General > Privacy Policy

1. Introduction

We, Union Bank of India (hereinafter referred to as “the Bank” or “UBI”), are committed to protecting the privacy of the Bank’s customers’ data including Personal Data and have taken all necessary measures to safeguard it. Keeping information secure is one of the banks most important responsibilities.

The Bank maintains physical, electronic, and procedural safeguards to protect customers’ data including Personal Data. Access to such information is strictly limited to employees, authorized service providers, and other vendors for lawful purposes only. All employees and authorized service providers are bound by a code of ethics that mandates the confidential treatment of customer information, and any violation of this code is subject to disciplinary action.

The Bank shall not be held liable for disclosure of confidential information when such disclosure is:

• In accordance with this Privacy Policy (or Policy),
• As per agreements with customers, or
• In compliance with applicable laws or directives from competent authorities.

The Bank recognizes and upholds the responsibility to maintain the confidentiality of all information entrusted to us by our customers.

Scope of this Privacy Policy

• This Privacy Policy (“document”) applies when the services of the Bank are availed either directly or through merchant partners for any financial or non-financial transaction with the Bank.
• This Notice is framed to outline the Bank’s broader commitment to maintaining high standards of privacy and responsible data handling. It sets forth the privacy practices followed by the Bank and the manner in which the Bank collects, uses, discloses, stores, secures, and disposes of Information/Data including your Personal Data and Sensitive Personal Data, whether processed in physical or electronic form. Further, this Notice also reflects the Bank’s approach to meeting its obligations under applicable laws, including the Digital Personal Data Protection Act, 2023.Throughout this document, the terms “we”, “us”, “our” & “ours” refer to UBI, and the terms “you”, “your” & “yours” refer to the individual whose data including Personal Data is being processed.

Definitions

Application: The Bank’s mobile application or any other application through which the Bank’s services can be availed electronically.

Personal Data: Any information relating to an individual that can identify such person directly or indirectly, in combination with other information available or likely to be available with the Bank.

Sensitive Personal Data: It is a subset of Personal Data. Wherever Sensitive Personal Data is not mentioned separately, it is deemed included under Personal Data.

Sensitive Personal Data or Information includes:

1. Financial information such as bank account, credit/debit card details, or other payment instrument details
2. Physical, physiological, and mental health condition
3. Medical records and history
4. Biometric information
5. Password
6. Any information received under the above clauses for processing, stored or processed under lawful contract or otherwise
7. Any other information which may fall under the ambit of Sensitive Personal Data (as defined by the Bank from time to time).

Website: A collection of publicly accessible, interlinked web pages of the Bank under a single domain name, created and maintained for various purposes.

2. Applicability

This is applicable Data and/or Information including Personal Data and Sensitive Personal Data collected and processed by us or is received directly from you at our offices/branches or through the Bank’s website, applications and electronic communications and any information collected by the Bank’s server from the browser, or the physical forms that are later digitized.

Exceptions of Personal Data/Sensitive Personal Data-

• Any information freely available in the public domain
• Any reviews, comments, messages, or blogs posted by customers on public sections of the Bank’s website or application become published content and are not considered personal or sensitive data subject to this document.

3. What Data including Personal Data does the Bank Collect & Process?

The Bank collects the following categories of Data including Personal Data for providing services to you. Please note below is not an exhaustive list and may change as per the products and services offered to fulfil regulatory and legal requirements:

1. Demographic & Identification Data
   1. Name, first name, middle name, last name
   2. Date of birth, age, gender, marital status, nationality, religion, caste
   3. Contact details: address (home, permanent, residential), phone numbers, email IDs
   4. Depositor name, director name, director address, guarantor name, spouse’s name, father’s name, mother’s maiden name
   5. Nominee and beneficiary details (name, relationship, date of birth, address)
   6. Photograph, signature, CCTV footage, location data
   7. dentity and address proof: Aadhaar, PAN, passport, voter ID, driving license, KYC documents, CIF ID
   8. Employment details, education qualifications
2. Financial Information
   1. Bank account details, account number, IFSC code
   2. Account statements, transaction history
   3. Annual income, salary slips, income tax returns (Form 16)
   4. Loan details: amount, sanction date
   5. Credit score (e.g., CIBIL), net worth statements, PF number
   6. Card details (credit/debit), payment instrument information

4. Where does the bank obtain Data from?

Most of the Data including Personal Data processed by the Bank is provided directly by you through our website, mobile banking application, by visiting our branches, through our authorised third parties (such as DSAs and CSAs), or through Relationship Managers, and while using our products and services. We may also collect certain information through cookies when you visit our website. In addition, we may collect information about you from other sources as described below, and after verifying its authenticity, may add it to the data we already hold and process it in accordance with this Privacy Policy.

