Privacy Notice for Website Users

1. General Information

Sberbank India, a branch of the globally recognized Sberbank Group, is committed to safeguarding your Personal Data. We prioritize transparency, accountability, and security in every interaction involving your Personal Data. As a regulated financial institution operating in India, we adhere to the Digital Personal Data Protection Act, 2023 (DPDPA), RBI Master Directions, and other applicable Indian and global privacy regulations.

This Privacy Notice outlines our practices regarding the collection, use, disclosure, retention, and transfer of Personal Data obtained through our website, services, and interactions, both online and offline.

Sberbank Branch in India, New Delhi (hereinafter referred to as “Sberbank India” or “we”) is committed to the protection of your Personal Data. The protection of your Personal Data is of a great importance for us; therefore, we handle your Personal Data responsibly, in a data protection-compliant manner and in accordance with high standards of Personal Data processing and protection.

In this Privacy Notice, we explain how, as Data Fiduciary, we collect, process and use Personal Data of our individual clients and data of individuals associated with corporate clients (which include individuals and representatives contact details from corporate clients) about you as a https://sber.bank.in/ (the Website) user and a potential or current client of Sberbank India, and how you can exercise your rights.

2. Description of Personal data processing

We collect and process the Personal Data that you voluntarily provide us through the Website for purpose you have provided us with the data. Such purposes may include, but are not limited to providing you with our banking and related services; receiving your feedback and queries; contacting you upon your request; Website use analytics, etc. In certain cases, we may be obliged to process your Personal Data by legal and regulatory provisions. Insofar as we also use your Personal Data in a way that requires your consent in accordance with applicable laws, we will ask for your consent before we collect your data.

We also process the data collected during your usage of our Website through Cookies. By continuing to use this Website, you grant your consent to the processing of your Cookies. Cookies are a small fragment of data which a website requests from the browser used on your PC or mobile device. Cookies reflect your preferences or actions on the Website. Cookies are stored locally on your PC or mobile device. If you wish, you can delete the stored Cookies in the settings of your browser. Cookies (information about the user’s actions on the Website and about the user’s device, date and time of the session) are used by us to improve the functioning of the Website. You can decline the processing of cookies in your browser settings. In this case, our Website will only use those cookies that are strictly necessary for the functioning of the site and the services it offers.

Our website processes the obtained data, amongst others, by using metrics programs:

·  yandex.metrica

·  vk pixel

·  MyTarget

·  Adriver

·  DMPKit

·  SberAds

·  AdServing

The data we collect by using metrics programs is used for the Website use analytics purpose and include the following categories of data:

·  number of Website’s visits;

·  time spent using the Website;

·  your clicks and scrolls;

·  number of requests;

·  source of traffic;

·  your browser and operating system;

·  Web visor (screenshots);Age and gender

·  IP address

·  Device type

·  Browser information

·  Traffic source

·  Page visited

·  Time and date of visit

You can manage or disable cookies through your browser settings, though doing so may limit certain functionalities.

Please find the description of how we generally collect, process and use your data for the purpose of providing you with our banking and related services in the table below:

Table 1. Description of Personal data processing 

Kindly note, that we need the above-mentioned data for the negotiations and performance of any agreements with you or for the fulfillment of the legal obligations to which we may be subject to. If the Personal Data required for these purposes are not provided, we may not be able to fulfill our duties and/or in particular, the above purposes, and/or this would slow down the process considerably.

3. Children's Privacy

We do not knowingly collect Personal Data from children under the age of 18. If you believe that a child’s data has been inadvertently submitted through our platforms or during a banking relationship, you may contact our Data Protection Manager to request correction or deletion.

4. Third-Party Links Disclaimer

Our platforms may contain links to third-party websites for informational or convenience purposes. Sberbank India does not control or endorse these third-party websites, nor do we accept any responsibility for their content, privacy practices, or security measures. Users are encouraged to review the privacy policies of external sites before sharing any Personal Data with them.

5. Data Retention and Disposal

Sberbank India retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required under applicable laws and regulatory guidelines. The duration of retention depends on various factors including the type of product or service availed, the nature of the relationship, statutory obligations, legal hold requirements, and dispute resolution timelines.

Once the retention period expires or the data is no longer required, we ensure secure disposal through controlled processes such as digital wiping, and secure physical destruction (for paper records). Our disposal practices follow globally accepted data lifecycle management standards and are designed to eliminate any risk of unauthorized access, reuse, or reconstruction of data post-deletion.

6. Technical and Organizational Measures for Data Security

Sberbank India implements a multi-layered data protection strategy comprising both technical controls and organizational safeguards to ensure the security and confidentiality of Personal Data. Our systems are protected through advanced security architectures that include firewalls, intrusion

detection and prevention systems (IDPS), encryption (at rest and in transit), virtual private networks (VPNs), and access controls based on roles and responsibilities.

7. Data Sharing and Cross-Border Transfers

All the data sharing and cross-border transfers are conducted in compliance with the principles of data minimization, purpose limitation, and accountability, ensuring that your rights as a Data Principal remain protected irrespective of where your data is processed.

8. The Rights of Data Principals in relation to Personal Data processing and other related queries: 

As a Data Principal, your employees have the following rights about the processing of their Personal Data:

1.1.   Right to access information about Personal Data: you have the right to receive a confirmation from Sberbank India as to whether we are processing or have processed your Personal Data, and a brief summary of Personal Data which is being processed by Sberbank India and the processing activities undertaken by Sberbank India with respect to such Personal Data; the identities of all other Data fiduciaries and Data Processors with whom the Personal Data has been shared, along with a description of the Personal Data so shared; and any other information related to the Personal Data of such Data Principal and its processing, as may be prescribed.

1.2.   Right to correction and erasure: you have the right to the correction of your inaccurate or misleading Personal Data, the completion of incomplete Personal Data, updating of Personal Data that is out-of-date (e.g. where your Personal Data is put on a roaster list), the erasure of Personal Data which is no longer necessary for the purposes for which it was processed.

1.3.   Right of grievance redressal: you have the right to submit any grievances you might have to the Sberbank India’s Data Protection Manager (dpm_india@sberbank.ru) in respect of any act or omission of Sberbank India regarding the performance of its obligations in relation to your Personal Data or the exercise of your rights under the provisions of applicable laws.

1.4.   Right to withdraw consent to the processing: where the processing of your Personal Data is based on your explicit consent, you have the right to revoke such consent at any time. However, please note that such withdrawal may affect our ability to fulfill our duties and/or in particular, the above purposes, and/or this would slow down the process considerably.

1.5.   Right to nominate: you have the right to nominate any other individual, who shall, in the event of your death or incapacity, exercise your rights in accordance with the provisions of applicable laws.

Mechanism for the exercise of your Data Principal Rights

For all additional queries and/or for exercising any of the rights listed above or raising any grievances, Data principals shall make a request in writing with the necessary information as regards to their identity. For this purpose, they may reach us via contact details listed below:

Data Protection Manager Sberbank Branch in India

E-mail: dpm_india@sberbank.ru

Address: Upper Ground Floor & Fourth Floor,

Birla Tower, 25 Barakhamba Road, New Delhi, Delhi, 110001.

1. Changes to this Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in legal obligations, technology, or our internal practices. Any significant changes will be notified via our website and, where required, via direct communication.

By providing us with your Personal Data you acknowledge to have read this Privacy Notice and hereby provide explicit consent to process your data in accordance to this Notice. This Notice may be updated from time to time and you should review it before providing us with any new Personal Data.