Privacy Policy
PaisaGraph is an AMFI-registered Mutual Fund Distributor. This policy explains what personal information we collect, how we use, share and protect it, and the rights and choices available to you.
1. Introduction
PaisaGraph ("PaisaGraph", "we", "our" or "us") is engaged in mutual fund distribution and related financial information and investor support activities, subject to applicable registrations and regulatory requirements.
This Privacy Policy describes how PaisaGraph collects, receives, accesses, uses, stores, shares, retains and protects personal information through its website, mobile applications, investor login facilities, digital communication channels and associated services (collectively, the "Platform").
This Policy applies to visitors, prospective investors, existing clients and other individuals whose personal information is processed by PaisaGraph in connection with its activities.
We recognise the importance of protecting personal information, particularly financial goals, investment holdings, transaction history, identity documents and other information that investors entrust to us.
We aim to process personal information lawfully, transparently and only for specified purposes, subject to applicable law, contractual obligations and the requirements of the relevant financial services.
2. Applicable Laws and Regulatory Framework
This Policy is intended to operate in accordance with applicable Indian laws and regulations, including, as applicable:
- The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), to the extent their respective provisions have commenced and apply to the relevant processing.
- The Information Technology Act, 2000, and applicable rules and requirements that remain in force and apply to our operations.
- Applicable SEBI regulations, circulars, directions and requirements relating to mutual fund distribution and investor protection.
- The AMFI Code of Conduct for Mutual Fund Distributors and applicable AMFI guidelines.
- Applicable contractual, record-keeping, cybersecurity and other regulatory requirements governing our relationships with authorised transaction platforms, asset management companies, registrars and transfer agents, and other service providers.
The DPDP Act and DPDP Rules have phased commencement provisions. This Policy will be implemented and updated to reflect the provisions applicable from time to time. Nothing in this Policy is intended to exclude any statutory right or obligation that applies to PaisaGraph or an individual.
3. Personal Information We Collect
The categories of personal information we collect depend on the services used, the information voluntarily supplied by an individual, and the requirements of the relevant transaction or service.
3.1 Identity and Contact Information
We may collect:
- Full name and contact details.
- Mobile number and email address.
- Residential or correspondence address, where required.
- Date of birth and other identity particulars, where applicable.
- PAN, KYC status and identity verification information, where required for permitted services.
- Other information reasonably necessary for investor onboarding, account administration or regulatory compliance.
3.2 Financial and Investment Information
Where relevant to the services requested, we may process information relating to:
- Financial goals and investment objectives.
- Investment horizon, liquidity requirements and stated risk preferences.
- Existing investment holdings and portfolio allocation.
- Mutual fund folio details, scheme holdings and transaction history.
- Investment amounts, purchase and redemption instructions, and transaction status.
- Investment performance information and portfolio statements.
- Other financial information voluntarily supplied or lawfully obtained for the relevant service.
Such information will be accessed and processed only to the extent necessary for the relevant service, subject to applicable permissions and contractual arrangements.
3.3 KYC and Regulatory Information
Where required, we may collect or access KYC-related information, PAN, identity verification records, declarations, tax-status information and other documentation necessary for investor onboarding, transaction facilitation, regulatory compliance or account maintenance.
Where feasible, KYC documents and other identity records will be collected or processed through authorised platforms and secure channels.
Individuals should not submit identity documents or other confidential records through unsecured public forms or ordinary email unless specifically instructed through an appropriate process.
3.4 Account and Transaction Information
Where the Platform provides investor login or transaction functionality, we may process information necessary to:
- Authenticate users and manage access to their accounts.
- Display portfolio information and transaction history.
- Facilitate permitted mutual fund transactions.
- Provide transaction confirmations, status updates and service notifications.
- Maintain transaction logs, audit trails and records required by law or contract.
- Investigate discrepancies, resolve service requests and address suspected misuse.