If Personal Data is collected from third-party service providers for the purpose of offering relevant marketing content, offers, or services, such data will be used and processed only with your consent. These third-party service providers may include email service providers, and public data bases, social media sites as well as other third parties as deemed appropriate. We, including our service providers, may monitor, record & retain your image, conversations and/ or electronic communication between you & us electronically or otherwise as deemed appropriate.

5. Purpose for collecting and processing Data including Personal Data

The Bank processes your Data including Personal Data for the following purposes:

• Provide products and assist in and administer the provision of services to you, which includes activities like account opening, product delivery, onboarding, and service facilitation:
  • To process account opening (in person, branch assisted, VKYC)
  • To issue and deliver credit cards/debit cards
  • UIDAI Aadhaar Verification
  • To onboard clients and partners for banking and financial services
  • To facilitate NEFT transactions, NACH mandates, and digital/physical payments
  • To manage locker facilities and cheque books
  • To deliver services via call centre and doorstep banking
  • To maintain records and reconcile accounts
  • To provide financial literacy training and general services
  • To onboard buyers for TReDS and clients for channel finance
  • To evaluate and onboard loan accounts from NBFCs
  • To facilitate joint loan disbursement
  • To generate financial statements and maintain borrower accounts
  • To provide general banking services
• Prevent, detect, investigate and prosecute fraud and alleged fraud, money laundering and other crimes and to verify your identity which includes KYC, compliance, and fraud related activities:
  • Includes KYC, compliance, and fraud-related activities:
  • To verify and update customer contact details
  • To conduct due diligence and investigations
  • To fulfil legal obligations and provide data to auditors
  • To facilitate Re-KYC and investigate staff accountability
  • To monitor and manage stressed loan accounts
  • To identify early signs of financial distress
• Providing information about products, offers, promotions, and services, which includes marketing and outreach activities in accordance with the consent provided by you.
• Process and deal with any complaints or enquiries made by or about you which includes grievance redressal and customer support:
  • To handle customer complaints and RCA
  • To recover the dues
  • To resolve GST-related complaints
  • To investigate and redress grievances
  • To reach out to customers to recover the loans
  • To ensure secure and efficient recovery of dues
• To analyse your Personal Data for Anti-Money Laundering (AML) and other regulatory compliance requirements, provisioning of services, assessing loan and credit eligibility, and for other legitimate purposes necessary to support the Bank’s operations.
• For reporting to regulatory authorities and internal audits

6. Sharing of Personal Data

The Bank may disclose your Personal Data to various categories of third parties after obtaining your consent for the same or as part of legitimate use as per DPDPA. However, the Bank may also disclose your Personal Data without your consent where such disclosure is required under applicable laws, where the Bank is mandated to cooperate with statutory, regulatory, or governmental authorities, or where such disclosure is necessary for the legitimate use under the DPDP Act. The third parties include:

• Other Group Companies, Partners, and Subsidiaries for providing or enhancing products, services, and customer experience.
• Sub-contractors, agents, or service providers who work for the Bank or provide services/products on behalf of the Bank.
• Partners offering co-branded services, products, or programs, where such sharing is necessary to deliver the offering.
• Agents or service providers engaged for activities connected to customer servicing, operational support, marketing (where permissible), or other contractual obligations.
• Law enforcement agencies, government authorities, investigating agencies, and any authority empowered under law.
• Regulators, including the Reserve Bank of India, Indian or overseas regulatory bodies, auditors, and entities appointed by regulators to conduct inspections, audits, or investigations.
• Courts, tribunals, judicial or quasi-judicial bodies, arbitrators, and arbitration tribunals.
• Credit information companies / credit bureaus, statutory bodies, and any persons or entities to whom disclosure is mandatory under applicable laws.
• Situations involving regulatory reporting, compliance with legal processes, or to assert or defend the Bank’s legal rights and interests.

7. Withdrawal of Consent

Any individual has the right to withdraw their consent for the processing of their Personal Data at any time. Such withdrawal applies specifically to processing carried out for purposes, such as marketing or promotional communications, and will take effect only for future processing activities. It will not affect the lawfulness of any processing that was carried out prior to the withdrawal of consent. Even after consent is withdrawn, the Bank may continue to process Personal Data where required to comply with legal or regulatory obligations, to protect the Bank’s lawful interests, to pursue available remedies, or to defend against existing or potential claims.

In accordance with the requirements of the Digital Personal Data Protection Act, 2023, a clear and accessible mechanism for withdrawal of consent is required. Data Principals may withdraw or modify their consent at any time by using the consent management option available on the corporate website, internet banking portal, mobile banking application, among others.

8. Processing of Personal Data of Children and Persons with Disability

We obtain verifiable consent from a parent or lawful guardian before processing the Personal Data of minors. We ensure that such processing does not have any detrimental effect on the child’s well-being. The Bank does not engage in profiling, behavioural monitoring, or targeted advertising directed at children, and their data is not used for marketing or promotional activities. In line with the principle of data minimisation, only essential information required for providing the requested services is collected.

