residential status under banking, general and tax laws.
• Spending/saving/investing/payments/receipts/borrowing history.
• Risk profile, financial objectives, financial knowledge and experience, preferences and any other information to assess the suitability of the Products to you.
• Information collected when you make or receive payments.
• Other information such as information relating to occupation and financial situation such as employer’s name and address, if self-employed, type of account, and nature and volume of anticipated business dealings, with the conventional bank licensee, income proof, bank statements, income tax returns, salary slip, contract of employment, 
  passbook, expenditure, assets and liabilities, source of wealth and signature.
• Data that is collected when you make financial and non-financial transactions. Data may include information associated with the transaction such as amount sent or requested, amount paid for Products or merchant information, including information about any funding instruments used to complete the transaction.

Information you provide about others or others provide about you

• If you give information or data about someone else (for example, information or data about a spouse or financial associate provided during the course of a joint application with that person), or someone gives information about you, may be added to any Data that is already held about you and can be used in the ways described in this Privacy 
  Policy.
• Your Data from third party providers: In order to enhance our ability to provide relevant marketing, offers, and services to you, Data about you is obtained from other sources with your consent, such as email service providers, public databases, joint marketing partners, social media platforms, as well as from other third parties as appropriate.
• Information including Data from credit information companies/ credit reference agencies, risk management and fraud prevention agencies, national and government databases.
• Information including Data from other parties and entities where we are a part of a transaction in one or more roles even though we may not be directly interfacing you, for example during the course of remittances being initiated by you through your bank to a beneficiary whose bank account is with us.
• Data of authorised signatories or authorised persons or representatives of non- individual applicants/ customers/ users of any services, whether direct or indirect.

Information from online activities

• Information about your internet activity is collected using technology known as cookies, which can often be controlled through internet browsers. For detailed information on the cookies used and the purposes for which they are used, see our Cookie Policy, which is available on our website.
• Your digital and electronic devices where various checks are performed are designed to ascertain and verify your residency to ensure we meet our regulatory obligations. These checks include identifying and collecting your location (with your specific permission) and the IP address your device connects from and the collection of information about your use of the website or mobile app (including device type, operating system, screen resolution, and the way you interact with us).
• Information about your Internet browser, IP address, and information collected through tracking technologies.
• Unique device identifier such as International Mobile Equipment Identity (IMEI) number, technical usage data, contact lists (in some cases where specific permission is obtained), technical data about your computer and mobile device including details regarding applications and usage details.
• Information such as your fingerprint, etc. that you choose to provide to us. We will not collect your biometric information without your explicit consent.
• Generation and storing password or PIN in encrypted form.

Other personal information

• Information in relation to data access, correction, restriction, deletion, porting requests and complaints.
• CCTV images and Data at our Bank branches, offices and ATMs (but only for security reasons and to help prevent fraud or crime).
• Conversations during meetings/calls/correspondences/discussions with bank staff.
• Social relationships detail such as your father’s name, spouse’s name and mother’s name
• Behavioural details as to how to utilise our Products, offers etc., your browsing actions, patterns and online activity;
• Records of correspondence and other communications with you, including email, telephone conversations, live chat, instant messages and social media communications containing information concerning your grievances, complaints and dispute.
• Any other information, Data or records which you may consent to be collected or used.

From the categories of information mentioned above, the Bank identifies the 
following specific items as "sensitive personal data or information":

• Passwords: Access credentials for your accounts.
• Financial Details: Information regarding your bank accounts, credit/debit cards, or any other payment instrument data.
• Health Records: Your physical, physiological, and mental health conditions, as well as medical history.
• Sexual Orientation: Information regarding your sexual orientation.
• Biometric Data: Unique biological identifiers.
• Related Details: Any additional information provided by you that relates to the items listed above.

It is important to note that information does not qualify as "sensitive personal data" if it is already accessible to the public, available through the Right to Information Act (2005), or provided under any other active legislation.

The term “Data” serves as a collective label for all information we handle. This includes your personal and sensitive data, KYC details, and any “Derivative Data.” Derivative Data refers to insights we generate such as credit scores, behavioural profiles, or analytical reports using algorithms, software, and automated profiling.

These insights may be developed solely from your information or by combining it with data from external sources and databases. Finally, the internal or external process used to generate these insights is referred to as “Derivation.”