Certain information may be generated or maintained by the relevant asset management company, registrar and transfer agent, or transaction platform rather than directly by PaisaGraph.
3.5 Technical Information and Cookies
When an individual visits the Platform, we may collect or receive technical information such as:
- IP address and device identifiers.
- Browser type, operating system and device characteristics.
- Pages visited, session information and approximate usage patterns.
- Access dates, timestamps and referral sources.
- Error logs, diagnostic information and security-related records.
- Cookie identifiers and analytics information, subject to applicable consent requirements.
We may use this information to maintain website functionality, monitor performance, detect security incidents and improve the user experience.
3.6 Information Received from Third Parties
Where lawfully permitted and relevant to the requested service, we may receive information from asset management companies, authorised transaction platforms, registrars and transfer agents, KYC Registration Agencies, authorised service providers and other relevant parties.
We will process such information consistently with the applicable purpose, legal requirements, permissions and contractual arrangements.
4. Purposes for Which Information Is Processed
PaisaGraph may process personal information for the following specified purposes, as applicable:
A. Website enquiries and customer support
- Responding to enquiries and callback requests.
- Communicating with prospective and existing investors.
- Addressing complaints, requests and service issues.
B. Mutual fund distribution and transaction support
- Facilitating investor onboarding and permitted transaction-related processes.
- Supporting the display or retrieval of portfolio and transaction information.
- Communicating transaction status and relevant service updates.
- Coordinating with authorised transaction platforms, AMCs and other relevant service providers.
C. Investor information and educational content
- Providing financial information, market updates and educational material.
- Sharing scheme-related information and product documentation.
- Helping users access information relevant to their stated investment objectives, where appropriate to our distribution role.
D. Regulatory and operational requirements
- Meeting applicable legal, regulatory, contractual and record-keeping obligations.
- Maintaining audit trails and records.
- Preventing fraud, unauthorised access and misuse.
- Investigating disputes and responding to lawful requests from competent authorities.
E. Website operation and improvement
- Maintaining the security, availability and functionality of the Platform.
- Diagnosing technical problems.
- Understanding aggregate website usage and improving user experience.
- Measuring the effectiveness of permitted communications and website content.
F. Marketing and promotional communications
Subject to applicable law and the relevant consent requirements, we may communicate information about our services, investor education initiatives, financial content and relevant investment products.
We will not use personal information for a new purpose incompatible with the purpose disclosed to the individual unless the processing is otherwise permitted by applicable law or the necessary consent has been obtained.
5. Legal Basis and Consent
Where consent is required under applicable law, PaisaGraph will seek consent through an appropriate mechanism before undertaking the relevant processing.
Consent requests will be designed to explain the information involved, the purpose of processing and the choices available to the individual, in accordance with applicable requirements.
Where processing is permitted or required on another legal basis, including a statutory obligation or another recognised basis under applicable law, the relevant processing may take place without relying on consent to the extent legally permitted.
Consent to promotional communications will be kept distinct from consent or other lawful authorisation necessary to provide a requested service, wherever applicable.
Merely visiting the Platform or reading publicly available financial information will not, by itself, be treated as consent to unrelated marketing or unnecessary collection of personal information.
6. Use and Protection of Investor Financial Information
Financial and investment-related information requires particular care. PaisaGraph will apply the following principles, subject to applicable law and the nature of the services provided:
- Purpose limitation: Investor information will be used for the relevant service, transaction, communication or other disclosed purpose.
- Need-to-know access: Access will be restricted to authorised personnel and service providers who require the information for legitimate operational purposes.
- Data minimisation: We will seek to collect only information reasonably necessary for the relevant purpose.
- Confidentiality: Investor information will be handled in accordance with applicable confidentiality, regulatory and contractual obligations.
- Secure processing: Appropriate technical and organisational safeguards will be maintained according to the nature and risks of the processing.
- Controlled disclosure: Information will not be disclosed to unrelated third parties for their independent use without the required consent or another lawful basis.
