1. Introduction
1.1 ERRITARA WEALTH ("ERRITARA WEALTH", "we", "us", "our"), having its registered office at [Full Address], India, is an AMFI-registered Mutual Fund Distributor ARN:354877 and an IRDAI-registered insurance intermediary ABLIC1003411114,CTH1132161
1.2 We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use, share, store and protect it, and the rights and choices available to you.
1.3 This Policy applies to our website [www.erritarawealth.com], mobile application, social media pages, call centres, WhatsApp/email/SMS communications and all offline interactions through which we provide our services (together, the "Services").
1.4 This Policy should be read together with our Terms and Conditions. By using our Services, submitting your information or completing onboarding, you confirm that you have read this Policy and consent to the practices described in it.
1.5 For the purpose of applicable data protection laws, ERRITARA WEALTH acts as the Data Fiduciary / body corporate in respect of the personal data you provide to us.
2. Legal Framework
We process personal data in accordance with applicable Indian laws, including:
- The Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
- The Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act"), as and when their provisions come into force and apply to us;
- The Prevention of Money Laundering Act, 2002 and related rules;
- SEBI regulations, circulars and AMFI guidelines applicable to mutual fund distributors, including KYC and record-keeping requirements;
- The Insurance Act, 1938, IRDAI regulations and guidelines applicable to insurance intermediaries, including those on protection of policyholders' interests and information security;
- CERT-In directions on cyber security and incident reporting; and
- The Aadhaar Act, 2016 and related regulations, where Aadhaar-based verification is used.
3. Information We Collect
3.1 Information you provide to us
| Category | Examples |
|---|---|
| Identity and contact details | Name, date of birth, gender, photograph, signature, mobile number, email address, residential and correspondence address, father's/mother's/spouse's name |
| KYC and regulatory documents | PAN, Aadhaar (or masked Aadhaar / Virtual ID / e-KYC), passport, voter ID, driving licence, proof of address, CKYC number, IPV/video KYC records, FATCA/CRS declarations, tax residency and country of birth |
| Financial information | Bank account details, cancelled cheque, income range, occupation, source of wealth/funds, net worth, existing investments and policies, investment goals, risk profile, mandate (SIP/NACH/UPI AutoPay) details, folio numbers, transaction history |
| Insurance information | Proposal form details, nominee and beneficiary details, family details, policy numbers, premium and claim history, and sensitive information such as medical history, health condition, lifestyle habits and disability, required by insurers for underwriting and claims |
| Nominee and family details | Name, relationship, date of birth, address, and where applicable guardian details of minors |
| Communications | Emails, chats, call recordings, feedback, complaints, survey responses |
3.2 Information collected automatically
- Device and technical data: IP address, device type, operating system, browser type, unique device identifiers, mobile network, time zone, screen resolution.
- Usage data: pages visited, features used, clicks, time spent, referring URLs, crash logs.
- Approximate location (derived from IP) and, with your permission, device location for fraud prevention.
- Data collected through cookies, pixels, SDKs and similar technologies (see Section 12).
3.3 Information from third parties
We may receive information about you from: AMCs, Registrars and Transfer Agents (CAMS, KFintech), insurers, TPAs, KYC Registration Agencies (KRAs), CKYC registry, depositories (NSDL/CDSL), banks and payment gateways, credit bureaus (where permitted), government databases (e.g., PAN verification, DigiLocker, UIDAI authentication) and publicly available sources, and from referrals, partners and employers (where you have been introduced through them).
3.4 Sensitive personal data
Under the SPDI Rules, sensitive personal data includes passwords, financial information (such as bank account or payment instrument details), physical, physiological and mental health condition, medical records and history, and biometric information. We collect such information only with your consent, and only where necessary for providing the Services (for example, health insurance proposals or financial account verification).
3.5 Children's data
Our Services are intended for adults. Where an investment or policy is made for a minor, we collect the minor's data only through a parent or lawful guardian, and with verifiable parental/guardian consent. We do not knowingly track or target minors for advertising or behavioural monitoring.
4. Purposes and Legal Basis for Processing
We process your data on the basis of your consent, to perform our contract/services with you, to comply with legal obligations, and for other legitimate uses permitted by law. The purposes include:
- Onboarding and identity verification: completing KYC, FATCA/CRS, PAN/Aadhaar validation, IPV, creating folios and policies.
