1. DEFINITIONS

In this Privacy Policy, the following terms shall have the meanings set out below:

2. WHO WE ARE — IDENTITY OF THE DATA FIDUCIARY

AnchorWealth Technologies LLP is the Data Fiduciary responsible for your Personal Data under this Privacy Policy. Our details are as follows:

• Legal Name: AnchorWealth Technologies LLP
• Trading Name / Platform: AnchorWealth.AI
• Registered Office: 18, Floor-3, Plot-319, Mitha, Mansion, Ballard Estate, Mumbai G.P.O., Mumbai, Mumbai, Maharashtra, India, 400001
• LLPIN: ACS-1984
• AMFI ARN: 346989
• Data Protection Officer Email: customerservice@anchorwealth.ai

3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to:

• all Users who register, access, or use the Platform;
• all Personal Data collected through the Platform, our mobile applications, customer support channels, email, telephone interactions, and any other interface between you and AnchorWealth;
• all third-party Data Processors engaged by AnchorWealth in connection with the Services; and
• all Personal Data processed in India.

This Privacy Policy does not apply to:

• Personal Data processed by third-party websites linked from the Platform (see Clause 13); or
• Personal Data collected by AnchorWealth in its capacity as an employer from its employees, which is governed by separate internal HR privacy policies.

4. PERSONAL DATA WE COLLECT

We collect Personal Data from you in the following categories, depending on your level of engagement with the Platform:

4.1 Identity and Contact Information

• Full legal name as per PAN card
• Date of birth
• Gender
• Residential and correspondence address
• Email address (registered and communication)
• Mobile number
• Photograph (where required for KYC)

4.2 Government-Issued Identifiers

• Permanent Account Number (PAN)
• Aadhaar number (collected only with explicit consent for e-KYC, as per UIDAI guidelines)
• Passport / Voter ID / Driving Licence (where alternative KYC documents are submitted)
• CKYC identification number (where applicable)

Note: Aadhaar data is processed strictly in accordance with the Aadhaar Act, 2016, and applicable UIDAI regulations. AnchorWealth does not store the full Aadhaar number; only the last four digits are retained post-verification.

4.3 Financial and Investment Information

• Bank account details (account number, IFSC code, account type) for mandate and transaction processing
• Income details and net worth declaration (for regulatory suitability assessment)
• Existing investment holdings and portfolio information (where disclosed by you)
• Risk profile, investment horizon, and financial goals
• SIP mandate details and debit instructions
• Tax status and deductions claimed under the Income Tax Act

4.4 Transaction Data

• Details of all mutual fund transactions executed through the Platform, including investment amount, fund name, scheme, date, NAV, and units allotted
• SIP transaction history, redemption requests, and switch instructions
• Payment records, bank debit confirmations, and electronic mandate (NACH) data

4.5 Technical and Usage Data

• IP address, browser type and version, operating system, and device identifiers
• Log data including pages visited, time spent, features used, and navigation paths
• Cookie identifiers and web beacon data (see Clause 6)
• Mobile device data including device ID, push notification token, and app version
• Geolocation data (city/region level, if permitted by your device settings)

4.6 AI and Behavioural Data

• User interaction patterns with the AI Dashboard and portfolio tools
• Risk assessment responses and questionnaire data
• Investment preference signals inferred from Platform usage
• Feedback, ratings, and user-generated inputs provided through the Platform

4.7 Customer Support Data

• Records of communications with our support team, including emails, chat logs, and call recordings (where applicable and notified)
• Complaint and grievance records

4.8 Data Collected from Third Parties

We may receive Personal Data about you from the following third-party sources:

• KYC Registration Agencies (KRAs) — KYC status, verification results, and CKYC data
• AMFI and BSE/NSE platforms — transaction confirmation and folio data
• Account Aggregators (AAs) — financial data shared by you through the RBI-regulated AA framework, with your consent

5. PURPOSES AND LEGAL BASIS FOR PROCESSING

We process your Personal Data only for specified, lawful purposes. The sections below set out the primary purposes for which we process your data and the corresponding legal basis under the DPDPA 2023:

5.1 Consent-Based Processing

• Registration on the Platform and creation of your Account
• e-KYC verification using Aadhaar (OTP-based or biometric, where applicable)
• Sharing your financial data with Account Aggregators for investment suitability assessment
• Sending marketing communications, promotional offers, and investment insights via email, SMS, or push notifications
• Profiling and personalisation of AI-generated fund suggestions and portfolio insights
• Sharing anonymised or aggregated data for market research and product improvement

