गोपनीयता नीति

Who we are

SIP to Retire (formerly SIPDhara) is run by Sanjay Singh Kushwaha, an AMFI-registered Mutual Fund Distributor (ARN-364557) ("we", "us"). For the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules, we are the Data Fiduciary: we decide why and how your personal data is processed.

This policy is our notice to you under the DPDP Act, and our privacy policy under the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). Contact: contact@siptoretire.com.

What this policy covers

It covers personal data we process through the SIP to Retire website and any future domain or app, our email, SMS and WhatsApp channels, phone calls, and our work as your mutual fund distributor. It does not cover services run by others, such as WhatsApp, Google, AMCs or transaction platforms, which have their own policies.

Personal data we collect

We collect only what we need for the purpose. Some items apply only once you use a feature or invest through us.

Financial information (such as bank account details) is sensitive personal data under the SPDI Rules, and we protect it accordingly. If you give us data about another person (for example a nominee, joint holder or minor), please make sure you are allowed to do so and that they know about this policy.

What we do not collect

• Full Aadhaar numbers: masked Aadhaar only, and we do not perform Aadhaar authentication ourselves.
• Passwords: sign-in uses one-time email codes or Google; we never see or store a password.
• OTPs, UPI PINs, card numbers, CVVs or logins of investment platforms.
• Your CAS statement: it is read in your browser and never uploaded (see section 8).
• Biometrics, and data about health, religion, caste or politics.

Why we use it, and on what basis

We do not sell or rent personal data, we do not use it for advertising networks, and we do not build profiles to show you ads.

Notice, consent and withdrawal

• How you consent. Our forms do not use tick-boxes. Each form shows a short notice, "By sending, you agree to our Terms and Privacy Policy", with links to this page. By choosing to send the form, sign in, upload a document or message us, you give consent for the purpose of that action, as described here. Your consent is recorded with the time it was given.
• Withdrawing consent is as easy as giving it: use the unsubscribe link, reply STOP, delete your account or saved items, or email contact@siptoretire.com. We then stop the processing, except where the law requires us to keep data (see section 11). Withdrawal does not affect processing already done, and we may not be able to help with an investment request without the data it needs.
• Consent managers. When consent managers registered with the Data Protection Board become available, you may also manage your consent through one.

Documents, PAN and masked Aadhaar

• Why: only to help complete KYC, account updates or transactions that you ask for.
• Masked Aadhaar only: as required by the Aadhaar Act, 2016 (section 29) and its regulations, share Aadhaar only with the first eight digits hidden. If a full Aadhaar number reaches us, we will mask it or delete the copy and ask you for a masked one.
• Where KYC happens: KYC is completed on the systems of KYC Registration Agencies, the Central KYC Registry, AMCs, MF Utilities or BSE StAR MF. We send documents only to the platform that needs them for your request.
• Protection: uploads travel over encrypted connections, are stored encrypted, are not publicly accessible, and open only through short-lived signed links.
• Who sees them: only the distributor and any named staff or sub-distributor who services you, bound by confidentiality, on a need-to-know basis; access is logged.
• How long: until the KYC or transaction is complete, and then deleted within 90 days, unless the law requires us to keep a copy as a record (see section 11). You can ask us to delete them sooner.

Portfolio analysis stays on your device

The Portfolio X-Ray reads your Consolidated Account Statement (CAS) PDF inside your browser. The file, its password, your PAN, name and transactions are not uploaded to us. Only public fund data is downloaded to compare returns. If you are signed in and choose to save a snapshot, we store only an anonymised list of holdings (scheme, units and cost, without PAN, name, email or folio numbers), which you can delete at any time.

Who we share data with

We share personal data only as needed for the purposes above, with:

Data Processors act only on our instructions, under contracts that require security and confidentiality.

Where data is stored and transfers

• Email sending by Azure Communication Services is configured with its data location in India.
• Our sign-in directory (Microsoft Entra External ID) is set up with India as its country, and Microsoft keeps its data in its Asia Pacific data centres.
• Cloudflare serves the site from its global network, so requests may be handled at the data centre nearest to you, which may be outside India. Our application data is held in Cloudflare's database and storage services.
• Under section 16 of the DPDP Act, personal data may be transferred outside India except to countries the Government restricts. Where we or our processors transfer data abroad, we do so under contracts and safeguards, and we will follow any data localisation requirement of SEBI or other law for records that must be kept in India.

Data retention and security

How long we keep data

When a purpose is served and no law requires us to keep data, we erase it or make it anonymous. Where the DPDP Rules require, we will tell you at least 48 hours before erasing data because you have been inactive, so you can log in or ask us to keep it.