- Retention and deletion: Information will be retained and disposed of in accordance with the retention principles in this Policy and applicable legal obligations.
PaisaGraph does not sell investors' personal financial information to third parties.
Users should never disclose their passwords, OTPs, PINs, transaction authentication credentials or similar security credentials to anyone claiming to represent PaisaGraph.
7. Disclosure and Sharing of Information
We may disclose or make relevant personal information available to the following categories of recipients, where necessary for the stated purpose and permitted by law.
7.1 Mutual Fund and Transaction Service Providers
These may include:
- Asset management companies.
- Registrars and transfer agents.
- Authorised mutual fund transaction platforms, including BSE StAR MF where applicable.
- Authorised KYC service providers and KYC Registration Agencies.
- Other authorised financial market infrastructure or operational service providers involved in the relevant service.
Information shared will be limited to what is reasonably necessary for the relevant transaction, service, verification or regulatory purpose.
7.2 Technology and Operational Service Providers
We may use third-party providers for:
- Website hosting and infrastructure.
- Cloud storage and data processing.
- Cybersecurity and technical support.
- Customer relationship management.
- Email, SMS, telephone and WhatsApp communications.
- Analytics, website performance and diagnostic services.
- Secure document handling and electronic verification.
Appropriate contractual, confidentiality and security arrangements will be implemented where required.
7.3 Professional Advisers and Auditors
Information may be disclosed to legal advisers, auditors, accountants, consultants or other professional service providers where reasonably necessary for the relevant engagement and subject to applicable confidentiality obligations.
7.4 Government, Regulators and Legal Authorities
We may disclose information where required or authorised by applicable law, a valid court order, a lawful request from a competent authority or an applicable regulatory obligation.
7.5 Other Disclosures
Information may also be disclosed where the individual has provided the necessary consent or where another lawful basis permits the disclosure.
We do not authorise recipients to use information received from us for unrelated purposes merely because it has been shared with them.
8. Third-Party Platforms and Allocation of Responsibilities
The Platform may integrate with, link to or rely on services operated by third parties, including mutual fund transaction platforms, AMCs, registrars and transfer agents, KYC providers, app stores, communication providers and analytics services.
Depending on the arrangement, a third party may process information on behalf of PaisaGraph, or may process it independently under its own legal and regulatory responsibilities.
PaisaGraph's responsibilities will depend on the role it actually performs in relation to the relevant processing. We will not represent that PaisaGraph controls information held exclusively by an independent third party.
Users should review the applicable privacy notices and terms of relevant third-party services before using those services.
Where an external platform is used to complete authentication, KYC or a transaction, users should verify that they are accessing the intended authorised platform.
10. Marketing, Email, SMS and WhatsApp Communications
PaisaGraph may communicate through email, telephone, SMS, WhatsApp or other permitted channels for:
- Responses to enquiries and callback requests.
- Transaction and account-related updates.
- Service notifications and operational communications.
- Financial education, market updates and relevant promotional material.
Where required, we will obtain consent for promotional communications and maintain an appropriate record of that consent.
Promotional communications may be declined or discontinued by using the available unsubscribe facility, replying through a supported opt-out mechanism or contacting us at support@paisagraph.com.
Withdrawal of marketing consent will not ordinarily prevent us from sending essential service, security, transaction or legally required communications where those communications remain necessary and legally permitted.
We will not treat a user's consent to receive transaction-related notifications as automatic consent to receive unrelated promotional messages.
11. Data Security and Incident Management
PaisaGraph will implement reasonable technical and organisational safeguards appropriate to the nature of the personal information processed, the risks involved and the requirements of applicable law.
Such safeguards may include:
- Role-based access restrictions and authentication controls.
- Secure transmission and storage practices, where appropriate.
- Monitoring of access and relevant system activity.
- Confidentiality requirements for personnel.
- Security assessments, backups and incident-response procedures.
- Appropriate contractual safeguards for relevant service providers.