5.2 Contractual Necessity

• Processing KYC documentation required to onboard you as an investor
• Executing mutual fund transactions, SIPs, and redemption requests on your behalf
• Generating portfolio reports, performance summaries, and tax statements
• Managing your Account, including password resets and support requests

5.3 Legal Obligation

• Compliance with SEBI (Mutual Funds) Regulations, 1996, and AMFI guidelines, including mandatory record-keeping and reporting
• Compliance with PMLA 2002 and RBI AML/KYC guidelines, including submission of STRs to the Financial Intelligence Unit (FIU-IND)
• Responding to orders, subpoenas, or directions from SEBI, AMFI, RBI, UIDAI, Income Tax Department, or other competent authorities
• Retention of transaction records as mandated under SEBI and income tax regulations

5.4 Legitimate Interests

• Fraud detection, cybersecurity monitoring, and prevention of unauthorised access to the Platform
• Improving the accuracy and performance of the AI Engine through anonymised usage data
• Internal audit, compliance monitoring, and risk management
• Enforcing our Terms and Conditions

6. COOKIES AND TRACKING TECHNOLOGIES

6.1 What Are Cookies?

Cookies are small text files stored on your device when you visit the Platform. We also use web beacons, pixel tags, and similar tracking technologies to collect information about your interactions with the Platform.

6.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly, including session management, authentication, and security. These cannot be disabled.
• Functional Cookies: Enable the Platform to remember your preferences, language settings, and personalisation choices.
• Analytics Cookies: Collect anonymised data about how users interact with the Platform (e.g., pages visited, time on page) to help us improve user experience.
• Marketing Cookies: Used to deliver targeted advertisements and measure the effectiveness of marketing campaigns, with your consent.

6.3 Cookie Management

You can manage your cookie preferences through the cookie consent banner displayed on your first visit to the Platform, or through your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the Platform.

7. SHARING AND DISCLOSURE OF PERSONAL DATA

AnchorWealth does not sell, rent, or trade your Personal Data to any third party. We share your Personal Data only in the following circumstances:

7.1 Regulatory and Statutory Bodies

• Securities and Exchange Board of India (SEBI)
• Association of Mutual Funds in India (AMFI)
• Bombay Stock Exchange (BSE) and National Stock Exchange (NSE)
• KYC Registration Agencies (KRAs) — CAMS KRA, Karvy KRA, CVL KRA, NDML, and DotEx
• Financial Intelligence Unit — India (FIU-IND)
• Income Tax Department and other revenue authorities
• Reserve Bank of India (RBI)
• UIDAI (limited Aadhaar data for e-KYC purposes)

7.2 Asset Management Companies (AMCs) and Fund Houses

To execute mutual fund transactions on your behalf, we share your identity, KYC status, bank details, and transaction instructions with the relevant AMCs, their Registrar and Transfer Agents (RTAs), and collecting banks.

7.3 Technology and Service Partners

We engage third-party Data Processors to provide technology, cloud hosting, payment processing, analytics, and customer support services. These Data Processors are contractually obligated to:

• process your Personal Data only on our documented instructions;
• implement appropriate technical and organisational security measures;
• not sub-process your data without our prior written authorisation; and
• delete or return your Personal Data upon termination of their engagement.

7.4 Account Aggregators (AA Framework)

With your explicit and revocable consent, we may access your financial data through the RBI-regulated Account Aggregator (AA) framework for the purpose of conducting investment suitability assessments and generating personalised portfolio insights.

7.5 Professional Advisers and Legal Proceedings

We may disclose your Personal Data to our legal, financial, or compliance advisers for the purposes of obtaining professional advice, and to courts or tribunals in connection with actual or prospective legal proceedings, to the extent legally required.

7.6 Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets, or any similar corporate transaction involving AnchorWealth, your Personal Data may be transferred to the successor entity, subject to the successor being bound by privacy obligations no less protective than those set out in this Privacy Policy. We will notify you of any such transfer in accordance with Applicable Law.

7.7 Disclosure with Your Consent

We will share your Personal Data with any third party not listed above only where we have obtained your prior, specific, and informed Consent to do so.

