Privacy & Data Protection Policy

Version privacy-notice-draft-2026-10 · Last updated 2 October 2026

1. Who we are

This policy applies to the website tiro.finance and the services of Tiro Global Finance (a brand of Pharosys LLP, LLPIN ADB-0181, registered office: A-202, Geetashree Apartment, Sai Mandir, Navghar, Bassein Road, Manikpur, Vasai (Bassein), Thane - 401202, Maharashtra, India) (“Tiro Global Finance”, “we”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data you give us. We help students explore education-loan options and prepare applications for our lending partners. We are not a bank or lender.

2. Personal data we collect

We do not ask for Aadhaar or PAN numbers, identity-document images, bank statements, passwords, OTPs or bank login details on our website. If a lender needs documents to assess your application, they are collected through that lender's own approved process.

3. How we use your data (purposes)

• Responding to your enquiry and contacting you on the channels you chose.
• Reviewing your profile and suggesting education-loan options that may suit you.
• Preparing and, only when you decide to proceed, sharing your application with your chosen lending partner.
• Keeping you updated on your case and responding to questions, complaints and data requests.
• Keeping our service secure, preventing fraud and meeting our legal obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Legal basis - your consent

We process your personal data on the basis of your consent, which you give when you submit the enquiry form and agree to our Terms of Use and this policy, and for certain legitimate uses permitted by section 7 of the DPDP Act (for example, complying with law). You can withdraw your consent at any time, as easily as you gave it - see section 8. Withdrawal does not affect processing already carried out.

5. Who we share your data with

• Lending partners (our partner banks and NBFCs) - only the lender you choose, only when you decide to proceed, and only the information needed for your application. Your adviser will tell you the name of the lender before anything is shared, and you can ask us at any time who your data has been shared with.
• Service providers (Data Processors) who help us run the service under contract and only on our instructions: website hosting (Netlify), database hosting (Neon), and - when enabled - email and messaging providers.
• Authorities where required by law, court order or a lawful request.

6. Where your data is stored (cross-border transfer)

Our database is hosted on secure cloud infrastructure in Singapore, and our website is delivered through a global network. This means your data may be processed outside India. We transfer data only to countries not restricted by the Central Government under section 16 of the DPDP Act, and our providers are bound by contractual security obligations.

7. How long we keep your data

We keep personal data only for as long as needed for the purposes above, or as required by law. If you do not proceed with an application, we erase or anonymise your enquiry data after 24 months of inactivity, and we will tell you at least 48 hours before erasing it where the DPDP Rules require this. Security logs and records we must keep by law are retained for the minimum period the law requires (at least one year).

8. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how it is used, and the identities of those we have shared it with;
• Correct, complete or update inaccurate or incomplete data;
• Erase your data where it is no longer needed and we are not legally required to keep it;
• Withdraw consent at any time;
• Nominate another person to exercise your rights in the event of your death or incapacity; and
• Grievance redressal - to complain to us and, if unresolved, to the Data Protection Board of India.

To exercise any right, sign in and use Privacy & data requests, use our contact form(topic: “Privacy”), or email PRIVACY EMAIL (TIRO_PRIVACY_CONTACT). We may need to verify your identity. We respond within the period required by the DPDP Rules.

9. Children (under 18)

If you tell us you are under 18, we collect only your contact details and pause. We process a child's personal data only with the verifiable consent of a parent or lawful guardian, and we never track, behaviourally monitor or target advertising at children.

10. How we protect your data

• Encryption in transit (HTTPS) and encrypted cloud storage.
• Passwords stored only as secure one-way hashes; multi-factor authentication for staff.
• Role-based access - staff see only what their role requires - with an audit log of access to sensitive records.
• Minimum data collection, and contact details removed from system logs.

If a personal data breach occurs, we will inform the Data Protection Board of India and affected users as required by the DPDP Act and Rules, including what happened, the likely consequences and the steps we are taking.

11. Cookies

We use only essential cookies needed to keep you signed in and to protect forms. Optional analytics or marketing cookies are off unless you switch them on in Cookie & consent preferences.

12. Grievance Officer / contact

Grievance Officer: Rishiraj Makhija, Pharosys LLP
Email: GRIEVANCE EMAIL
Address: A-202, Geetashree Apartment, Sai Mandir, Navghar, Bassein Road, Manikpur, Vasai (Bassein), Thane - 401202, Maharashtra, India

If you are not satisfied with our response, you may complain to the Data Protection Board of India after first raising your grievance with us.

13. Changes to this policy

We will update the version and date above when this policy changes, and tell you about significant changes before they apply.