• Identity & contact information
  • Name, address, signatures, biometric data, date of birth, copies of identity cards (ID), contact details including email id and phone number, address, previous names, maiden names, marital status, relatives information, nomination, medical condition, domicile, origin, citizenship, nationality, residence, any legal or other identifiers like Permanent Account Number (PAN)/ Taxpayer Identification Number (TIN)/ Aadhaar/ National ID/ Social Security Number/ or its equivalent, Photograph and Gender.
  • Data that identifies (whether directly or indirectly) a particular individual, such as information you provide on any forms, surveys, online applications or similar online fields.
  • Demographic information that you provide and aggregated or de-identified Data.

• Financial details/circumstances
  • Bank account details, investments history, credit/debit card details, prepaid payment instrument details, any other instrument/ modality/ function details, UPI handles, income details, history in relation to these.
  • Employment / occupational information.
  • Residential status under banking, general and tax laws.
  • Spending/saving/investing/payments/receipts/borrowing history.
  • Risk profile, financial objectives, financial knowledge and experience, preferences and any other information to assess the suitability of the Products to you.
  • Information collected when you make or receive payments.
  • Other information such as information relating to occupation and financial situation such as employer’s name and address, if self-employed, type of account, and nature and volume of anticipated business dealings, with the conventional bank licensee, income proof, bank statements, income tax returns, salary slip, contract of employment, passbook, expenditure, assets and liabilities, source of wealth and signature.
  • Data that is collected when you make financial and non-financial transactions. Data may include information associated with the transaction such as amount sent or requested, amount paid for Products or merchant information, including information about any funding instruments used to complete the transaction.

• Information you provide about others or others provide about you
  • If you give information or data about someone else (for example, information or data about a spouse or financial associate provided during the course of a joint application with that person), or someone gives information about you, may be added to any Data that is already held about you and can be used in the ways described in this Privacy Policy.
  • Your Data from third party providers: In order to enhance our ability to provide relevant marketing, offers, and services to you, Data about you is obtained from other sources with your consent, such as email service providers, public databases, joint marketing partners, social media platforms, as well as from other third parties as appropriate.
  • Information including Data from credit information companies/ credit reference agencies, risk management and fraud prevention agencies, national and government databases.
  • Information including Data from other parties and entities where we are a part of a transaction in one or more roles even though we may not be directly interfacing you, for example during the course of remittances being initiated by you through your bank to a beneficiary whose bank account is with us.
  • Data of authorised signatories or authorised persons or representatives of non-individual applicants/ customers/ users of any services, whether direct or indirect.

• Information from online activities.
  • Information about your internet activity is collected using technology known as cookies, which can often be controlled through internet browsers. For detailed information on the cookies used and the purposes for which they are used, see our Cookie Policy, which is available on our website.
  • Your digital and electronic devices where various checks are performed are designed to ascertain and verify your residency to ensure we meet our regulatory obligations. These checks include identifying and collecting your location (with your specific permission) and the IP address your device connects from and the collection of information about your use of the website or mobile app (including device type, operating system, screen resolution, and the way you interact with us). 
  • Information about your Internet browser, IP address, information collected through tracking technologies.
  • Unique device identifier such as International Mobile Equipment Identity (IMEI) number, technical usage data, contact lists (in some cases where specific permission is obtained), technical data about your computer and mobile device including details regarding applications and usage details.
  • Information such as your fingerprint, etc. that you choose to provide to us. We will not collect your biometric information without your explicit consent.
  • Generation and storing password or PIN in encrypted form.

• Other personal information
  • Information in relation to data access, correction, restriction, deletion, porting requests and complaints.
  • CCTV images and Data at our Bank branches, offices and ATMs (but only for security reasons and to help prevent fraud or crime).
  • Conversations during meetings/calls/correspondences/discussions with bank staff.
  • Social relationships detail such as your father’s name, spouse’s name and mother’s name;
  • Behavioural details as to how to utilise our Products, offers etc., your browsing actions, patterns and online activity;
  • Records of correspondence and other communications with you, including email, telephone conversations, live chat, instant messages and social media communications containing information concerning your grievances, complaints and dispute.
  • Any other information, Data or records which you may consent to be collected or used.
    ​​​​​​​
    

Out of the aforesaid data points, the following are ‘sensitive personal data or information’:

1. password
2. financial information such as Bank Account or Credit Card or Debit Card or other payment instrument details;
3. physical, physiological and mental health condition;
4. sexual orientation;
5. medical records and history;
6. biometric information; and
7. any detail relating to the above clauses as provided by you.