Data Collection: Timing and Methods

We gather and process your information through various touch-points and interactions, including:

• Direct Interaction: When you provide information while applying for, inquiring about, or using our Products and services.
• Transaction Activity: During the course of your financial transactions, whether they are performed directly with us or through platforms where we act as a service provider (such as UPI, NACH, or NEFT).
• Operational Processes: Data is collected during essential banking procedures, such as credit and risk assessments, background checks, KYC/AML verifications, and fraud prevention measures.
• Digital and Physical Presence: When you visit our branches, use our website, or interact with our mobile applications (including information collected via cookies).
• Communication: Through your emails, phone calls, meetings, or complaints handled by our staff, service providers, or representatives.
• External and Public Sources: From publicly available records, including social media accounts (where appropriate), and from third parties involved in the payment infrastructure (such as TPAPs, payment gateways, or sponsor banks).
• Internal Analysis: Data generated through "Derivation," where we create new insights (like credit scores) based on existing information.

By agreeing to this Privacy Policy or by utilizing any of our Products including transactions initiated through third parties (such as UPI transfers where we act as the PSP bank) you confirm that any individual or entity providing your data to us is fully authorized by you to do so. This includes any information we obtain through the "Derivation" process. Furthermore, you grant us permission to process this data for any of the objectives and purposes outlined in this policy.

Our Data Processing Approach

Whether we are verifying your identity, assisting with a product application, or enhancing your overall experience with us, we handle your information with the utmost care. At every stage, our processing activities are strictly guided by the core principles of protection and transparency detailed in this Privacy Policy.

Reasons for Processing Your Data

Your information may be processed by the Bank or its authorized Processing Entities for the objectives listed below. By using our services, you acknowledge and provide your consent for these activities: 

• Service Delivery and Management: To offer, activate, and manage the banking products you use, including processing applications, executing transactions, and fulfilling our contractual obligations to you.
• Risk and Credit Assessment: To evaluate your financial standing and creditworthiness. This includes performing credit scoring, risk analysis, and due diligence by obtaining reports from credit bureaus, fintech partners, and other service providers.
• Security and Fraud Prevention: To protect your accounts through fraud detection, probability checks, and reference verifications. We use your data to maintain business continuity, manage risks, and ensure the safety of our systems.
• Digital Experience and Accessibility: To facilitate your use of our websites, mobile apps, and physical branches. This includes personalizing your online experience and, with your permission, accessing device-level data to enable specific app features.
• Operational Improvement: To conduct data analysis, audits, and research into usage trends. This helps us measure the effectiveness of our campaigns and improve the overall quality of our products and customer service.
• Communication: To contact you regarding your account, verify your whereabouts, or update you on important changes to our terms, conditions, and policies. We may reach out via post, phone, SMS, email, WhatsApp, social media, or through our ATM and POS networks.
• Compliance and Legal Interests: To meet our regulatory and legal obligations. We also process data based on our "legitimate interests," such as developing new products or testing "proof of concept" solutions with vendors to improve our efficiency and fraud prevention capabilities.
• Marketing and Promotions: With your specific consent, we may use your data to refer or cross-sell relevant financial products to you or allow you to participate in surveys, contests, and market research.
• Emergency Situations: To protect your vital interests in rare circumstances where you may be unable to provide immediate consent (such as a medical emergency).
• Support Functions: For any administrative, system development, or planning purposes that are necessary to support the services mentioned above.

You acknowledge and agree that Bharat Bank may partner with various Processing Entities to fulfill the objectives mentioned above, including any related or supporting tasks. Consequently, we may share your Data with these entities and permit them to process or share it further as needed to achieve those specific purposes.

Automated Processing and Decision-Making

To manage our products and evaluate applications efficiently, we use automated profiling and decision-making systems. This means your data may be processed by software that analyzes your personal information to assess eligibility, evaluate creditworthiness, and predict potential risks or outcomes.

We also utilize automated tools for anti-money laundering (AML) and sanctions screening. Through these processes, the system may automatically flag you as a fraud or money laundering risk if:

• Your activity matches patterns associated with fraudulent behavior or money laundering.
• The information provided is inconsistent with your previous records.
• It appears that steps have been taken to intentionally conceal your true identity.

With Whom Do We Share Your Information?

We may disclose your data to the following parties or under the specific circumstances listed below:

• Affiliates: We share information with our affiliates to provide a more seamless and enhanced experience across our various services, where permitted by law or your consent.
• Operational Partners: Data is shared with vendors, service providers, and agents who assist us in running our business, maintaining our systems, or delivering specific products and services to you.
• Strategic Alliances: We share details with entities involved in co-branded programs, rewards schemes, loyalty initiatives, or special benefit offers.
• Financial Collaborators: This includes co-lenders, originators, and other financial institutions with whom the Bank has formal partnerships for credit or investment products.
• Legal and Regulatory Authorities: We may share data—without prior notice or consent—with government bodies, law enforcement, courts, and regulators when required by law, a court order, or a regulatory directive. Please note that once shared with these authorities, we do not control how they further process the data.
• Credit and Verification Agencies: Information is shared with credit bureaus, fintech partners, the Central KYC Records Registry, and due diligence providers to assess creditworthiness, verify identity, and perform risk analysis.
• Payment Infrastructure Providers: We share data with entities involved in the national payment ecosystem (such as UPI, NACH, NEFT, RTGS, and IMPS) and third-party application providers (TPAPs) to facilitate your transactions and payments.
• Safety and Protection: We disclose information to third parties when necessary to enforce our terms, address technical or security issues, respond to emergencies, or protect the rights and safety of our customers and the public.
• Analytical Partners: Data is shared with those involved in "Derivation" processes to help us build internal models and risk profiles.

The entities and individuals mentioned above may also share your information with their own network of service providers, consultants, subsidiaries, fintech partners, and marketing agents. This extends to collaborators, merchants, lead generators, and any other intermediaries within the financial ecosystem we operate in, such as TPAPs (where we serve as the PSP bank).

Such sharing is conducted to fulfill the primary objectives of this policy or any necessary supporting activities. Any organization or person that receives and handles this data for these purposes is known as a “Processing Entity.” For any Processing Entity with whom we have a direct agreement, we implement contractual safeguards to ensure they only use your data for the specific purposes outlined in this policy.

For additional details regarding how your information is handled for specific services, please consult the application forms and the unique terms and conditions associated with each Product.

Withdrawing Your Consent

If you decide to withdraw your consent for the processing of your personal information, you can do so by emailing a completed Consent Withdrawal Form to privacy@bharatbank.co.in from your registered email address.

Once we have successfully verified your request, the Bank will process it within 30 business days. Please be aware of the following:

• Legal Retention: We may still be required to keep certain parts of your data to meet our legal and regulatory obligations.
• Service Impact: Withdrawing your consent may affect our ability to continue providing specific products or services to you.

Data Retention Period

We retain the information collected on our systems, or with our authorized third parties, for as long as necessary to fulfill the purposes described in this policy. We may continue to store this data even after your specific account or transactional relationship with us has ended for the following reasons:

• Legal & Regulatory Compliance: To meet any statutory requirements or obligations mandated by law.
• Legal Protection: To establish, exercise, or defend against legal claims.
• Policy Requirements: As outlined within the specific provisions of this Privacy Policy.
• Specific Consents: In accordance with any additional permissions you have granted us.

Security Standards and Procedures

We are committed to protecting your information by employing industry-standard organizational, technical, and administrative security measures. While we strive to maintain a secure environment, no system is entirely infallible. If you have any reason to suspect that your interaction with us or your account security has been compromised, please notify us immediately using the details provided in the "How to Contact Us" section.

External Links and Redirects

Our websites, platforms, and mobile applications may occasionally provide links or redirect you to external sites and apps managed by other networks, advertisers, affiliates, or Processing Entities. Please be aware that these third-party platforms operate under their own independent privacy policies. We do not accept any responsibility or liability for their practices or the content of their notices. We strongly encourage you to review their specific privacy policies before submitting any information to these external sites.

Your Right to Review and Correct Data

The accuracy of your information is vital for us to provide you with our products and services. Therefore, you are responsible for ensuring that all data you share with us is complete and correct.

In line with this, you have the right to review the information you have provided and, where feasible, correct or update any details that are inaccurate or incomplete. To do this, please follow the specific procedures established by Bharat Bank. You can learn more about this process by reaching out to us through the details found in the "How to Contact Us" section.

Please note that Bharat Bank is not responsible for verifying the authenticity of the information provided by you or anyone acting on your behalf.

Cookies and Similar Technologies

We may use cookies and other tracking technologies across our websites, mobile applications, and email communications. Cookies are small text files placed on your computer or mobile device that collect minor amounts of information when you interact with our digital platforms.

How to Contact us

You may contact us for privacy related matters at privacy@bharatbank.bank.in

Updates to the Privacy Policy

Our products, features, and digital functionalities are constantly evolving, and as a result, this Privacy Policy will be updated periodically. It is your responsibility to review the current policy whenever you visit our website, use our apps, or apply for and use any of our products.

While you are responsible for staying informed, we may also notify you of significant changes through various channels, such as in-app notifications, website banners, SMS, email, or social media. Any modifications to this policy become effective immediately upon being posted on our platforms. By continuing to use our website, apps, or any of our services after these changes are published, you are providing your automatic acceptance of the updated Privacy Policy.

Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India. Any disputes arising from or related to this policy will be subject to the exclusive jurisdiction of the courts and tribunals in Mumbai, India.