Privacy policy

1. Who are we

Forward Finance Private Limited (“Forward”, “the Company”, “we”, “us” or “our”) is a non-deposit-taking Investment and Credit Company (NBFC-ND-ICC) registered with the Reserve Bank of India (“RBI”) under Section 45-IA of the Reserve Bank of India Act, 1934, vide Certificate of Registration No. 0012/2026 and incorporated under the Companies Act, 2013.

We operate the website and digital platform at www.forward.in (“Platform”), through which we offer free portfolio analysis tools and secured lending products and services such as Loan Against Mutual Funds, Loan Against Shares and Loan Against Insurance Policies. Please note that we do not accept deposits from the public.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), Forward is the Data Fiduciary in respect of the personal data described in this Policy. “You” or “Data Principal” means the individual to whom that data relates.

This Policy explains what personal data we collect through the Platform, why we collect it, who we share it with, how long we keep it and the rights available to you. It applies to all use of the Platform. However, please note that with respect to any loan that we extend to you separately shall be governed by the Key Fact Statement, sanction letter and loan agreement issued to you.

2. Who is this policy applicable to

• Visitors: anyone who browses the Platform or uses our illustrative calculators.
• Portfolio Pulse users: anyone who uses our free portfolio analysis tool, which requires no account and no login.
• Applicants and borrowers: anyone who applies for or avails a loan from us.
• Partners: individuals at registered partner firms who apply to join or who access the Partner Portal.
• Enquirers: anyone who contacts us or asks to receive updates from us.

3. Information we collect

3.1 Website visitors and cookies

We use a single first-party cookie to count visits and understand which features are used. We do not use third-party trackers, advertising networks or interest-based advertising and we do not sell or share your data with advertisers. This cookie is set only if you accept it and you may decline it or change your choice at any time by withdrawing your consent to the same.

Our servers also record limited technical log data (such as IP address, browser and device type and timestamps) as necessary to operate and secure the Platform and to meet our legal obligations.

3.2 Illustrative calculators

Our calculators, including the tool that compares the cost of selling your investments against borrowing from us, work from figures you set using on-screen controls, such as portfolio value, the amount of cash you need and assumptions on returns, interest rate, tenor and tax. These figures are not personal data, are used only to generate the illustration shown on your screen and are not stored by us. The outputs are indicative and do not constitute an offer, a quote or financial, investment or tax advice.

3.3 Portfolio Pulse

Portfolio Pulse gives you a health check on your mutual fund or equity portfolio, free of charge, without an account and without logging in. It reports your portfolio value, a health score and measures of liquidity, diversification, volatility and returns, together with asset composition, sector breakdown, concentration alerts and an indicative view of what you might be eligible to borrow. These outputs are indicative only and do not constitute an offer of credit or a sanction.

You may provide your holdings in any of the following ways:

• Consolidated Account Statement (CAS): a CAS PDF downloaded from CAMS or KFintech for mutual funds or from NSDL or CDSL for demat holdings.
• Spreadsheet: an Excel or CSV file listing your scheme names or ISINs and units or your equity holdings.
• Manual entry: searching for and adding schemes with units or entering stock symbol, quantity and buy price.

Your CAS file is parsed locally in your browser. The file and its contents, including your name, PAN, folio and demat account numbers and holdings, are not transmitted to us and are not stored on our servers. Where your CAS PDF is password-protected, the password is used only within your browser to open the file; it is not transmitted to us and we do not store it. The same applies to spreadsheets you upload and to holdings you enter manually.

The resulting analysis is held on your own device and remains under your control; clearing your browser storage will delete it. If you choose to carry a saved analysis into a loan application, that data is transmitted to us at that point and only with your explicit consent.

If you choose to generate your CAS through MF Central, you do so on a website operated by a third party. We do not receive your data from MF Central and are not responsible for that website; its own terms and privacy policy will apply to your use of it. You return to our Platform only to upload the PDF you have downloaded.