• When you submit the Data to us including when you ask for certain Products.
• When you use the Products.
• During the course of transactions.
• When you apply for the Products, make enquiries or engage with us or with any other person where we are involved for any other person in the transaction concerning you.
• Data collected during credit assessment, risk assessment, fraud checks, fraud detections, processes undertaken for fraud prevention, detecting malpractices or discrepant documents or information, prevention of misuse, assessment of credit worthiness, evaluation of financial standing, due diligence, background check, physical and other inspections, verifications, KYC/ Anti Money Laundering (AML) checks, monitoring, collections, recovery, customer service etc.
• When you use our website and online services provided by us (including mobile applications) and visit our branches or offices.
• When you email or call or respond to our emails/phone calls or during meetings with our bank staff or its service providers or representatives.
• When you or others give the Data verbally or in writing. This Data may be on application forms, in records of your transactions or if you make a complaint.
• From information publicly available about you. When you make Data about yourself publicly available on your social media accounts or where you choose to make the Data available through your social media account, and where it is appropriate to be used.
• During or as a result of Derivation, from any person possessing the same or sourcing any Data therefor.
• From any persons involved in any payment system or infrastructure or architecture of which HDFC Bank is a part including National Automated Clearing House (NACH), UPI, Electronic Clearing Service (ECS), ATM portability, Immediate Payment Service (IMPS), Real Time Gross Settlement (RTGS), National Electronic Fund Transfer (NEFT) etc., or from any persons (including TPAP) to whom the Bank acts as a service provider, distributor, agent, referral entity, promoter, marketer, sponsor bank, PSP bank, trustee, etc., where you are part of any payment or withdrawal or transaction or purchase/ sale/ distribution of any Product, whether as payee, payer, beneficiary, intermediary, distributor etc. and whether your interface/ interaction is directly with us or not or with any such other person or any platform/app.
• Data collected through cookies.

The processing of the Data may be done by us or any of the Processing Entities for any of the following purposes, and you agree and consent to the same:

• To provide you with Products.
• To manage relationships with you.
• For enabling your use of Products.
• For processing or executing transactions.
• For enabling any applications/ requests for any Products, for processing any such applications/ requests, for performing any contract pursuant thereto and for undertaking any Specified Purposes in relation to any of the above.
• To perform activities such as data analysis, audits, usage trends to determine the effectiveness of our campaigns and as input into improving Products.
• For credit scoring, credit analysis, risk analysis, obtaining any reports, credit scores, credit information, scrubs, for assessing and undertaking/ evaluating financial standing, fraud check, fraud probability, reference checks, due diligence, inspections, etc. including from or through any credit information companies, bureaus, fintech entities or service providers.
• For enabling use of our website, platforms, and online services (including mobile or web applications) and visiting our branches or offices.
• To contact you or to establish contact with you or your whereabouts.
• To allow you to utilize features on platforms/ apps by granting us access to Data from your device.
• For security, business continuity and risk management.
• For system or product development and planning, audit and administrative purposes.
• To personalize your platform/ app experience.
• To improve customer/ user experience.
• To inform you about important information regarding our Products, changes to terms, conditions, and policies and/or other administrative information; Where processing is necessary for the performance of a contract to which you are a party or in order to take steps prior to entering into a contract. To take actions that are necessary in order to provide you with the Products (performance of a contract), for example, to make and receive payments.
• Where processing is necessary because of a legal or regulatory obligation that applies to us.
• Where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. Processing may be required to meet our legitimate interests, for example, to understand the customer behaviour, customer expectations, to build analytical models, or to understand how customers use or respond to the Products, or to develop new Products, as well as improve the Products we currently provide. This may also include sharing of your Data either as part of a sample or specifically or generally with any potential or actual service provider or consultant or vendor or third party or Processing Entity, for the purposes of testing of proof of concept, where the utility, workability, efficacy, authenticity of any solution or service proposed or being rendered by any such person may be tested, and any such person may process such Data along with any other data it may have or source externally, for the purpose of running or pilot running or testing of the proposed solution or service and to submit the results to us along with the Data and any other data which such person may have or source. You agree that such sharing of Data and processing thereof and testing of proof of concept is in our legitimate interest to improve our efficiency, customer service, product delivery, to prevent frauds, etc. and ultimately is a necessary part of developing the ecosystem where customers and potential customers including you, benefit. 
• Where processing is necessary to protect your interests where we need to process your Data and you are not capable of providing consent (emergency situations).
• Subject to a specific consent (obtained separately from this Privacy Policy), to allow you to participate in surveys and other forms of market research, contests and similar promotions and to administer these activities. Some of these activities have additional rules, which may contain additional information about how Data is used and shared.
• To allow you to apply for Products (e.g., to prequalify for a loan, apply for a credit card, or to open an account, investment account, insurance or other financial product) including to pre-populate any Data during any application whether directly by us or through any service provider on any platform.
• Subject to your specific consent in this regard, to sell, cross-sell, distribute or refer to you any Products (by us or through any of the Processing Entities) and for such purpose we may assess your credit worthiness or your eligibility through such means as feasible and for such activity we may also share the Data with/ receive from third parties.
• Where we have your consent to do so.
• We may also contact you or send you messages, notifications or alerts by post, telephone, text, email, through social media, POS machines and other digital methods, including for example via our ATMs, mobile applications, push notifications, or online banking services (and new methods that may become available in the future).
• For any purposes which are incidental or necessary to any of the aforesaid purposes.  

We may share the Data with the following persons and/or in the following circumstances:

• With subsidiaries and/or affiliates in an effort to bring you improved services across our family of Products, when permissible under relevant laws and regulations or with consent.
• With service providers, vendors, agents etc. who perform services for us or assist us/ our subsidiaries/ affiliates to operate the business or provide the Products or services (own or where we/ our subsidiaries/ affiliates distribute, refer or act as agent etc.), intermediaries or consultants.
• Entities or persons with whom we have tie-ups for the co-branded services, products or programs, any rewards programs or loyalty programs, any benefits, offers, features or any similar arrangements.
• With co-lenders, co-originators, collaborators, and persons with whom the Bank may have a tie-up for any Products.
• Other third parties to comply with legal requirements such as the demands of applicable warrants, court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.
• We may share your Data, without obtaining your consent or without intimating you: (a) with governmental, statutory, regulatory, executive, law-enforcement, investigating or judicial/ quasi-judicial authorities, departments, instrumentalities, agencies, institutions, boards, commissions, courts, tribunals, who ask for such Data including by way of an order, direction, etc; or (b) with any person, where disclosure is necessary for compliance of any legal or regulatory obligation. Wherever the Data is shared as above, we will not have  control over how such Data is further processed by such authorities, persons, etc. (both under ‘a’ and ‘b’ above).
• Credit information companies, bureaus, fintech entities or service providers for the purposes of obtaining any reports, credit scores, credit information, scrubs, financial standing, fraud check, fraud probability, reference checks, due diligence, inspections, risk analysis etc.
• With any persons involved in Derivation.
• With any persons involved in any payment system or infrastructure or architecture of which HDFC Bank is a part including NACH, UPI, ECS, ATM portability, IMPS, RTGS, NEFT etc. or with any persons (including TPAP) to whom the Bank acts as a service provider, distributor, agent, referral entity, promoter, marketer, sponsor bank, PSP bank, trustee, etc. where you are part of any payment or withdrawal or transaction or purchase/ sale/ distribution of any Product, whether as payee, payer, beneficiary, intermediary, distributor etc. and whether your interface/ interaction is directly with us or not or with any such other person or any platform/app.

