Privacy Policy
PRIVACY POLICY
Personal Data Protection Notice
This Privacy Policy ("Policy") describes how Aarya Consultants ("Company", "we", "us" or "our"), a company incorporated under the Companies Act, 2013, having its registered office at 73C, Shyama Prasad Mukherjee Road, Kolkata - 700026, India, collects, uses, processes, stores, discloses and protects personal data of individuals ("Data Principals", "you" or "your") in connection with the use of our website [Website URL] (the "Website") and the services we provide.
This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and the Rules framed thereunder (including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended), and other applicable laws of India. By accessing the Website or providing personal data to us, you acknowledge that you have read and understood this Policy.
We act as a Data Fiduciary in respect of personal data processed by us. Where we engage third parties to process personal data on our behalf, such parties act as Data Processors under appropriate contractual arrangements. The DPDP Act and DPDP Rules are being implemented in a phased manner; core obligations of Data Fiduciaries become fully enforceable in accordance with the enforcement notifications issued by the Ministry of Electronics and Information Technology (presently scheduled for May 2027). We are aligning our practices with the DPDP framework during the transition period.
1. Personal Data We Collect
1.1 We may collect the following categories of personal data, depending on the nature of your interaction with us:
Identity and Contact Data
Full name, date of birth, gender, nationality, PAN, Aadhaar number (where permitted and necessary under applicable law), passport details, photographs and signatures;
Residential and correspondence address, email address, mobile number and alternate contact details.
Financial and Professional Data
Bank account details, demat account details, income details, tax returns, investment portfolio information, net worth statements and source of funds information;
Employment details, designation, employer name and professional qualifications.
KYC and Regulatory Data
Documents and information collected for Know Your Customer (KYC), Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) purposes as mandated by SEBI, RBI or other regulators;
Risk profile information and investment objectives.
Technical and Usage Data
IP address, browser type and version, device identifiers, operating system, referral source, pages visited, time spent on pages and other diagnostic data collected through cookies and similar technologies.
Communication Data
Records of correspondence, enquiry forms, feedback, complaints and call recordings (where applicable and with notice).
1.2 We do not knowingly collect personal data of children (individuals below the age of 18 years) without verifiable parental consent, except where permitted under the DPDP Act for legitimate purposes. Processing of personal data of children shall be in accordance with Section 9 of the DPDP Act and the applicable Rules.
2. Purpose of Processing
2.1 We process personal data only for lawful purposes, which include:
providing and managing the services requested by you, including wealth management, taxation, compliance, trust and estate planning and audit services;
onboarding clients, conducting KYC/AML checks and complying with regulatory obligations under SEBI, RBI, the Income Tax Act, 1961, the Prevention of Money Laundering Act, 2002 and other applicable laws;
responding to enquiries, providing information about our services and managing client relationships;
processing payments and maintaining financial records;
improving the Website, analysing usage patterns and enhancing user experience;
sending service-related communications, updates and, where consent has been obtained, marketing communications (with an option to opt out at any time);
detecting, preventing and investigating fraud, security incidents or other illegal activities;
complying with legal obligations, responding to lawful requests from courts, regulators or law enforcement agencies; and
establishing, exercising or defending legal claims.
2.2 We process personal data on the basis of: (a) your free, specific, informed, unconditional and unambiguous consent given through clear affirmative action; (b) performance of a contract with you; (c) compliance with a legal obligation; or (d) certain legitimate uses as permitted under Section 7 of the DPDP Act.
3. Notice and Consent
3.1 Before or at the time of collecting personal data on the basis of consent, we provide a clear notice in plain language specifying the personal data to be collected, the purpose of processing, the rights available to you and the manner of exercising those rights, and the manner of making a complaint to the Data Protection Board of India, in accordance with Section 5 of the DPDP Act and the DPDP Rules. Where practicable, the notice will be made available in English and, upon request, in any of the languages listed in the Eighth Schedule to the Constitution of India.
3.2 Consent is obtained through clear affirmative action (such as ticking a checkbox or clicking an "I Agree" button) and is not bundled with acceptance of terms for unrelated purposes. You may withdraw consent at any time by contacting the Grievance Officer or Data Protection contact, subject to any legal or contractual restrictions. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
3.3 Where processing is based on legitimate uses under the DPDP Act (for example, employment-related processing or medical emergencies), consent may not be required, but we will still adhere to the principles of purpose limitation and data minimisation.
3.4 You may, where available, manage consents through a Consent Manager registered with the Data Protection Board of India in accordance with the DPDP Rules.