3.4 Loan applications and borrowers

When you apply for a loan, we collect, with your consent and as necessary for the product:

• Contact and authentication data: your mobile number, which we verify by one-time password and which you use to log in to your loan dashboard and to resume an application in progress.
• Identity and KYC data: your name, date of birth, PAN, address, email and KYC records obtained through Aadhaar-based verification or other RBI-permitted KYC methods.
• Holdings and collateral data: for Loan Against Mutual Funds, your holdings fetched from CAMS or KFintech using your PAN and OTP authorisation; for Loan Against Shares, your demat account details and holdings fetched from CDSL or NSDL, which we match against our approved securities list to determine applicable loan-to-value and eligible value; and for Loan Against Insurance Policies, your policy number and policy details, which we use to assess surrender value. In each case we also record the pledge, lien or assignment created over the asset and its release.
• Purpose of the loan: the end-use you tell us the borrowing is for, where we are required or choose to record it.
• Financial and credit data: your bank account details for disbursement and repayment and your credit information obtained from Credit Information Companies with your consent.
• Agreement and servicing data: your electronic signature and executed loan documents and your repayment and servicing history.

We tell you at each stage what data we are collecting and why. You may decline consent for any specific category or decline sharing with any specific third party; where a data point is essential to the product, we will explain what declining means for your application before you decide.

Our Platform is accessed through a browser. We do not access your files, media, contact list, call logs, SMS messages or telephony functions. Where camera or location access is required for KYC, it is requested on a one-time basis with your explicit consent and used only for that purpose. We do not store biometric data except to the extent permitted by law.

3.5 Partner Portal

If you apply for your firm to become a registered partner, we collect your name, business email address and contact details, your firm's details and its regulatory registrations, so that we can assess and process the application.

If you are an individual at a registered partner firm, we collect your business email address, authentication credentials and records of your activity on the Partner Portal, including the clients you refer, the status of their applications and your commission entitlements. Where you submit information about a prospective client to us, you confirm that you have that person's consent to do so and we will process that information as Data Fiduciary in accordance with this Policy.

3.6 Enquiries and updates

If you contact us or ask to receive updates from us, we collect your email address and, if you choose to provide them, your name and phone number and use them to respond to you or to send you the updates you asked for. We do not send marketing communications on the basis of such a request beyond what you have asked for and you may unsubscribe or ask us to remove you at any time. Service communications relating to a loan you hold, such as repayment reminders and account notices, will continue regardless of any marketing opt-out.

4. How we use your information

• To provide the Portfolio Pulse analysis and the calculator illustrations you request;
• To verify your identity, complete KYC, assess your eligibility and creditworthiness, create and manage collateral, disburse and service your loan and provide customer support;
• To authenticate you and give you access to your loan dashboard;
• To assess partner applications and to operate the Partner Portal and administer referrals and commissions;
• To respond to your enquiries and send you updates you have asked for;
• To operate, secure, maintain and improve the Platform and to detect and prevent fraud; and
• To comply with applicable law and RBI directions and to respond to lawful requests from courts, regulators and authorities.

We do not use your data for automated profiling beyond the eligibility and credit assessment described above and we do not use it for any purpose beyond those stated here without obtaining your fresh consent.

5. Lawful basis

We process your personal data on the basis of your consent under Section 6 of the DPDP Act or, where applicable, for a legitimate use permitted under Section 7 of the DPDP Act, including compliance with law and the performance of legal obligations to which we are subject.

Where we rely on consent, we obtain it through a clear, standalone notice presented separately from our terms, in English and in such other languages as are prescribed. You may withdraw your consent at any time, with the same ease with which it was given, by writing to us or through the Platform. Withdrawal does not affect the lawfulness of processing carried out before it and may limit or prevent our ability to continue providing the relevant service - we will explain the specific consequences before you confirm.

