Privacy Policy

KYC and onboarding verification through SEBI-registered KRAs and related compliance processes. Transaction processing for purchases, redemptions, switches, SIP instructions, and payment handling. Regulatory reporting and compliance support for AMFI, SEBI, FIU-IND, tax, and other lawful obligations.

Fraud prevention, identity checks, suspicious-activity detection, and platform security controls. Platform improvement using usage insights and service-quality analysis. Operational communications such as account alerts, SIP reminders, portfolio updates, and investor education messages.

Marketing communications only where explicit consent is provided, with opt-out controls available.

The policy references the Digital Personal Data Protection Act, 2023, along with related legal and regulatory obligations.

Explicit consent provided at registration, onboarding, or transaction stages. Contract performance for investment-account servicing and transaction execution. Legal obligations under SEBI, PMLA, Income Tax Act, AMFI, and related frameworks.

Legitimate interests connected to fraud prevention, service integrity, and information security.

Data is stated to be shared only on a need-to-know basis with limited categories of service and regulatory participants.

AMCs and RTAs for order processing and folio maintenance. KYC agencies for verification and CKYCRR-related registration workflows. Payment gateways for debits, settlements, and redemption-credit flows.

BSE or NSE transaction platforms for routing flows such as StarMF or NMF. SEBI, AMFI, FIU, and other authorities where statutory reporting or AML compliance applies. IT and cloud providers operating under service and data-protection arrangements.

The policy states that personal data is not sold, rented, or traded to third parties for commercial purposes.

The policy states that account data may be retained while the account remains active and for defined periods after closure where legal obligations continue.

KYC and identity documents: 8 years after account closure. Transaction records: 8 years, aligned to stated PMLA retention expectations. Communication logs: 3 years.

Technical and device logs: 90 days. Marketing-preference records: until opt-out or deletion, subject to applicable obligations.

AES-256 encryption at rest and TLS 1.2 or higher in transit. Multi-factor authentication for accounts. Regular penetration testing and vulnerability assessments.

ISO 27001-aligned information-security management controls. Role-based access control for internal data access. Breach-notification handling aligned to DPDPA 2023 requirements.

The policy lists core rights and notes that requests may be sent to privacy@ramaniya.com, with a stated response window of 30 days.

Access: request a summary of personal data held and related processing activities. Correction: request correction of inaccurate or incomplete data. Erasure: request deletion, subject to applicable legal-retention obligations.

Grievance redressal: raise a complaint with the Data Protection Officer or the Data Protection Board. Nomination: nominate a representative in case of death or incapacity. Consent withdrawal: withdraw optional or marketing consent through account controls where available.

Essential cookies support login, security tokens, and transaction continuity and are described as required for service operation. Analytics cookies may be used to improve the platform and may be controlled through browser settings where applicable. Marketing cookies require consent and may be opted out where provided.

The platform is described as not intended for persons under 18 years of age.

The policy states that data from minors is not knowingly collected and may be deleted if such collection is identified.

The policy states that data is primarily stored on servers within India.

Where cross-border transfers become necessary, they are described as being handled with safeguards under DPDPA 2023, including contractual and adequacy-based controls where applicable.

Data Protection Officer: to be appointed per DPDPA 2023. Privacy email: privacy@ramaniya.com. Grievance email: grievance@ramaniya.com.

Address listed in the policy: Ramaniya Financial Services Pvt. Ltd., [Registered Address], New Delhi - 110019. Stated response time: within 30 days of receipt. Escalation references listed in the policy include the Data Protection Board of India and SEBI SCORES if a complaint remains unresolved after 30 days.

The policy states that Ramaniya may update the Privacy Policy from time to time, with material changes intended to be notified by email or platform notification at least 7 days before taking effect.

Continued use of the platform after policy updates is described as acceptance of the revised policy.

The current document references compliance with the Digital Personal Data Protection Act 2023, IT Act 2000, SEBI KYC Master Circular, PMLA 2002, and applicable AMFI guidelines, with a last review noted for April 2026.