- Providing the Services: executing purchase, redemption, switch, SIP/STP/SWP transactions; submitting insurance proposals; renewals, endorsements and claims assistance.
- Suitability and guidance: understanding your goals, risk profile and needs, and recommending relevant products.
- Communication: sending transaction confirmations, statements, NAV updates, policy renewal and premium reminders, regulatory notices and service updates.
- Compliance: meeting obligations under PMLA, SEBI, AMFI, IRDAI, tax and other laws; responding to legal requests, audits and inspections.
- Fraud prevention and security: detecting and preventing fraud, unauthorised access, money laundering and misuse of our platforms.
- Service improvement: analytics, research, product development, customer support quality and training (including call recording).
- Marketing: with your consent, informing you of products, offers, market insights and events. You can opt out at any time.
- Grievance handling and dispute resolution.
- Business operations: internal record-keeping, risk management, audit, corporate restructuring, and enforcement of our legal rights.
We will not use your data for purposes materially different from those stated above without notifying you and, where required, obtaining fresh consent.
5. Consent
5.1 By providing your information, you consent to its collection and use as described in this Policy. Consent is given through a clear affirmative action such as ticking a box, submitting a form, providing an OTP, or continuing to use the Services after notice.
5.2 For specific purposes (such as marketing, WhatsApp communication or sharing sensitive data for a particular product) we may seek separate, specific consent.
5.3 You may withdraw consent at any time by writing to us at the contact details in Section 17. Withdrawal will not affect the lawfulness of processing done before withdrawal. Withdrawal may mean we can no longer provide certain Services, and we may continue to retain and process data where required by law.
5.4 If you provide us with personal data of another person (such as a nominee, family member or co-applicant), you confirm that you are authorised to do so and have obtained that person's consent.
6. Sharing and Disclosure of Information
We do not sell your personal data. We share it only as described below, and only to the extent necessary:
| Recipient | Purpose |
|---|---|
| AMCs, RTAs, mutual funds | Processing investments, folio creation and servicing |
| Insurers, TPAs, reinsurers, surveyors | Underwriting, policy issuance, servicing and claims |
| KRAs, CKYC registry, UIDAI-authorised agencies, DigiLocker, depositories | KYC, e-sign, identity verification |
| Banks, payment gateways, NPCI, clearing agencies | Payments, mandates, collections and refunds |
| Technology and service providers | Cloud hosting, software, analytics, communication (SMS, email, WhatsApp), customer support, document storage, security , bound by confidentiality and data protection obligations |
| Professional advisers | Auditors, lawyers, compliance consultants, and insurers' and regulators' auditors |
| Regulators, government and law enforcement | SEBI, AMFI, IRDAI, RBI, FIU-IND, tax authorities, courts, police and other authorities when required by law, regulation, court order or to protect rights and safety |
| Business transferees | In case of merger, acquisition, restructuring or sale of business, subject to continued protection of your data |
| Other persons with your consent | Any other party to whom you ask or authorise us to disclose your data |
Third parties who receive your data are bound by their own privacy policies and legal obligations. We are not responsible for how they handle data once it is under their control.
7. Cross-Border Transfers
Your data is primarily stored and processed in India. Some of our service providers (for example, cloud or communication platforms) may process data outside India. Where this occurs, we will ensure that the transfer complies with applicable law (including any restrictions notified by the Government of India) and that the recipient provides a comparable level of protection through contractual and security safeguards.
8. Data Retention
8.1 We retain your data only as long as necessary for the purposes for which it was collected, and to comply with legal, regulatory, accounting, audit and dispute-resolution requirements.
8.2 Indicative retention periods (subject to change as regulations change):
| Data | Retention |
|---|---|
| KYC and transaction records | At least 5 years after the end of the business relationship or transaction, or such longer period required under PMLA, SEBI, AMFI or other rules |
| Mutual fund distribution records | As required by SEBI/AMFI guidelines (generally up to 8 years) |
| Insurance proposals, policy and claim records | As required by IRDAI regulations and the insurer (generally the policy term plus the period prescribed by law) |
| Call recordings and communications | As per our internal policy and regulatory requirements |
| Website/analytics logs | As per technical and security needs, generally not exceeding [24] months |
| Marketing preferences | Until you withdraw consent or object |
8.3 After the retention period expires, we securely delete, anonymise or destroy the data, unless a legal hold or ongoing dispute requires us to keep it.
