Privacy Policy

1. Information We Collect

Information you give us

• Mobile number (required): to create your account, sign in with an OTP, confirm account deletion, and contact you about your account.
• Name (required) and your preferred branch: to set up your account and link it to your Bhima customer record.
• Profile details (optional): date of birth, gender, and your nominee's name and relationship to you.
• Email address (optional): if your customer record has one, it is passed to Razorpay at checkout so it can send you a payment receipt. The app does not ask you to type an email address.
• Billing address (optional): building, area, city, state, PIN code and country. We ask for it only when it is needed for an invoice at checkout.
• Profile photo (optional): a photo you take or choose from your gallery.
• KYC documents (optional): photos or scans of an identity document (such as Aadhaar, PAN card, driving licence or voter ID). The app turns the scan into a PDF on your phone and uploads it to us, together with the document type. We use it only for identity verification (KYC) and legal compliance. You can use most of the app without KYC; some savings plans or transactions may require it.
• Messages to us: feedback or support messages, and the reason you give if you delete your account.
• Help searches: words you type into the FAQ search, used to find answers.

Information created when you use the app

• Savings plans: plans you join, instalments paid, balances and maturity dates.
• Purchases and payments: orders, payment amounts, dates, status and receipts.
• Payment details: if you pay online, you choose UPI, a bank, a wallet or a card. Card details are entered in Razorpay's secure screen and go directly to Razorpay. We receive the payment result, which may include the payment method, your UPI ID and the last four digits of a card. We do not receive or store full card numbers, CVV, UPI PIN or net-banking passwords.

Information collected automatically

• Device identifiers: a one-way scrambled (hashed) identifier made from your phone's Android ID and device details, an ID our server gives your device, a push notification token, and Firebase installation IDs.
• Device and app details: phone brand and model, operating system version, time zone, language and app version. Our servers also record the IP address and basic connection details of each request.
• App activity: the notification topics you turn on or off, your selected branch, and simple events such as turning on notifications, changing language or completing your profile. These events do not include your name, phone number or other personal details.
• Crash reports and performance data: see section 5.
• App security checks: when you register a device or request or enter an OTP, the Android app asks Google Play Integrity to confirm that the app is genuine and running on a real, unmodified device. This helps us stop fraud and fake accounts.
• Installed UPI apps: to offer UPI payment, Razorpay's payment component checks which UPI apps (for example Google Pay or PhonePe) are installed on your phone so it can show them as options. It does not look at your other apps.

2. What We Do Not Collect

• Location: the app does not use GPS or any location permission. You choose your branch from a list.
• Contacts, call logs and calendar: not accessed.
• SMS: the app does not read your SMS inbox. OTP auto-fill, where available, uses your phone's built-in feature that shares only the single OTP message.
• Files and photos: the app has no access to your phone's storage. It only receives a photo or document that you choose to take or pick.
• Microphone, audio and video: not accessed.
• Fingerprint or face data: if you turn on app lock, your fingerprint or face is checked by your phone. It never leaves your phone and we never receive it.
• Advertising ID: the app does not use it, contains no advertising, and does not track you across other apps or websites.

3. App Permissions

The app asks only for what it needs:

• Internet and network state: to load live gold rates, your account and payments.
• Notifications (you choose): for gold rate updates, offers, and payment and plan reminders. You can turn notification topics off in the app, or turn all notifications off in your phone's settings.
• Fingerprint / face unlock (optional): only if you turn on app lock.
• Camera and photos (only when you choose): when you take or pick a profile photo or scan a KYC document, using your phone's own camera, photo picker or document scanner.

The app does not request location, contacts, SMS, phone call or storage permissions.

4. How We Use Your Information

• To provide the app: create and manage your account, show your savings plans, take instalment and purchase payments, issue receipts and invoices, and show gold rates and offers for your branch.
• To communicate with you: send OTPs, payment and plan updates, replies to your messages and, if you have turned them on, notifications about gold rates and offers.
• For security and fraud prevention: confirm your identity, check that the app and device are genuine, and detect misuse.
• For legal compliance: KYC and anti-money-laundering checks, tax and accounting records, and lawful requests from authorities.
• To fix and improve the app: find and fix crashes, errors and slow screens (you can turn this off, see section 5).

We do not use your data for advertising, and we do not make automated decisions about you that have legal or similar effects.

5. Crash Reports and Performance Data

To find and fix problems, the app sends crash reports, error details and performance measurements (such as how long screens and network requests take) to Google Firebase Crashlytics and Firebase Performance Monitoring. These reports include your device model, operating system and app version, a scrambled (hashed) version of your user ID, and a short list of recent in-app events. Identifiers are removed from web addresses in performance data. The reports do not include your name, phone number, documents or payment details.