8. CROSS-BORDER DATA TRANSFERS

AnchorWealth processes and stores your Personal Data primarily within India. To the extent any Personal Data is transferred outside India (for example, in connection with cloud services operated by global providers), such transfers will be made only:

• to countries notified by the Central Government of India as permitting cross-border data transfers under the DPDPA 2023;
• in compliance with any restrictions or conditions specified by the Central Government; and
• subject to appropriate contractual safeguards being in place with the recipient Data Processor.

9. DATA RETENTION

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by Applicable Law. The following retention schedule applies:

Upon expiry of the applicable retention period, we will securely delete, destroy, or anonymise your Personal Data in accordance with our data deletion protocols and any requirements prescribed under the DPDPA 2023.

10. SECURITY OF PERSONAL DATA

10.1 Technical Safeguards

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• AES-256 encryption for Personal Data and Sensitive Personal Data stored in our databases
• Multi-factor authentication (MFA) for user accounts and administrative access
• Role-based access controls (RBAC) limiting employee access to Personal Data on a strict need-to-know basis
• Regular penetration testing and vulnerability assessments by certified third-party security auditors
• Web Application Firewalls (WAF), intrusion detection systems (IDS), and DDoS mitigation

10.2 Organisational Safeguards

• Mandatory data privacy and security training for all employees handling Personal Data
• Data Processing Agreements (DPAs) with all third-party processors
• Data breach response plan and incident management protocol
• Internal data privacy audits conducted at least annually

10.3 Breach Notification

In the event of a Personal Data breach that is likely to result in harm to you, AnchorWealth will:

• notify the Data Protection Board of India (DPBI) as soon as practicable upon becoming aware of the breach, in the manner prescribed under the DPDPA 2023; and
• notify you without undue delay, providing details of the nature of the breach, categories of data affected, likely consequences, and remedial measures taken.

Notwithstanding the above, no method of data transmission over the internet or electronic storage is completely secure, and AnchorWealth cannot guarantee absolute security. If you believe your Account or Personal Data has been compromised, please contact us immediately at customerservice@anchorwealth.ai

11. YOUR RIGHTS AS A DATA PRINCIPAL

Under the DPDPA 2023 and other Applicable Laws, you have the following rights with respect to your Personal Data processed by AnchorWealth. These rights may be exercised by contacting our Data Protection Officer at customerservice@anchorwealth.ai.

11.1 Right to Access Information

You have the right to obtain from us a summary of the Personal Data we hold about you, the purposes for which it is being processed, and the names and addresses of Data Processors and recipients with whom your data has been shared.

11.2 Right to Correction and Erasure

You have the right to request correction of any inaccurate, incomplete, or outdated Personal Data, completion of incomplete Personal Data, and erasure of Personal Data that is no longer necessary for the purpose for which it was collected, subject to legal and regulatory retention obligations.

Note: Erasure of certain categories of data (e.g., KYC records, transaction records) may not be possible due to mandatory retention requirements under PMLA 2002, SEBI regulations, and the Income Tax Act.

11.3 Right to Withdraw Consent

Where processing is based on your Consent, you have the right to withdraw your Consent at any time. Withdrawal of Consent will not affect the lawfulness of processing carried out prior to such withdrawal. To withdraw Consent, please contact us at customerservice@anchorwealth.ai or use the opt-out mechanism available in your Account settings. Please note that withdrawal of Consent may affect our ability to provide you with certain Services.

11.4 Right to Grievance Redressal

You have the right to have your grievances addressed by our Grievance Officer within a reasonable timeframe (see Clause 16 for details). If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India (DPBI) established under the DPDPA 2023.

11.5 Right of Nomination

You have the right to nominate another individual to exercise your rights under the DPDPA 2023 on your behalf in the event of your death or incapacity. To register a nominee, please contact our Data Protection Officer.

11.6 How to Exercise Your Rights

To exercise any of the above rights, please submit a written request to:

Data Protection Officer
AnchorWealth Technologies LLP
Email: customerservice@anchorwealth.ai
Address: 18, floor-3, plot-319, mitha mansion, ballard estate, mumbai g.p.o., maharashtra, india, 400001.
Response Time: We will acknowledge your request within 3 (three) business days and respond fully within 30 (thirty) days.

12. CHILDREN’S PRIVACY

The Platform is not directed at or intended for use by individuals under the age of 18 (eighteen) years. AnchorWealth does not knowingly collect Personal Data from minors. If you are a parent or guardian and believe that your child has provided Personal Data to us without your consent, please contact us immediately at customerservice@anchorwealth.ai, and we will take prompt steps to delete such data from our systems.

13. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, applications, or services, including fund house websites, research platforms, payment gateways, and regulatory portals. AnchorWealth is not responsible for the privacy practices, data protection standards, or content of such third-party sites. AnchorWealth’s Privacy Policy applies only to data collected by AnchorWealth through the Platform.

14. AI-SPECIFIC DATA PROCESSING DISCLOSURES

In compliance with emerging best practices for AI transparency and the spirit of the DPDPA 2023, AnchorWealth makes the following specific disclosures regarding the processing of your Personal Data by our AI Engine:

14.1 How the AI Engine Uses Your Data

• The AI Engine uses your risk profile, investment horizon, income information, and portfolio preferences to generate fund selection suggestions and portfolio allocation insights.
• Your Platform usage behaviour, including navigation patterns and interaction with portfolio tools, is used to refine and improve the accuracy of the AI outputs.
• Your historical transaction data on the Platform is used to assess portfolio performance and generate rebalancing alerts.

14.2 Automated Decision-Making

The AI Engine engages in automated processing, including profiling, to generate fund suggestions and portfolio insights. These outputs are informational tools only and do not constitute investment advice. All final investment decisions remain entirely within your control. AnchorWealth does not make legally significant automated decisions about you without human oversight.

14.3 Model Training Data

AnchorWealth may use anonymised and aggregated usage data to train and improve AI models. This process does not involve the use of identifiable Personal Data. No identifiable information about any individual User is used to train AI models accessible by or shared with third parties.

14.4 Right to Human Review

If you believe that an AI-generated output has resulted in a decision that adversely affects your interests, you have the right to request a human review. Please contact us at customerservice@anchorwealth.ai to make such a request.

15. MARKETING COMMUNICATIONS AND OPT-OUT

With your consent, we may use your contact information to send you market insights, fund performance reports, investment alerts, promotional offers, new product announcements, educational content, and survey invitations.

You can opt out of marketing communications at any time by:

• clicking the “Unsubscribe” link in any marketing email;
• updating your communication preferences in your Account settings; or
• contacting us at customerservice@anchorwealth.ai

Please note that opting out of marketing communications will not affect service-related communications, which we are required to send to you as part of the Services (e.g., transaction confirmations, regulatory disclosures, and account alerts).

16. GRIEVANCE REDRESSAL AND DATA PROTECTION OFFICER

16.1 Data Protection Officer

AnchorWealth has appointed a Data Protection Officer (DPO) in accordance with the DPDPA 2023. The DPO is responsible for overseeing AnchorWealth’s data protection compliance and serves as the primary point of contact for data-related queries and complaints.

Data Protection Officer
Email: customerservice@anchorwealth.ai
Phone: +91 74000 15078
Address: 18, floor-3, plot-319, mitha mansion, ballard estate, mumbai g.p.o., maharashtra, india, 400001.

16.2 Grievance Officer

In addition to the DPO, AnchorWealth has designated a Grievance Officer under the IT Act, 2000 and AMFI guidelines.

Grievance Officer
Email: customerservice@anchorwealth.ai
Phone: +91 74000 15078
Response Time: Acknowledgement within 48 hours; resolution within 30 days.

16.3 Escalation to Data Protection Board of India

If you are not satisfied with the response of the DPO or Grievance Officer, you may file a complaint with the Data Protection Board of India (DPBI) established under Section 18 of the DPDPA 2023.

17. AMENDMENTS TO THIS PRIVACY POLICY

AnchorWealth reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, the Services, or Applicable Law. Any material changes will be communicated to you by sending an email notification to your registered email address or displaying a prominent notice on the Platform at least 15 (fifteen) days prior to the effective date of the change.

Your continued use of the Platform after the effective date of any amendment shall constitute your acceptance of the revised Privacy Policy.

18. GOVERNING LAW

This Privacy Policy is governed by and shall be construed in accordance with the laws of the Republic of India, including the DPDPA 2023, the IT Act 2000, the SPDI Rules, and all other Applicable Laws. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts at Mumbai, India, and to the Data Protection Board of India in respect of matters within its statutory jurisdiction.

19. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact us through any of the following channels:

AnchorWealth Technologies LLP
Email: customerservice@anchorwealth.ai
Contact No.: +91 74000 15078
Website: www.anchorwealth.ai