• Identity & contact information
  • Name, address, signatures, biometric data, date of birth, copies of identity cards (“ID”), contact details marital status, relatives information, nomination, medical condition, PAN/TIN/Aadhaar/National ID/Social Security Number/ or its equivalent, Photograph, Gender

• Financial details/circumstances
  • Bank account details, investments history, credit/debit card details, income details, history in relation to these.
  • Employment / occupational information.
  • Residential status under banking, general and tax laws.
  • Spending/saving/investing/payments/receipts/borrowing history.
  • Risk profile, financial objectives, financial knowledge and experience, preferences and any other information to assess the suitability of our products to you.
  • Information collected when you make or receive payments.

• Information you provide us about others or others provide us about you
  • If you give us information including personal data about someone else (for example, information about a spouse or financial associate provided during the course of a joint application with that person), or someone gives us information about you, we may add it to any personal data we already hold and we will use it in the ways described in this Data Privacy Notice.
  • Your personal data from third party providers: In order to enhance our ability to provide relevant marketing, offers, and services to you, we obtain personal data about you from other sources with your consent, such as email service providers, public databases, joint marketing partners, social media platforms, as well as from other third parties as appropriate.
  • Information including personal data from credit information companies/ credit reference agencies, risk management and fraud prevention agencies, national and government databases.
  • Information including personal data from other parties and entities where we are a part of a transaction in one or more roles even though we may not be directly interfacing you, for example during the course of remittances being initiated by you through your bank to a beneficiary whose bank account is with us.

• Personal data which you have consented to us using
  • Your agreement to allow us to contact you through certain channels to offer you relevant products and services.

• Information from online activities.
  • We collect information about your internet activity using technology known as cookies, which can often be controlled through internet browsers. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy, which is available on our website.
  • Your digital and electronic devices where we perform various checks designed to ascertain and verify your residency to ensure we meet our regulatory obligations. These checks include identifying the IP address your device connects from and the collection of information about your use of the website or mobile app (including device type, operating system, screen resolution, and the way you interact with us). 

• Other personal information
  • Information in relation to data access, correction, restriction, deletion, porting requests and complaints.
  • CCTV images and data at our Bank branches, offices and ATMs (but only for security reasons and to help prevent fraud or crime).
  • Conversations during meetings/calls/correspondences/discussions with bank staff.

When and how we collect personal data about you?

The table below sets out the purposes for which we use your personal data and our legal basis for doing so. Where we are relying on a legitimate interest, these are also set out below

• • When you ask us to provide you with certain products and services.
  • When you use our services or products;
  • During the course of transactions;
  • When you apply for products, make enquiries or engage with us or with any other person where we are involved for any other person in the transaction concerning you
  • When you use our website and online services provided by us (including mobile applications) and visit our branches, offices.
  • When you email or call or respond to our emails/phone calls or during meetings with our bank staff or its service providers or representatives.
  • When you or others give us personal data verbally or in writing. This personal data may be on application forms, in records of your transactions with us or if you make a complaint.
  • From information publicly available about you. When you make information including personal data about yourself publicly available on your social media accounts or where you choose to make information available to us through your social media account, and where it is appropriate for us to use it
  • Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. To allow us to take actions that are necessary in order to provide you with the product / service (performance of a contract), for example, to make and receive payments
  • Processing is necessary because of a legal obligation that applies to us. It may be necessary to allow us to comply with our legal obligations, for example, obtaining proof of identity to enable us to meet our anti-money laundering obligations under applicable law.
  • Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. Processing may be required to meet our legitimate interests, for example, to understand how customers use our services and to develop new services, as well as improve the service we currently provide.
  • Where we have your consent to do so.
  • Its processing is necessary to protect your “vital interests” where we need to process your personal data and you are not capable of providing consent (emergency situations).