How we protect it

• Encrypted connections (HTTPS/TLS) everywhere, and encryption of stored data and backups.
• Sign-in through Microsoft Entra External ID; secure, HTTP-only, signed session cookies; no passwords stored.
• Access only for people who need it, with multi-factor authentication on administrative accounts, and logs of access to personal data.
• Protection against abuse: Cloudflare's network security, the Turnstile human check, rate limits and input validation.
• Service providers chosen for their security certifications (such as ISO/IEC 27001 and SOC 2), under contract.
• Practices modelled on IS/ISO/IEC 27001, as recognised by the SPDI Rules, and the security safeguards in the DPDP Rules, reviewed regularly.

No system is perfectly secure. Please keep your email account and devices safe and tell us at once if you notice anything suspicious.

If a breach happens

If a personal data breach affects you, we will tell you without delay, in plain language: what happened and when, the likely consequences, what we are doing about it, what you can do to protect yourself, and whom to contact. We will report it to the Data Protection Board of India as the DPDP Rules require (including a detailed report within 72 hours of becoming aware), and report cyber security incidents to CERT-In within 6 hours as its directions require.

Messages, alerts and marketing

• Service messages (replies, sign-in codes, alerts you set, transaction and KYC updates) are sent because you asked for them.
• Newsletters, market updates, SIP reminders and offers by email, SMS, WhatsApp or push are sent only if you asked for them or the law allows. Every message tells you how to stop it: an unsubscribe link, STOP reply, or your account settings.
• Email is sent through Azure Communication Services. We record delivery status, not whether you open emails.

AI-assisted features

If we offer AI features (such as summaries or a chat assistant), the text you enter is processed to answer you, by us or a processor under contract that does not use it to train its models. We do not make decisions with legal or similar effect about you by automated means alone. Do not enter identity numbers, passwords or OTPs in AI features.

Cookies, local storage and analytics

We use only cookies and browser storage that are needed to run the Service and remember your choices: a sign-in session, sign-in security, your theme, number format and currency, and the Turnstile human check. There are no advertising or cross-site tracking cookies. We use no analytics that track you; at most, privacy-friendly aggregate visit counts without cookies (such as Cloudflare Web Analytics). The Cookie Policy lists each item, and we update it before anything changes.

Your rights

Under the DPDP Act and the SPDI Rules you can:

• Access: get a summary of your personal data we process, the processing, and whom we shared it with.
• Correct, complete and update inaccurate or incomplete data.
• Erase data that is no longer needed, unless the law requires us to keep it.
• Withdraw consent at any time (see section 6).
• Nominate another person to exercise your rights if you die or become incapable.
• Grievance redressal, and then a complaint to the Data Protection Board of India.

Write to contact@siptoretire.com, or use your account page to delete saved items or the account. We may ask you to verify your identity. We respond within 30 days, and in any case within the 90 days allowed by the DPDP Rules. Rights are free of charge.

Children and persons with disability

The Service is meant for adults. A child (a person under 18) can invest only through a parent or lawful guardian. We process a child's personal data only with the verifiable consent of the parent or guardian, as the DPDP Act (section 9) and DPDP Rules require, and only for the child's investments. We do not track, monitor the behaviour of, or target advertising at children. For a person with a disability who cannot decide for themselves, we act on the verifiable consent of their lawful guardian.

NRIs and investors abroad

If you live outside India, we also collect information needed under FEMA and for FATCA/CRS tax reporting, which AMCs and registrars report to Indian tax authorities, who may share it with other countries under tax treaties. If the law of your country gives you further privacy rights, write to us and we will honour them where they apply.

Third-party sites and news

News headlines and many pages link to other sites (regulators, exchanges, AMCs, YouTube). When you follow a link, that site's own privacy policy applies. We do not embed advertising or social-media trackers.

Change of brand, domain or owner

If SIP to Retire changes its name or domain, or the business is transferred (for example to a company formed by the distributor, or in a merger or sale), your personal data may move to the new operator, who must continue to protect it under this policy. We will tell you before that happens.

Changes to this policy

We will update this policy when our services, our providers or the law change. The version and date appear at the top. We will announce material changes on the Service and, if you have an account, by email, at least 15 days before they take effect, and ask for fresh consent where the law requires.

Grievance officer and Data Protection Board

Grievance officer

Sanjay Singh Kushwaha

Email

sanjayskushwaha@gmail.com

Phone

+91 99496 84000

We acknowledge complaints within 2 working days and aim to resolve them within 15 days, and in any case within 30 days (and never later than the 90 days the DPDP Rules allow). If you are not satisfied, you can complain to the Data Protection Board of India through its online platform, after using our grievance process. For complaints about mutual fund distribution, see the escalation routes in our Terms (AMC, AMFI, SEBI SCORES, Online Dispute Resolution).