Privacy Policy

1. About This Policy and Our Identity

Dhan Saarthi (available at https://dhansaarthi.com and as a mobile application) is operated by Khazana Fintech Private Limited, a company incorporated under the Companies Act, 2013, bearing CIN U66190WB2025PTC276483 and registered office at 28 Southend Park, Prime Residency, Ground Floor, Kolkata 700029. The Company is registered with AMFI as a mutual fund distributor bearing ARN-325085.

This Privacy Policy ("Policy") explains how we collect, use, store, share and protect your personal data when you use our Platform and Services. For the purposes of this Policy, "personal data" or "personal information" means any data that can be used to identify you personally.

This Policy is published in compliance with:

• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
• The Digital Personal Data Protection Act, 2023 (DPDP Act) and rules framed thereunder.
• Applicable SEBI, AMFI and other regulatory requirements.

By using the Platform, you consent to the collection and use of your personal data as described in this Policy. If you do not agree, please stop using the Platform immediately.

2. Personal Data We Collect

2.1 When You Visit as a Guest

• Technical and usage data: IP address, device type, operating system, browser type, pages visited, time spent, referral URL and cookies that may uniquely identify your browser or device.
• We use this data to analyse usage patterns and improve the Platform. No investment services are available without registration.

2.2 When You Register

• Login credentials: username and password (stored in encrypted form).
• If you use Social Login (Google or Facebook): your name and email address only. No other data is accessed from your social media account.

2.3 When You Avail Investment Services

To open an investment account and transact, we collect:

• Identity details: full name, father's name, date of birth, gender, nationality.
• Contact details: email address, mobile number, mailing/correspondence address, pin code.
• Tax and regulatory identifiers: PAN, Aadhaar (for KYC), FATCA/CRS declarations.
• Bank account details: account number, IFSC code, MICR code, cancelled cheque image or passbook first page.
• KYC documents: proof of identity and address as required under Applicable Law.
• Photograph and signature: captured digitally for KYC and account-opening formalities only. Your signature will not be used to authorise transactions.
• Investment preferences and risk profile: responses to risk profiling questionnaires and goal planning inputs.

2.4 Consolidated Account Statement (CAS) Feature

If you choose to track investments made outside DhanSaarthi, we will require your email address registered with your mutual fund folios. Our systems will automatically read only the email with the subject line:

• No other emails in your inbox are accessed, read or stored by us.
• This access is governed by the Google API Services User Data Policy, including the Limited Use requirements. Our use and transfer of information received from Google APIs adheres strictly to these requirements.
• If you do not wish to provide your email address, you may manually upload your investment information on the Platform.

2.5 Sub-Distributors and Partners

• If you are onboarded as a sub-distributor or partner, we additionally collect your ARN, EUIN, GSTIN, business address, and authorised representative details as required for empanelment and commission payments.
• Partner data is handled with the same security standards as investor data and is subject to the confidentiality terms of your Platform Agreement.

3. How We Use Your Personal Data

We use your personal data for the following lawful purposes:

• Account registration, activation and management.
• KYC verification and compliance with SEBI, AMFI, PMLA, FATCA/CRS and other regulatory obligations.
• Processing investment transactions and forwarding instructions to relevant AMCs and RTAs.
• Sending investment confirmations, account statements, transaction alerts and regulatory communications.
• Providing portfolio tracking, goal planning, risk profiling and other Platform tools.
• Responding to your queries and grievances.
• Conducting internal analytics, quality assurance, product improvement and fraud prevention.
• Sending marketing and promotional communications about our Services. You may opt out at any time.
• Complying with statutory, regulatory and legal obligations including court orders and government directives.
• Sharing data with authorised third parties as described in Section 4 below.

4. How We Share Your Personal Data

We do not sell or rent your personal data to any third party. We share your data only in the following circumstances:

4.1 Regulatory and Transaction Processing

• Bombay Stock Exchange (BSE) and its STAR MF platform: for transaction execution and verification.
• AMCs (Asset Management Companies): to process your investment, redemption, switch and SIP/STP instructions.
• RTAs (Registrar and Transfer Agents) such as CAMS and KFintech: for folio management, account statements and transaction records.
• KYC Registration Agencies (KRAs): for KYC verification and maintenance of your KYC records.
• Payment gateway providers: for processing electronic fund transfers for your investments.
• AMFI and SEBI: as required under regulatory obligations.

4.2 Service Providers

• Third-party technology vendors, cloud service providers, data analytics providers and communication service providers who assist us in operating the Platform. All such vendors are contractually bound to maintain confidentiality and comply with applicable data protection laws.

4.3 Legal and Regulatory Disclosure

• We may disclose your personal data to judicial, administrative or regulatory authorities where required by law, court order, or in good faith to protect our legal rights, report illegal activity, or respond to regulatory inquiries.

4.4 Advisor Transitions

• If your registered sub-distributor or advisor transitions to another entity, your data may be disclosed to the new entity unless you instruct us in writing not to do so. You may write to us at admin@dhansaarthi.com to exercise this right.