When we process personal data to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and before collecting, we ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

We will send you messages by post, telephone, text, email and other digital methods, including for example via our ATMs, mobile applications, push notifications, or online banking services (and new methods that may become available in the future). These messages may be:

Recipients: Who we share your personal data with:
​​​​​​​

We only share your personal data with the following persons and/or in the following circumstances,and only as may be necessary:

• Your authorised representatives
• Third parties we need to share your personal data with in order to facilitate payments you have requested (for example, SWIFT, credit card issuers and merchant banks) and those you ask us to share your personal data with.
• We may also share your personal data with the following third parties to help us manage our business for our legitimate interests:  
  • Statutory and regulatory bodies and authorities (including central and local government) and law enforcement authorities, investigating agencies and entities or persons, to whom or before whom it is mandatory to disclose the personal data as per the applicable law, courts, judicial and quasi-judicial authorities and tribunals, arbitrators and arbitration tribunals.
  • Overseas regulators and authorities in connection with their duties (such as crime prevention).
  • Third parties bank may engage to provide services to you.
  • Processors and service providers of HDFC Bank engaged for its various activities and services.
  • Credit information companies or Credit reference entities, identity and address verification organizations who may record and use your information and disclose it to other lenders, financial services organizations and insurers. Your information may be used by those third parties to make assessments in relation to your creditworthiness for debt tracing
  • Other banks and financial institutions, quasi governmental institutions like clearing houses, network associations etc where required in terms of contract or legal requirements
  • Transferees and assignees and potential transferees and assignees of HDFC Bank
  • Courier or postal service providers for the purpose of sending or collecting of mails to you as a customer
  • Any other person or organization after a restructure, sale or acquisition, as long as that person uses your information for the same purposes as it was originally given to us or used by us (or both)
  • HDFC Bank’s branches in India or outside India, its subsidiaries, Affiliates and group entities.​​​​​​​

    For further information, please refer to our product specific terms and conditions and application form.

You have the following rights, in accordance with and subject to the qualifications and provisions under GDPR:

Date of most recent update: 1^st July 2022.

PLEASE READ THIS POLICY CAREFULLY BEFORE USING OUR WEBSITES

This policy explains how cookies are used on our websites.

This policy may be amended from time to time and the latest policy will be posted on this page.

By using our websites, you agree that we can place cookies on your device. Please be aware that some of our services will not function if your browser or device does not accept our cookies.

Please note that where we have another type of presence on a site owned by a third party, such as a page or handle on a social media site, that third party’s privacy policy and terms of use, rather than this Policy, will govern, unless specifically stated otherwise.

What are cookies?

Cookies are text files containing small amounts of information, which your computer or mobile device downloads when you visit a website. When you return to websites — or visit other websites that use the same cookies — they recognise these cookies and therefore your browsing device.

Cookies do lots of different jobs, like helping us understand how this website is being used, letting you navigate between pages efficiently, remembering your preferences, and generally improving your browsing experience. Cookies can also help ensure marketing you see online is more relevant to you and your interests.

You can learn about the cookies we use and how to manage them below.

What type of cookies Bank use?

The type of cookies used on most websites can generally be put into 1 of 4 categories: Strictly Necessary, Performance, Functionality and Targeting.

Strictly Necessary Cookies

These cookies are essential, as they enable you to move around the website and use its features, such as accessing secure areas. Without these cookies, services you've asked for can't be provided. These cookies don’t gather information about you that is used for marketing or remembering where you've been on the internet.

Performance Cookies

These cookies collect information about how you use a website, for example which pages you go to most often and if you get error messages from certain pages. These cookies don't gather information that identifies you. All information these cookies collect is anonymous and is only used to improve how a website works.

These cookies are not used to target you with online marketing. Without these cookies we can't learn how our website is performing and make relevant improvements that could better your browsing experience.

Functionality Cookies

These cookies allow a website to remember choices you make (such as your user name, language or the region you're in) and tailor the website to provide enhanced features and content for you.

Without these cookies, a website cannot remember choices you've previously made or personalise your browsing experience.

Targeting Cookies

These cookies are used to tailor marketing to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. They remember that you have visited a website and this information may be shared with other organisations such as advertisers. Although these cookies can track your visits to other websites, they don’t usually know who you are.