Your choice: this is on by default. You can turn it off at any time in Account → Data & privacy → Help improve the app. Once it is off, the app stops sending crash reports and performance data straight away.

Separately, if you tap Send error report in the app, the error log stored on your phone is sent to us so our team can investigate. This happens only when you choose to send it.

6. Who We Share It With

We do not sell your personal data, and we do not share it with other companies for their own marketing or other purposes. We use a small number of trusted service providers who process data only on our behalf and under our instructions:

Your account, savings plan and payment records are also kept in Bhima's own business (ERP) system, so our branches can serve you and keep your scheme and purchase records up to date. This is part of Bhima, not a third party.

We may also disclose data:

• to government, tax, law-enforcement or regulatory authorities when the law requires it;
• to protect the rights, property or safety of Bhima, our customers or the public, including to prevent fraud;
• to a buyer or successor if our business is merged or sold, who must continue to protect your data under this policy.

7. How We Protect Your Data

• All data between the app and our servers is encrypted in transit using HTTPS (TLS). Payment information is additionally encrypted.
• Sign-in uses a one-time password sent to your registered mobile number, and you can add a fingerprint or face app lock.
• Card and bank details are handled by Razorpay, a PCI DSS compliant payment gateway, not by our app or servers.
• Access to personal data within Bhima is limited to staff who need it for their work.

No system is completely secure, but we work to protect your data and will act promptly on any security issue.

8. Where Your Data Is Processed

Our own systems are operated by Bhima in India. Some service providers, such as Google and Cloudflare, may process data on servers outside India. They are bound by their own security and data protection commitments, and we share only what is needed for the service they provide.

9. How Long We Keep It

We keep your account data while your account is open. When you delete your account, we delete your profile and app data as described on our account deletion page, except for records the law requires us to keep:

• Transaction and payment records: 7 years, as required by Indian financial and tax regulations.
• Savings scheme and chit records: 7 years after the scheme closes, for legal and audit compliance.
• KYC / government ID records: for the period required by applicable KYC and anti-money-laundering regulations.
• Customer support records: up to 3 years, to resolve disputes.
• Crash reports and performance data: kept by Google Firebase for a limited period under its standard retention settings, then deleted automatically.

Retained records are used only for these legal purposes, are never used for marketing, and are deleted or anonymised when the period ends.

10. Your Rights and Choices

• See your data: view your profile, plans and payments in the app, or ask for a copy (using Download my data in Account → Data & privacy, where shown, or by writing to [email protected]).
• Correct your data: edit your profile and address in the app, or contact support to correct anything you cannot change yourself.
• Delete your data: delete your account in the app (Account → Delete account) or follow the steps at bhimadigital.in/account/delete. You can also ask us to delete specific data without closing your account.
• Marketing: turn off offer notifications in the app's notification settings or your phone's settings, or ask us to stop marketing messages. This withdraws your marketing consent.
• Diagnostics: turn off crash reports and performance data in Account → Data & privacy → Help improve the app.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect anything done before you withdrew it. Some features (such as payments) cannot work without the data they need.
• Complain: contact our Grievance Officer (section 14).

We will respond to your request within 30 days. We may need to confirm your identity first, for example with an OTP to your registered mobile number.

11. Children

The app is intended for adults (18 and over) and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

12. This Website

This website (bhimadigital.in) does not use advertising or analytics cookies. It remembers your chosen language in your own browser. Like any website, our servers and Cloudflare log basic request details (such as IP address and browser type) for security and to keep the site running.

13. Changes to This Policy

We may update this policy when the app or the law changes. We will post the new version on this page with a new "last updated" date, and tell you in the app if the changes are significant.

14. Grievance Officer

If you have a concern or complaint about how we handle your personal data, please contact our Grievance Officer:

• Grievance Officer, Bhima Gold & Diamonds
• Email: [email protected]
• Phone: +91-471-350-2032
• Address: Bhima Gold & Diamonds, Nandanam Towers, Regional Office, Kunnumpuram, Vanchiyoor, Thiruvananthapuram, Kerala 695001

We will acknowledge your complaint promptly and resolve it within one month.

15. Contact Us

For questions about this policy or your data:

• Privacy: [email protected]
• Data Protection Officer: [email protected]
• Customer Support: [email protected]
• Phone: +91-471-350-2032
• Address: Bhima Gold & Diamonds, Nandanam Towers, Regional Office, Kunnumpuram, Vanchiyoor, Thiruvananthapuram, Kerala 695001

This policy is governed by the laws of India, including the Information Technology Act, 2000 and the rules under it, and the Digital Personal Data Protection Act, 2023 as it comes into effect. Disputes are subject to the jurisdiction of the courts in India.