Privacy policy.
What personal data KGT Solutions handles for Koshtaq, why, how long we keep it, who we share it with, and the rights you have under the DPDP Act.
1.Who we are
Koshtaq is lender allocation software for NBFCs and HFCs, made by Kujata Global Technologies Private Limited, trading as KGT Solutions, a company registered in India (CIN U72100AP2020PTC116611) (“KGT”, “we”, “us”).
This policy explains what personal data we handle through the Koshtaq website and our sales and support work, why, how long we keep it, who we share it with, and what rights you have. We have tried to keep it short and in plain words. If anything is unclear, write to us at connect@kgt.solutions.
2.Two different roles we play
This matters, so we explain it first.
When an NBFC or HFC uses Koshtaq
Koshtaq is installed on the organisation's own servers. The loan, borrower and lender data in it stays there, and the organisation is the Data Fiduciary for it under the DPDP Act. Koshtaq sends nothing to us on its own, so in normal use we do not receive that data. When the organisation lets our team into its system for a support session, or shares a sample of its data for a trial run, we act as its Data Processor: only on its instructions and under our written agreement with it.
When you deal with us directly
When you visit this website, fill in the demo form, write to us or call us, we decide how that information is used. For that information, we are the Data Fiduciary.
If you are a borrower and have a question about how your lender uses your data, please ask your lender. If you write to us instead, we will pass your request on and help where we can.
3.What we collect
Information you give us directly
- Demo form: your name, work email, phone number, company and role, what you would like to see, and the ranges you choose for your number of lenders and loan accounts.
- Messages, emails, calls and support requests.
Information collected automatically
- Server logs kept by our website host: IP address, browser type, the page requested, and the date and time. We use them for security and to fix problems.
- The page you first arrived on and the campaign tag in the link (UTM source), if there is one. The demo form remembers these for the length of your browser session and sends them with your request. See section 10.
Information inside Koshtaq
Loan, borrower and lender data in Koshtaq stays on the customer's servers. We only see it during a support session the customer grants, or in a sample the customer shares with us under a written agreement (section 2).
What we do not collect
The website does not ask for loan data, borrower details, or card, bank account or UPI details. Please do not send borrower data through the demo form or by email.
4.Why we use it
Replying to demo requests and arranging demos
Whose data
People who fill in the demo form
Our basis under the DPDP Act
Consent, given when you submit the form
Following up about Koshtaq
Whose data
People who ask us about Koshtaq
Our basis under the DPDP Act
Consent, which you can withdraw at any time
Setting up, training and supporting customers
Whose data
Customer staff who work with us
Our basis under the DPDP Act
Consent, and to provide the service your organisation signed up for
Support sessions and trial runs on a customer's data
Whose data
Data in the customer's Koshtaq system, or a sample it shares
Our basis under the DPDP Act
On the customer's instructions, as its Data Processor. The customer is responsible for having a valid basis, such as consent or a legitimate use.
Security, fraud prevention and server logs
Whose data
Website visitors
Our basis under the DPDP Act
Legitimate uses permitted by law, and legal obligations
Meeting legal duties and responding to lawful requests from authorities
Whose data
As required
Our basis under the DPDP Act
Legal obligation
We never sell personal data. We never rent it, and we never use borrower data for marketing. Customers pay us for software. Their data is not our product.
5.Who can see what inside Koshtaq
The customer decides who sees what. Koshtaq has three roles:
- Treasury uploads the loan book, runs the month, reviews exceptions and downloads lender files.
- Viewer has read-only access to runs, snapshots and the audit log, for compliance, internal audit and statutory auditors.
- Admin sets up lenders, rule groups and users.
Every login is recorded in the audit log, including any support session the customer gives our team.
7.Where your data is stored
Loan, borrower and lender data in Koshtaq is stored on the customer's own servers, wherever the customer runs them.
Website and demo-request data is held by our service providers (section 6). Some of them may store or process data outside India. We only transfer personal data outside India where the DPDP Act and any government notification allow it.
8.How long we keep it
| Data | How long |
|---|---|
| Demo request details, if your organisation does not become a customer | 12 months from your last contact with us, then deleted |
| Contact details of customer staff | For as long as our agreement with your organisation runs, then as the law requires |
| Support messages | 24 months from the last message |
| Activity and security logs | At least one year, as required under the DPDP Rules, and no longer than 3 years |
| Sample data shared for a trial run | As set out in the written agreement for that run |
Once a purpose is complete and no law requires us to keep the data, we erase it. Where the DPDP Rules require it, we will tell a person at least 48 hours before erasing their data for inactivity.
9.How we protect it
- The website is served only over encrypted connections (HTTPS).
- Access to demo requests and customer contacts is limited to the team members who need it.
- Support access to a customer's Koshtaq system is granted by the customer, one session at a time, and recorded in its audit log.
- Our team members who handle personal data are bound by confidentiality.
- We regularly review our security safeguards.
No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and the people affected, without delay and within the timelines set by the DPDP Rules. Where we act as a customer's Data Processor, we will inform the customer and help it inform the people affected.
11.When a customer stops using Koshtaq
- Koshtaq runs on the customer's own servers, so its data is already with the customer. There is nothing to export from us.
- If we hold any of the customer's data, such as a sample shared for a trial run, we delete or return it as our agreement with the customer sets out, apart from anything the law requires us to keep.
12.Your rights
Under the DPDP Act you have the right to:
- Get a summary of the personal data being processed about you and how it is being used.
- Correct, complete or update your personal data.
- Have your personal data erased when it is no longer needed, unless the law requires it to be kept.
- Withdraw consent where processing is based on consent. Withdrawing is as easy as giving it. It does not affect processing already done.
- Nominate someone to exercise your rights if you die or become unable to do so.
- Raise a grievance with us and, if you are not satisfied, complain to the Data Protection Board of India.
How to use these rights. For data in a customer's Koshtaq system, ask that organisation, or write to us and we will help. For data we hold as Data Fiduciary, write to connect@kgt.solutions. We may need to confirm your identity first. We will respond within 30 days and no later than the time limits set by the DPDP Rules.
13.Children
The Koshtaq website and software are meant for businesses and their staff. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us their details, write to us and we will delete them.
14.Grievance Officer and data contact
If you have a question, a complaint or a request about your personal data, contact:
Grievance Officer
Kujata Global Technologies Private Limited (KGT Solutions)
We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
15.Changes to this policy
If we make an important change, we will update the date at the top of this page and tell customers by email before it takes effect. Earlier versions are available on request.
Where loan data lives
Koshtaq runs on your servers and sends nothing to KGT on its own. The security page shows how data flows, who can see what, and how support works.
Security and deployment