Without these cookies, online advertisements you encounter will be less relevant to you and your interests.

What happens if I disable cookies?

If cookies are disabled on your computer, tablet or mobile your experience on the website may be limited. For example, you may not be able to browse freely or use specific functions or features.

How do I disable/enable cookies?

To disable or enable cookies you will need to change some settings on your Internet browser.

We have provided step-by-step guides for the major desktop browsers below. 

For information on how to manage cookies on your tablet or mobile please consult your documentation or online help files.

Google Chrome

In the settings menu, select 'show advanced settings' at the bottom of the page

Select the 'content settings' button in the privacy section

In the page that appears tells you can manage and/or clear stored cookies.

Firefox

In the menu, select 'options'

Select the privacy tab in the options box

From the dropdown choose, 'use custom settings for history'. This will present the options for cookies and you can choose to enable or disable cookies.

Internet Explorer 6+

In the tools menu, select 'Internet options'

Click the privacy tab

You will see a privacy settings slider which has six settings that allow you to control the number of cookies that will be placed: Block All Cookies, High, Medium High, Medium (default level), Low, and Accept All Cookies.

Safari

In the settings menu, select the 'preferences' option

Open the privacy tab

Select the option you want from the 'block cookies' section

Any other browser

For information on how to manage cookies via other desktop browsers please consult your documentation or online help files.

What happens to cookies that have been downloaded in the past?

If you've disabled through your browser we may still use information collected from existing cookies, but we'll stop using the disabled cookies to gather any further information. For information on deleting stored cookies in your browser please visit the All About Cookies website.

SDKs Information We Collect and Services We Provide

If you use our apps (e.g. mobile application which integrates with Advertising services), we may use SDK’s to gather non PII information. At no point will these SDKs capture any personally identifiable information. We refer to the information we collect from our SDKs as the ‘SDKInformation .” The SDK Information includes (or may include) the following:

1.   Information Collected About End Users by Our SDKs

• Information about those visits on the websites where have implemented the SDK (e.g., session duration, time-stamp, referring URLs).
• End User’s interactions information with apps and websites. (Session data which includes - First Launches, Upgrades, Daily Engaged Users, Monthly Engaged Users, Launches, Crashes, Previous Session Length, Average Page Depth, Average Time Spent on Page, Average Time Spent on Site, Bounce rate, Bounces, Daily Return Visits, Entries, Exits, Instances, Lifetime, Mobile Views, New Engagements, Occurrences, Page Depth, Page Events, Page Views, Path Views, Reloads, Return Visits, Searches, Single Access, Time Spent, Unique Customer, Unique Visitors, Visitors, App Visits)
• IP address.
• Email address, if provided to us.
• End User’s browser and device information specifically (Browser language type; Operating system version (e.g., Android, iOS); Network provider; Language setting; time zone; browser Device height and width Pixel density; Screen height and width
• A unique identifier, Advertising ID, which may uniquely identify an End User anonymously.
• Location information ( Location information is only collected the user has granted permission to the App to collect this).
• Channel source of App download

As noted above, we refer to all of the above collectively as the “SDKInformation .”

2. How We Use the SDK Information

1. To operate and improve the app

• Enable you to use app feature
• Communicate with you about the app, including by sending announcements, updates and security alerts which we may send through a push notification, and responding to your questions and feedback
• Perform statistical analysis about use of the app
• Measure and analyze effectiveness of marketing campaigns

2. To send you marketing and promotional communication

• We may send you marketing communications as permitted by law.
• We might do the following analysis with aggregated data (no PII is stored or used at any given point in time)
• Customer Journey Analysis: Conversion funnels such as from Home Page to Product Page to Lead Form
• Traffic Analysis : Marketing channel categorized by visits, unique visitors, bounces etc.

3. How and Why We Share the SDK Information.

We share the SDK Information with service providers, to perform any of the activities set forth in Section 2. 
​​​​​​​

HDFC Bank does not share SDK information with third parties except those who process the data on behalf of HDFC Bank.