Where the individual is a Person with Disability who is unable to provide legally valid consent, we obtain verifiable consent from the lawful guardian before processing their Personal Data. Such processing is carried out with due care to ensure that it does not adversely impact the individual’s well-being.

9. Use of Cookies

• We use cookies and similar technologies to enhance your browsing experience, analyse site traffic, and personalised content. Some cookies are essential for this site to function, while others help us understand your use and preferences enabling us to improve our services. These are stored locally on your computer or mobile devices. By clicking "Accept All", you consent to the storage of cookies on your device & its functionality in accordance with our Cookie Policy. To customize your cookie preference, click “Customize” and select the categories you want to accept. You may choose to manage your preferences or modify/ withdraw your consent at any time by accessing cookie settings in your device.
• The Bank is not responsible for cookies placed in the device of user/s by any other website and data including Personal Data collected thereto. We do not control these cookies and once you have clicked on the advertisement and left the site, our Privacy Policy no longer applies.

10. Data Security

• The Bank is committed to protecting your Information/Data including your Personal Data and Sensitive Personal Data in our custody. We take reasonable steps and procedural safeguards that meet applicable laws to ensure appropriate physical, technical and managerial safeguards are in place to protect your data including Personal Data confidentiality and integrity. Appropriate contracts inclusive of security measures to protect your data including Personal Data is executed with the third parties/ vendors/ service providers involved in providing services to us.
• The Bank has adopted ISO/IEC 27001 standard, which is a globally accepted standard. The Bank’s Data centres, IT and Support functions are ISO 27001:2013 certified.

11. Data Principal Rights

We are committed to ensuring that you are aware of and can exercise your rights regarding your personal Data

Data principals have the following rights about their personal Data:

• Right of Access: Data principals have the right to obtain a copy of any or all the data bank processes about them, including the purpose for processing, the categories of personal data processed, any recipients of their data.
• Right to Rectification: Data principals have the right to request the correction of any inaccurate personal data held by bank.
• Right to Erasure: Data principals can request erasure of their personal data that is no longer required for legal, regulatory, or justified operational record-keeping purposes.
• Right to Nominate: Data principals have right to nominate a representative in case of death or incapacity.
• Right to Grievance Redressal: Before exercising the Right to Grievance, the Data Principal should first utilize the mechanisms available for other applicable rights. When submitting a grievance request, the Data Principal must provide the ticket or reference number associated with the previous request.

To exercise any of the data principal rights, customer can visit corporate website, internet banking portal, mobile banking application, among others and can contact the Data Protection Officer (DPO) via:

• Email: dpoffice@unionbankofindia.bank.in
• Address: Union Bank of India building, 2nd Floor, Data Protection Office, Military Road, Marol, Andheri East, Mumbai – 400059

If a satisfactory response is not received within 90 days under the grievance redressal system as per Rule 14 of DPDP Rules, you may lodge a complaint before the Data Protection Board for the redressal of any grievance arising from a personal data breach, the exercise of your statutory rights, or the failure to comply with applicable obligations.

12. Retention of Personal Data

The Bank may retain your Personal Data for as long as required for legitimate purposes that may include such as managing your account and dealing with any concerns that may arise or otherwise if as may be required for any for legal, regulatory and/or statutory reasons.

If the Bank no longer requires the retention of the information provided by the Customer, it will use best efforts to destroy or delete such Customer Information as per our Bank’s internal policies.

13. Links to other Websites and Social Media

The Bank website may contain links to websites of other organizations that are not owned by Bank. This document does not cover how those organizations process your data including

Personal Data. We encourage you to read the relevant privacy notice/policy on the other websites that you may visit.

Please note that when visiting Bank’s official social media site/ page, you are subject to this document well as the social media platform's own terms and conditions.

14. Conflict of Laws & Disputes

You agree that, irrespective of your location or country of jurisdiction, this document and its contents shall be subject to and governed by Indian laws (as amended from time to time) as may be applicable and that you waive all your rights which you may have in relation to this document under any contract or relevant laws applicable to the jurisdiction where you are situated and/or by which you are governed.

Any disputes over inter alia collection, storage and handling of data including Personal Data will be governed by this document, Terms and Conditions and by the laws of India and courts of India shall have exclusive jurisdiction.

15. Grievance Redressal

In case of any discrepancies or grievances, you may contact us at

• Email: dpoffice@unionbankofindia.bank.in
• Address: Union Bank of India building, 2nd Floor, Data Protection Office, Military Road, Marol, Andheri East, Mumbai – 400059

16. Notification of Changes

We may update this Privacy Policy from time to time to reflect changes in our business, technology, or legal requirements. We encourage you to review this Privacy Policy regularly to stay informed about our privacy practices and any changes we may make.

This Privacy Policy was last updated on July 31, 2026.