No electronic transmission or storage system can be guaranteed to be completely secure. Users should use trusted devices and networks, maintain the confidentiality of their credentials and promptly report suspected unauthorised access.
Where a personal data breach occurs, PaisaGraph will assess the incident and undertake the notifications, remedial measures and other actions required by the provisions of applicable law then in force.
12. Data Retention and Deletion
Personal information will be retained only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where required by applicable law, regulatory directions, contractual obligations or legitimate legal and record-keeping requirements.
Different categories of information may have different retention periods. Transaction records, KYC records, consent logs, complaint records and audit trails may be subject to specific retention obligations.
When personal information is no longer required, PaisaGraph will take appropriate steps to erase it or otherwise dispose of it securely, subject to lawful retention requirements and applicable exceptions.
Where information is held by an independent transaction platform, AMC, registrar or other service provider, its retention and deletion may also be governed by that provider's applicable obligations.
13. Rights and Choices of Individuals
Subject to the applicable law and the provisions in force at the relevant time, individuals may be entitled to exercise rights relating to their personal information, including:
- Requesting information about the processing of their personal information.
- Requesting correction, completion or updating of inaccurate or incomplete information.
- Requesting erasure of personal information where applicable, subject to lawful retention requirements.
- Withdrawing consent where processing is based on consent.
- Seeking an appropriate grievance redressal mechanism.
- Exercising any other rights available under applicable law.
Requests may be submitted using the contact details set out in Section 17.
PaisaGraph may request reasonable information to verify the identity and authority of the person making a request, particularly where the request concerns confidential financial or transaction information.
We will respond within the period prescribed by applicable law or, where no specific period applies, within a reasonable period.
A request for deletion may not be capable of being fully implemented where retention is required by law or necessary for a permitted legal purpose. Any such limitation will be handled in accordance with applicable law.
14. Consent Withdrawal and Grievance Redressal
Where personal information is processed on the basis of consent, individuals may withdraw that consent through the applicable mechanism or by contacting PaisaGraph.
The withdrawal process will be designed to be accessible and, where required, as easy as the process used to provide consent.
Withdrawal will not affect the lawfulness of processing undertaken before withdrawal. It may also affect our ability to continue providing services that depend on the relevant information.
Privacy-related complaints, requests or concerns may be submitted to the contact specified in Section 17. We will review complaints and take appropriate action in accordance with applicable law and our grievance-handling procedures.
Nothing in this Policy restricts an individual's statutory right to approach a competent authority or exercise another remedy available under applicable law.
15. Children's Personal Information
The Platform is primarily intended for individuals seeking financial information or services in accordance with applicable law.
Where personal data of a child is involved, PaisaGraph will comply with the requirements applicable to the relevant processing, including any applicable parental or lawful guardian consent requirements and restrictions.
We will not knowingly undertake processing of children's personal data in a manner prohibited by applicable law. Where we identify information that has been collected contrary to applicable requirements, we will take appropriate remedial action.
16. Changes to This Privacy Policy
PaisaGraph may revise this Policy to reflect changes in its services, technology, business arrangements, regulatory requirements or applicable law.
The updated version will be published on the Platform with the revised effective or last-updated date.
Where a material change requires a new notice, renewed consent or another specific action under applicable law, PaisaGraph will undertake that action before commencing the relevant processing, as required.
Users are encouraged to review this page periodically.
17. Contact and Grievance Redressal Details
For privacy-related enquiries, requests, consent withdrawal or complaints, please contact:
Please include sufficient details to identify the relevant request without sending passwords, OTPs or unnecessary confidential documents through ordinary email.
We will handle requests in accordance with the applicable legal framework and our internal procedures.
18. Governing Law
This Policy shall be governed by the laws of India, subject to applicable statutory rights, regulatory requirements and the jurisdiction of competent authorities.
Nothing in this Policy is intended to waive, reduce or contract out of any obligation imposed on PaisaGraph by applicable law.