Privacy Policy — Finoda Pvt Ltd | Data Protection & GDPR | India

What Data We Collect and Why

We collect only the data we actually need. Nothing more. Here's a breakdown of what we gather when you interact with our website or services:

• Personal identification data — your name, mobile number, email address, and PAN number. We need this to verify your identity when you open a demat account or request advisory services.
• Financial details — income range, investment preferences, and risk appetite. This helps us match you with the right products — whether that's a mutual fund SIP, a fixed deposit, or equity trading.
• KYC documents — Aadhaar, PAN card, and bank details. These are mandatory under Indian financial regulations for account opening and transaction processing.
• Device and usage data — IP address, browser type, pages visited, and time spent on the site. We use this to improve our website and understand what's actually useful to our users.
• Communication records — if you send us an email, fill out our contact form, or call us, we store that interaction to follow up properly and improve our service.

So, why do we collect all this? Four main reasons: to deliver our services, to meet regulatory requirements, to improve your experience, and to keep your account safe. We don't collect data "just in case." Every field has a purpose.

How We Use Your Information

We use your data to run this business properly — and to serve you better every time you come back.

• Service delivery is the big one. When you open a demat account, we need your details to process the application. When you ask for advice on portfolio management, we need to understand your financial situation first.
• Communication comes next. We send you account updates, transaction confirmations, and relevant market information. If you've opted in, we may also share insights on products like NPS investments or income tax filing. You can opt out anytime.
• Regulatory compliance is non-negotiable. Financial services firms in India must maintain records for auditing purposes. We store certain data to meet these legal obligations — not longer than required, and never beyond what regulators specify.
• Analytics and improvement round things out. We look at anonymised usage patterns to understand which pages are helpful and which need work. This data never identifies you personally.

We never sell your data. We don't share it with advertisers. And we don't use it to build profiles for third-party marketing.

Data Security Measures

Honestly, this is the part most privacy policies gloss over. We won't do that. Here's what we actually do to protect your data:

• SSL encryption secures every page of our website. Data transmitted between your browser and our servers is encrypted end-to-end. You'll see the padlock icon on your browser — that's standard, and it's active here.
• Access controls mean that only authorised Finoda team members can view sensitive client data. We operate on a need-to-know basis internally. Not everyone on our team can pull up your KYC documents.
• Secure data storage — we store your data on servers located within India. This aligns with the data localisation requirements under India's DPDP Act and RBI's Digital Lending Directions, 2025.
• Third-party processor agreements — when we work with technology partners or service providers (for instance, trading platforms or payment gateways), they're contractually bound to protect your data at the same standard we hold ourselves to.
• Breach response — in the unlikely event of a data breach, we'll notify you and the relevant authorities without delay, as required under the DPDP Act. Our response protocol is documented, tested, and ready.

We also recommend a few things on your end: use a strong, unique password for any account linked to financial services, don't share your OTPs with anyone, and always access our site via a secure network.

Your Rights Under Indian Data Protection Laws

The DPDP Act, 2023 gives you real rights over your personal data. We support all of them. Here's what you can do:

• Right to access — you can ask us what personal data we hold about you. We'll tell you within the timeframe specified under the DPDP Rules (generally 7 working days for such requests).
• Right to correction — if your data is wrong or outdated, you can request an update. Got a new address or phone number? Let us know and we'll fix it.
• Right to erasure — in certain situations, you can ask us to delete your data. Note that some data must be retained for regulatory reasons — we'll be transparent about what we can and can't delete, and why.
• Right to withdraw consent — if you've given us permission to use your data for marketing or communication purposes, you can take that back at any time. Withdrawing consent doesn't affect the lawfulness of anything we did before you withdrew it.
• Right to grievance redressal — if you're not happy with how we've handled your data, you can raise a formal complaint. We have a dedicated Grievance Redressal process to address these concerns properly.
• Right to nominate — under the DPDP Act, you can nominate another person to exercise data rights on your behalf in case of death or incapacity. This is a relatively new right in Indian law, and we support it fully.

To exercise any of these rights, email us at info@finoda.in with the subject line "Privacy Request." We'll respond within 7 working days.

Cookies and Tracking

Our website uses cookies — small files stored on your device that help us remember your preferences and understand how you use the site.

• Essential cookies keep the website running. Without them, things like the contact form and navigation break. These can't be disabled.
• Analytics cookies (like Google Analytics) help us see which pages get traffic, how long people stay, and where they drop off. This data is anonymised and used purely to improve the site.
• Marketing cookies — we use minimal marketing cookies. If you've landed on our site through a Google ad or social post, these help us understand which campaigns are working. They don't track you across the internet.

You can manage cookie preferences through your browser settings. Blocking analytics cookies won't affect your ability to use our site.

Data Sharing and Third Parties

We don't share your data with anyone who doesn't need it. But in the course of running a regulated financial services business, some sharing is necessary.

• Regulatory bodies — if required by law, regulation, or a court order, we may share data with authorities like SEBI, RBI, or income tax departments.
• Technology providers — our website, CRM, and trading infrastructure are powered by third-party tools. These providers process data on our behalf under strict contractual obligations.
• Banking and payment partners — for account opening and payment processing, certain data passes through banking infrastructure. These are licensed financial entities with their own regulatory compliance obligations.

We never share your data for commercial gain. No selling, no renting, no swapping lists with other companies.

Data Retention Policy

We keep your data for as long as we need it — and not a day longer.

For active clients, we retain data for the full duration of the client relationship plus seven years after closure (as required under SEBI and income tax regulations). For non-client enquiries and website leads, we retain contact information for up to two years, after which it is deleted unless you've engaged with us further.

Our internal review cycle ensures data that's past its retention period is purged from our systems regularly.

Contact Us for Privacy Concerns

We're real people, reachable at real contact points. If this policy raised any questions, or if you want to exercise your data rights, here's how to find us:

• Email: info@finoda.in
• Phone: 9035294343
• Office Address: VGV Towers, Unit 101, 139/88, 1st Floor, 100 Feet Ring Rd, Jayanagara 9th Block, Bengaluru — Karnataka 560041

Or fill out our Contact Form and our team will get back to you within one business day.

You can also visit our Grievance Redressal page if you have a formal complaint. And if you believe there's been a serious data breach, you also have the right to escalate your concern to the Data Protection Board of India, once fully operational under the DPDP Act's phased rollout (expected May 2027).