6. Sharing and disclosure

We do not sell or rent your personal data. We share it only as set out below, on a need-to-know basis and under written confidentiality and security obligations:

• Registrars and transfer agents: CAMS and KFintech, to fetch your mutual fund holdings and to create or release liens over them.
• Depositories: NSDL and CDSL, to fetch your demat holdings and to create or release pledges over them.
• Insurers: to value your policy and record its assignment to us as collateral and its reassignment on closure.
• KYC, e-sign and verification providers: to complete identity verification and execute documents electronically.
• Banks and payment providers: to disburse your loan and collect repayments.
• Credit Information Companies: to obtain credit information and to report your credit facility, as required by law.
• Technology and infrastructure providers: which operates and hosts the Platform on our behalf and our cloud hosting provider.
• Partner firms: where you have been referred to us by a registered partner, we may confirm the status of your application to that partner to the extent necessary to administer the referral.
• Authorities: where required by law, regulation or a valid order or to establish, exercise or defend legal claims.

Any Lending Service Provider we engage acts as our agent under a written agreement and is permitted to store only the minimal basic data necessary for its role. We remain fully responsible to you for the privacy and security of your personal data, including where it is processed by a service provider on our behalf.

7. Where your data is stored

Personal data collected through the Platform is stored on servers located in India. Where any processing is carried out outside India, the data is brought back to India and deleted from the servers outside India within 24 hours of that processing, in accordance with RBI directions.

8. Retention and erasure

We erase personal data as soon as the purpose for which it was collected is no longer being served and retention is no longer required by law, including where you withdraw consent.

• Portfolio Pulse and calculators: nothing is retained by us, because the analysis is held on your device and calculator inputs are not stored.
• KYC and loan records: retained for the period prescribed under the Prevention of Money-Laundering Act, 2002 and the RBI's KYC and digital lending directions (generally five years from the end of the customer relationship or transaction) and thereafter erased.
• Incomplete applications: where you begin an application and do not complete it, erased after 90 days unless you ask us to erase it sooner.
• Partner Portal data: retained for the duration of the partner relationship and thereafter as required for settlement of commissions and statutory records.
• Enquiry and update data: erased once your enquiry is closed or you unsubscribe, unless you are or become a borrower.

Security and access logs are retained for one year, as required under the DPDP Rules. On expiry of the applicable period, data is securely and irreversibly deleted, including from backups, in accordance with our internal retention and disposal policy.

9. Security

We maintain reasonable security safeguards to protect your personal data, including encryption of data in transit and at rest, access controls on a need-to-know basis, authentication controls, logging and monitoring and contractual security obligations on our service providers. We comply with the cybersecurity standards specified by the RBI and other competent authorities.

If a personal data breach occurs, we will inform you and the Data Protection Board of India without delay and in any event within the timelines prescribed under the DPDP Rules, describing the nature of the breach, its likely consequences, the measures we are taking and what you can do to protect yourself. We will also report to the Indian Computer Emergency Response Team (CERT-In) and the RBI as required.

No method of transmission or storage is completely secure and while we take these measures seriously, we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you have the right to:

• obtain a summary of the personal data we hold about you and of how it is processed and the identities of the parties with whom it has been shared;
• have inaccurate, incomplete or outdated data corrected, completed or updated;
• have your personal data erased, unless we are required by law to retain it;
• withdraw your consent at any time;
• nominate another individual to exercise your rights in the event of your death or incapacity; and
• have your grievance heard and resolved through the mechanism in Section 12.

To exercise any of these rights, write to us using the details in Section 12. We may ask you to verify your identity before acting. We will respond within the timelines prescribed under applicable law.

11. Children

The Platform is not intended for anyone under 18 years of age and we do not knowingly process the personal data of children. If we become aware that we have done so, we will erase it.

12. Grievance redressal

You can also write to:

Forward Finance Private Limited
Technopolis Knowledge Park, Unit No. 14, Mahakali Caves Road, Hanuman Nagar, Andheri East, Mumbai, Maharashtra 400093

13. Changes to this policy

We may update this Policy from time to time. The current version will always be available on the Platform, with the Effective Date showing when it was last revised. Where a change is material, including any change to the purposes for which we process your data, we will notify you and, where required, obtain your fresh consent. This Policy is reviewed at least annually.