Privacy policy — Mintifi Global

Regulatory status (read this first)

Mintifi Global Finance (IFSC) Private Limited is registered with the International Financial Services Centres Authority (IFSCA), authorised to conduct factoring and forfaiting of receivables from GIFT City IFSC.

1. Who we are

Mintifi Global Finance (IFSC) Private Limited (“Mintifi Global”, “we”, “us”) is a company domiciled in GIFT City IFSC, carrying on export factoring and forfaiting services for Indian exporters against overseas buyers, functioning in USD.

This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights available to you under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

2. Scope

This policy covers two distinct sets of data principals and is written to address both, because the two data sets involve different data, different purposes, and different obligations:

Website visitors who submit the lead/contact form on this website.
Onboarded exporters (and their authorised representatives) who become customers after Know-Your-Customer (KYC) and onboarding.

3. What personal data we collect

3.1 Website visitors — the lead form

When you submit the enquiry/lead form on this website, we collect the details you enter: your name, work email address, phone number, your company name, your Importer-Exporter Code (IEC), your annual export turnover band, and your key destination markets — together with your consent to be contacted and the time you gave it.

We ask for the IEC because export factoring is available only to registered exporters. We record it as you enter it; at this stage we do not verify it against DGFT records.

We also record automatically the browser user-agent string your submission arrives with, and the form carries one hidden field that genuine visitors never complete — it exists solely to detect automated submissions. Apart from the details listed here and the campaign information described below, we collect no other personal data through this form.

When you arrive from an advertisement, we record the advertising click identifiers and campaign tags in the page address (for example Google’s gclid and Meta’s fbclid) and store them with your enquiry, so we can measure which campaigns lead to enquiries and tell the advertising platform when an enquiry becomes business.

3.2 Onboarded exporters

Once an exporter is onboarded as a customer, following KYC, we collect a broader data set necessary to assess and service an export factoring transaction. For exporter clients this includes: certificate of incorporation/registration, Memorandum & Articles of Association, PAN, GST registration certificate, Importer Exporter Code (IEC), audited financials, board resolution authorising the factoring arrangement, KYC of authorised signatories (Aadhaar/Passport + PAN), and a beneficial-ownership declaration. For the overseas buyer on each transaction we collect business registration details, registered address, sanctions-screening results, and country-of-incorporation FATF status. Invoice, shipment and bank account data specific to each transaction are collected alongside these.

4. Purpose and lawful basis

Lead form data is collected and used to assess your eligibility for export factoring services and to contact you about them.

Onboarded-exporter data is collected to perform underwriting, credit assessment, factoring transaction servicing, collections, and any associated insurance placement or disclosure to overseas buyers, banks, or credit insurers that is intrinsic to the transaction.

Legal basis: the DPDP Act’s “legitimate use” exceptions (Section 7) do not contain a clean, standalone “performance of contract” ground. Pending final Rules under the Act, our lawful basis for onboarded-exporter processing is explicit, purpose-specific, withdrawable consent taken at onboarding for each distinct processing purpose (underwriting, credit monitoring, collections, insurance placement, disclosure to overseas counterparties), read together with the necessity created by the customer contract. This basis is a standing review item, not a one-time determination — we will re-confirm it once the Digital Personal Data Protection Rules are finalised and notified, and update this policy if the basis changes.

5. Retention

We retain personal data for as long as necessary for the purpose it was collected, and no longer than the statutory retention period that applies to the record. Records are kept for the following periods: 5 years under the Prevention of Money-Laundering Act, 2002 (s.12(3) and (4)); 6 years under the IFSCA AML/KYC Guidelines, 2022; and 8 years under the Companies Act, 2013 (s.128(5)) for financial statements and transaction documents. We erase or anonymise data once the applicable retention period expires and no other legal obligation requires it to be kept.

6. Who we share your data with

Depending on the stage of your relationship with us, personal data may be shared with:

Overseas buyers who are counterparties to the export transaction being factored.
Confirming banks and correspondent financial institutions involved in the transaction.
Credit insurers and trade insurance providers.
Credit bureaus, where applicable to underwriting — the specific bureau(s) used, and whether a bureau check applies to every transaction, is being confirmed with the underwriting team and will be added here once settled.
Service providers who process data on our behalf (for example, IT infrastructure and document-verification providers), under contractual confidentiality obligations.
Regulators and authorities, where required by law.

We do not sell personal data.

7. Cross-border data transfer

This is a GIFT City IFSC unit financing India-origin exports against overseas buyers — meaning your data, and your counterparties’ data, will in the ordinary course be transferred to or accessed by entities located outside India, including overseas buyers, confirming banks, and trade insurers. The specific destination in any given transaction is the overseas buyer’s own jurisdiction — this varies deal by deal and is not a fixed, predetermined list of countries.

Under DPDP Act Section 16, the Central Government may notify countries to which transfer is restricted; as of the date of this policy, that notification has not been issued. Cross-border transfer is not expressly prohibited under the Act but is also not yet governed by a finalised permitted-country list. We disclose to you that:

Your personal data (and, where applicable, your counterparties’ data) will be transferred to or accessed by entities located outside India as an intrinsic part of the factoring service — specifically the categories of recipients listed in Section 6 above.
The Indian-person nexus of the DPDP Act applies to this processing regardless of Mintifi Global’s IFSC domicile: the Act applies to processing of personal data of persons located in India, and it applies to this entity’s collection and processing on that basis.
We treat the Central Government’s future permitted-country notification as a standing compliance obligation and will update this policy and, if required, implement additional transfer safeguards once it is issued.

8. Your rights as a data principal

Under the DPDP Act, you have the right to:

Withdraw consent at any time, as easily as it was given.
Access the personal data we hold about you.
Correction and erasure of your personal data.
Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
Grievance redressal — see Section 9 below and our Grievance Redressal Policy.

9. How to exercise your rights / contact us

To exercise any of the above rights, or to raise a question about this policy, contact our appointed Grievance Officer at hello@mintifiglobal.com.

For the full grievance mechanism, including complaint content requirements, response timelines, and escalation, see our Grievance Redressal Policy.

10. Changes to this policy

We may update this policy from time to time, including to reflect changes in applicable regulation, and to reflect finalisation of the DPDP Rules referenced in Sections 4, 5, and 7. The “Last updated” date at the top of this page will change accordingly.