4. Sharing and Disclosure of Personal Data
4.1 We do not sell personal data. We may share personal data with:
our employees, directors and authorised personnel who require access for the purposes described in this Policy, on a need-to-know basis;
affiliates and group companies, subject to appropriate safeguards;
service providers and Data Processors (including IT service providers, cloud hosting providers, payment processors, KYC agencies and professional advisors) under written contracts that impose confidentiality and data protection obligations consistent with the DPDP Act;
regulators, courts, law enforcement agencies or other governmental authorities when required by law or in response to a valid legal process;
professional advisors such as lawyers, auditors and consultants, under confidentiality obligations; and
third parties in connection with a merger, acquisition, reorganisation or sale of assets, subject to appropriate protections.
4.2 Cross-border transfers of personal data are permitted under the DPDP Act unless the Central Government notifies a country or territory as restricted. As of the date of this Policy, no country is on the negative list. Where sectoral regulations (such as those of SEBI or RBI) impose localisation or additional restrictions (including in respect of payment system data), we comply with those requirements.
5. Data Retention
5.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligations. Typical retention periods include:
client records and transaction data: as required under the Companies Act, 2013, the Income Tax Act, 1961, SEBI regulations and the Prevention of Money Laundering Act, 2002 (generally eight years or more from the end of the relevant financial year or cessation of relationship);
KYC documents: as prescribed by the relevant regulator;
Website usage logs and technical data: typically up to twenty-four (24) months, unless required longer for security or legal purposes; associated logs may be retained for a minimum of one (1) year as may be prescribed under the DPDP Rules;
marketing preferences: until consent is withdrawn or the purpose is fulfilled.
5.2 Upon expiry of the retention period, personal data is securely deleted, anonymised or archived in accordance with our data retention and destruction policy, subject to any legal hold or ongoing proceedings.
6. Your Rights as a Data Principal
6.1 Under the DPDP Act, you have the following rights (subject to applicable exceptions and conditions):
Right to Access: You may request a summary of the personal data being processed about you and the processing activities.
Right to Correction and Erasure: You may request correction of inaccurate or incomplete personal data, and erasure of personal data that is no longer necessary for the purpose for which it was processed, subject to legal retention requirements.
Right of Grievance Redressal: You may raise a grievance with our Grievance Officer. If unsatisfied, you may escalate the matter to the Data Protection Board of India after exhausting the internal mechanism.
Right to Nominate: You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
6.2 To exercise any of these rights, please contact the Grievance Officer using the details provided in Section 10. We will respond within the timelines prescribed under the DPDP Act and Rules (presently referenced as up to ninety (90) days for grievance resolution).
7. Security Safeguards
7.1 We implement reasonable security safeguards to protect personal data against unauthorised access, alteration, disclosure, destruction or loss, consistent with Section 8 of the DPDP Act and Rule requirements on reasonable security safeguards. These measures include, as appropriate:
encryption or tokenisation of personal data in storage and transmission;
access controls and authentication mechanisms;
regular security assessments and vulnerability management;
employee training on data protection and confidentiality;
incident response and breach notification procedures; and
physical and environmental security controls at our premises.
7.2 In the event of a personal data breach, we will take prompt remedial action. We will intimate the Data Protection Board of India and affected Data Principals in accordance with the DPDP Act and Rules (including intimation to the Board within seventy-two (72) hours of becoming aware of the breach, and to Data Principals without delay, as prescribed).
8. Cookies and Tracking Technologies
8.1 The Website may use cookies, web beacons and similar technologies to enhance functionality, analyse usage and personalise content. Cookies may be session cookies (temporary) or persistent cookies.
8.2 You may control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Website. Where required, we obtain consent for non-essential cookies.
9. Third-Party Websites
The Website may contain links to third-party websites. This Policy does not apply to such third-party websites. We encourage you to review the privacy policies of any third-party sites you visit. The Company is not responsible for the privacy practices or content of third-party websites.
10. Grievance Officer and Contact Details
In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended), the following person has been designated as the Grievance Officer:
Name: Aarya Gupta
Designation: Grievance Officer
Email: [email protected]
Postal Address: 73C, Shyama Prasad Mukherjee Road, Kolkata - 700026, India
Telephone: +91-6290 716658
You may also write to us at the registered office address for any privacy-related queries. We endeavour to acknowledge grievances within twenty-four (24) hours and resolve them within the prescribed period under applicable law.
11. Changes to this Privacy Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The updated Policy will be posted on the Website with a revised "Last Updated" date. Material changes will be communicated through appropriate means. Continued use of the Website after such changes constitutes acceptance of the revised Policy.
12. Governing Law
This Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at [City], India, subject to the dispute resolution mechanisms available under the DPDP Act (including escalation to the Data Protection Board of India).
If you have any questions or concerns about this Privacy Policy or our data practices, please contact the Grievance Officer using the details provided above.