4.5 Third-Party Opt-In Services

• With your prior explicit consent, we may share your data with selected third-party service providers whose services you choose to access through the Platform. You may withdraw this consent at any time.

5. Cookies and Tracking Technologies

• We use cookies and similar tracking technologies to operate the Platform, remember your preferences and understand how you use our services.
• Essential cookies: required for the Platform to function. These cannot be disabled.
• Analytics cookies: help us understand usage patterns and improve the Platform. You may decline these.
• Marketing cookies: used to deliver relevant promotional content. You may decline these.
• You can manage your cookie preferences at any time through the cookie preference centre on the Platform or in your browser settings. Please refer to our Cookie Policy at https://dhansaarthi.com/cookie-policy for full details.

6. How We Protect Your Data

• We implement industry-standard physical, electronic and administrative safeguards including firewalls, SSL/TLS encryption for data in transit, encryption for sensitive data at rest, access controls and regular security assessments.
• Your account is protected by password-based authentication. We recommend using a strong, unique password and not sharing it with anyone.
• No security system is 100% impenetrable. We cannot guarantee absolute security of data transmitted over the internet. You use the Platform at your own risk for internet transmission.
• We are not responsible for losses arising from your failure to secure your login credentials, or from unauthorised access to your account resulting from your actions or omissions.
• In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the Data Protection Board of India (once notified under applicable law) in accordance with the DPDP Act, 2023.
• If you suspect your account has been compromised, immediately change your password and contact our Data Protection Officer at admin@dhansaarthi.com.

7. How Long We Retain Your Data

• We retain your personal data for as long as your account is active and for such periods thereafter as required under Applicable Law, including:
• KYC records and transaction data: minimum 5 (five) years from the end of the business relationship, as required under the Prevention of Money Laundering Act, 2002.
• Account and investment records: as required under the SEBI (Mutual Funds) Regulations, 1996 and AMFI guidelines.
• Tax-related records: as required under the Income Tax Act, 1961.
• After the expiry of mandatory retention periods, we will securely delete or anonymise your personal data, unless retention is required for ongoing legal proceedings, regulatory investigations or dispute resolution.
• If you close your account and request deletion, we will delete or anonymise your personal data to the extent not required to be retained under Applicable Law. We will confirm the action taken within 30 days of your request.

8. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights in relation to your personal data:

To exercise any of the above rights, please contact our Data Protection Officer (details in Section 10). We will respond within 30 (thirty) days. In some cases, we may need to verify your identity before processing your request.

Right to withdraw consent: You may withdraw your consent to the processing of your personal data at any time by writing to us. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. Please note that withdrawal of consent may result in your inability to access certain or all Services.

9. How Your Data Is Transmitted

• All data transmitted between your device and our servers is encrypted using HTTPS (TLS) protocol, indicated by the padlock icon in your browser.
• We do not transmit sensitive personal data through unencrypted channels.

10. Data Protection Officer and Grievance Redressal

We have appointed a Data Protection Officer who is also our Grievance Redressal Officer for matters relating to your personal data:

• You may contact our Data Protection Officer with any questions, requests or complaints relating to the processing of your personal data.
• We will acknowledge your grievance within 3 (three) Business Days and endeavour to resolve it within 30 (thirty) days of receipt.
• If you are not satisfied with our response, you may approach the Data Protection Board of India once it is established under the DPDP Act, 2023.

11. Third-Party Websites

• Our Platform may contain links to third-party websites. This Policy does not apply to those websites. We are not responsible for the privacy practices, content or security of any third-party website.
• We recommend reviewing the privacy policy of any third-party website before submitting your personal data to it.

12. What Happens to Your Data When You Leave

• If your relationship with us ends, whether by your choice, account closure, or termination, we will continue to protect your personal data in accordance with this Policy.
• We will retain such data as we are legally required to retain under Applicable Law (see Section 7).
• You may instruct us in writing not to share your data with our partners or affiliates after termination of your relationship. We will honour such instructions to the extent permitted by law.
• Upon receipt of a valid erasure request, we will delete or anonymise data not subject to a mandatory retention obligation and confirm the action within 30 days.

13. Changes to This Privacy Policy

This Policy is published in compliance with Regulation 4 of the SPDI Rules, 2011 and the requirements of the DPDP Act, 2023.

• We review and update this Policy periodically. The date of last revision will appear at the top of this Policy.
• We will notify you of material changes to this Policy by email or by a prominent notice on the Platform at least 7 (seven) days before the changes take effect.
• We will not reduce your rights under this Policy without your explicit consent.
• Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree, please discontinue use and contact us regarding deletion of your data.

14. Governing Law and Jurisdiction

• This Policy is governed by and construed in accordance with the laws of India, including the DPDP Act, 2023, the IT Act, 2000 and all applicable rules thereunder.
• Any disputes relating to this Policy shall be subject to the exclusive jurisdiction of the courts at Kolkata, West Bengal.