Privacy Policy

Version 1.0 · Effective 11 June 2026

This Privacy Policy explains how Sanjay Raj Mukundan, an AMFI-registered Mutual Fund Distributor (ARN-254257) operating the “Vault.” client portal (the “Platform”, “we”, “us”), collects, uses, shares and protects your personal data. We act as a Data Fiduciaryunder the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and follow the Information Technology (Reasonable Security Practices) Rules, 2011.

1. Information we collect

Identity & KYC

PAN, full name, date of birth, gender, occupation
Email address, mobile number, residential address (city, state, PIN)
Bank account number, IFSC and account type
FATCA declarations (including place of birth and tax-residency information)
Nominee details, where you provide them
NSE identifiers (IIN / Unique Client Code) and KYC status

Financial & transactional

Folios, scheme holdings, units, invested and current values
Purchase, redemption, switch and SIP transaction history
Mandate details (bank name, last 4 digits of the account, limit)
Consolidated Account Statement (CAS) data you choose to upload

Technical

IP address, device and browser (user-agent), login timestamps and audit logs

2. How and why we use your data

KYC & onboarding — to register you and meet PMLA/SEBI obligations (legal obligation + your consent).
Executing your instructions — purchases, redemptions, switches, SIPs and mandates (performance of our agreement with you).
Statements & reporting — to show your portfolio and generate statements.
Compliance — anti-money-laundering and regulatory reporting (legal obligation).
Communication — login OTPs and transaction confirmations.

We do not sell your personal data, and we do not use it for advertising.

3. Who we share it with

We share data only as needed to provide the service or meet legal obligations:

NSE MF Invest (NSEIL) — to route your orders, register your UCC, and submit KYC/FATCA/mandate data. NSE is our primary execution intermediary.
AMCs and their Registrars (CAMS, KFintech) — to process and service your investments.
KRA / CKYC registries — to verify and maintain KYC.
Email provider (Resend) — to deliver OTPs and confirmations.
Infrastructure providers — DigitalOcean (hosting, Bangalore, India), Cloudflare (security/CDN), Vercel (website delivery).
Operational alerting (Telegram) — limited transaction metadata (scheme, amount, reference) with no PAN or name, for our internal monitoring.

4. Where your data is stored (data residency)

Your personal data is stored at rest in India (Bangalore). Certain service providers used for email delivery, security/content delivery and operational alerting may process limited data on servers outside India; such transfers are made only as permitted under the DPDP Act.

5. How we protect your data

Sensitive fields (PAN, name, email, mobile, address, bank account) are encrypted at rest.
All traffic is encrypted in transit over TLS, with strict transport security headers.
Access requires email-OTP login and short-lived session tokens.
We maintain audit logs and take daily encrypted database backups.

6. How long we keep it

We retain your records for as long as your relationship with us is active and thereafter for the period required by SEBI and the PMLA (generally at least five years after the relationship or transaction), after which data is deleted or anonymised.

7. Your rights

Under the DPDP Act you may:

Access a summary of the personal data we hold about you;
Correct or update inaccurate or incomplete data;
Request erasure, subject to our legal retention obligations;
Withdraw consent at any time (as easily as it was given); and
Raise a grievance with our Grievance Officer (Section 9).

To exercise any right, email support@marketgurumalayalam.in. Note that withdrawing consent for KYC/transaction data may prevent us from servicing your investments.

8. Cookies & similar technologies

We use only essential cookies and local storage needed to keep you securely logged in. We do not use third-party advertising or tracking cookies.

9. Children

Investments for minors are operated by a guardian. We process a minor’s data only on the basis of verifiable consent from their parent or lawful guardian.

10. Grievance Officer

For privacy questions, requests or complaints:

Sanjay Raj Mukundan, Grievance Officer
Email: support@marketgurumalayalam.in
Phone: +91 90375 24075
Kozhikode, Kerala, India

We acknowledge grievances promptly and aim to resolve them within the timelines prescribed under applicable law.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the Platform and the version number above will change; continued use after an update, or re-acceptance where requested, constitutes acknowledgement.