DPDPA 2023 Compliant

1. Personal Data We Collect

We collect personal data that is necessary to provide our financial distribution services and comply with applicable regulations:

Data Category	Specific Data Points Collected
Identity Data	Full name, date of birth, gender, photograph, PAN card number, Aadhaar number (last 4 digits only), passport/voter ID
Contact Data	Residential address, email address, mobile number, WhatsApp number
Financial Data	Bank account details (account number, IFSC, bank name), net worth, income range, investment portfolio details, existing investments, liabilities
KYC Data	KYC status, KRA registration details, FATCA/CRS declarations, PEP (Politically Exposed Person) status, AML/CFT related data
Transaction Data	Investment transactions, redemptions, switches, SIP details, folio numbers, NAV history, portfolio valuation
Risk Profile Data	Risk tolerance assessment responses, investment goals, investment horizon, financial objectives
Technical Data	IP address, browser type and version, device information, pages visited, time spent on website (via cookies)
Communication Data	Records of correspondence, emails, phone calls (with consent), WhatsApp messages related to financial services

2. How We Use Your Personal Data

Purpose	Details & Legal Basis
Service Delivery	Processing your investment transactions, account maintenance — Contractual necessity
KYC & AML Compliance	Fulfilling KYC and AML requirements under PMLA 2002 and SEBI/AMFI regulations — Legal obligation
Regulatory Reporting	Submitting mandatory reports to SEBI, AMFI, Income Tax authorities as required — Legal obligation
Account Statements	Generating and sending transaction confirmations, account statements, and CAS — Contractual necessity
Risk Assessment	Assessing your risk profile and recommending suitable investment products — Legitimate interest
Service Communication	Sending portfolio updates, regulatory notices, scheme information — Legitimate interest
Grievance Redressal	Addressing and resolving your complaints and queries — Legal obligation and legitimate interest
Fraud Prevention	Detecting and preventing fraud, unauthorized transactions, and suspicious activities — Legal obligation

3. Data Retention — Minimum 8 Years

4. Data Sharing & Third Parties

We share your personal data only when necessary and only with the following authorised parties:

• Asset Management Companies (AMCs) — To process your investment transactions in the schemes you choose
• Registrar & Transfer Agents (CAMS / KFintech) — For folio creation, transaction processing, and account statements
• KYC Registration Agencies (KRAs) — For KYC verification and registration (CAMS KRA, CVL KRA, CKYC India, NDML)
• MF Central — For consolidated portfolio management and CAS generation
• SEBI, AMFI, Income Tax, and other Regulators — As required by law for regulatory reporting and compliance
• Technology Service Providers — Website hosting, email services (bound by confidentiality agreements)

5. Data Security Measures

• All digital data is stored in password-protected, encrypted systems with restricted access
• Physical documents are stored in locked, secure premises with access limited to authorised personnel only
• All staff with access to personal data are bound by strict confidentiality obligations
• Website data transmission is protected by SSL/TLS encryption (HTTPS)
• In the event of a data breach, affected individuals will be notified as required under DPDPA 2023

6. Cookies Policy

Our website haldiasun.com uses cookies to improve user experience and analyse website traffic. We do not use cookies for advertising or cross-site tracking.

7. Your Rights Under DPDPA 2023

8. Data Protection Officer (DPO)

9. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. Any disputes arising from this Privacy Policy shall be subject to the exclusive jurisdiction of courts in Haldia, West Bengal. For data protection grievances, you may also approach the Data Protection Board of India as constituted under DPDPA 2023.