9. Data Security
9.1 We implement reasonable administrative, technical and physical security measures consistent with the SPDI Rules, applicable SEBI/IRDAI information security requirements and good industry practice, including:
- encryption of data in transit and, where appropriate, at rest;
- access controls, role-based permissions and multi-factor authentication for staff systems;
- secure and regularly updated software, firewalls and anti-malware tools;
- periodic vulnerability assessment and security audits;
- confidentiality agreements and training for employees and service providers;
- secure disposal of records; and
- incident response and business continuity procedures.
9.2 Breach response. In case of a personal data breach or cyber incident, we will take prompt steps to contain and investigate it, and will report to CERT-In, the Data Protection Board of India and/or other regulators, and notify affected persons, as required by law.
9.3 Your role in security. No system is completely secure. You are responsible for:
- keeping your passwords, PINs, OTPs and device secure;
- never sharing OTPs or passwords with anyone, including our employees;
- using only trusted devices and networks; and
- notifying us immediately at the contact details below if you suspect unauthorised access.
We do not ask for your OTP, PIN or password over phone, email or messaging platforms.
10. Your Rights
Subject to applicable law, you have the right to:
- Access , request a summary of the personal data we hold about you, the processing activities, and the identities of those with whom it has been shared;
- Correction and updating , request correction of inaccurate or misleading data, and completion of incomplete data;
- Erasure , request deletion of personal data that is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent, subject to legal retention requirements;
- Withdrawal of consent , as described in Section 5;
- Grievance redressal , to have your complaints about our handling of your data addressed (Section 11);
- Nomination , to nominate another individual to exercise your rights in the event of your death or incapacity; and
- Opt-out , from marketing communications and non-essential cookies.
How to exercise your rights: Write to our Grievance Officer at the details in Section 11/17. We may need to verify your identity before acting on a request, and we will respond within the time period prescribed by law. We may decline or limit a request where required by law (for example, where records must be retained under PMLA, SEBI or IRDAI rules) or where it would affect the rights of others, and will explain the reason.
11. Grievance Redressal
If you have concerns about how we handle your data, or wish to exercise your rights, please contact:
Grievance Officer / Data Protection Contact
Name: [Name] | Designation: [Compliance Officer / Grievance Officer]
Email: [privacy@erritarawealth.com] | Phone: +91 9601339353
Address: 306, Trinity Orion, B/S Jolly Residency, Vesu Main Road ,Surat, Gujarat – 395007
Hours: Mon–Sat, 10:00 AM – 6:00 PM IST We will acknowledge your complaint within [48 hours] and aim to resolve it within 30 days (or any shorter period required by law).
If you are not satisfied with our response, you may approach:
- the Data Protection Board of India, once operational and as provided under the DPDP Act;
- the SEBI SCORES portal (https://scores.sebi.gov.in) or SEBI Smart ODR (https://smartodr.in) for mutual fund–related matters;
- IRDAI Bima Bharosa (https://bimabharosa.irdai.gov.in) or the Insurance Ombudsman for insurance-related matters; or
- any other competent authority or court under applicable law.
12. Cookies and Tracking Technologies
12.1 We use cookies, pixels, local storage and SDKs to make our website and app work, remember your preferences, understand usage, enhance security and (where permitted) deliver relevant content and marketing.
12.2 Types of cookies:
- Strictly necessary: needed for login, security, load balancing and basic functionality.
- Performance/analytics: help us understand how visitors use our site (for example, through Google Analytics or similar tools).
- Functionality: remember choices such as language or saved forms.
- Advertising/marketing: used by us or partners to show relevant promotions, where you have consented.
12.3 You can manage or disable cookies through your browser or device settings, or via our cookie banner where available. Blocking some cookies may affect how the website functions.
12.4 We do not currently respond to browser "Do Not Track" signals, but we respect your cookie and marketing choices as described above.
13. Marketing and Communications
13.1 With your consent, we may send you promotional communications by email, SMS, WhatsApp, calls and push notifications about products, market updates, webinars and offers.
13.2 Opt out at any time by using the "unsubscribe" link, replying STOP, adjusting app settings, or writing to us. Service-related and legally required communications (such as transaction confirmations, statements, premium due notices and regulatory messages) will continue even if you opt out of marketing.
13.3 Calls to numbers registered on the DND/NCPR may still be made for transactional and service purposes, as permitted by TRAI regulations.
13.4 We may record calls with you for quality, training, compliance and dispute-resolution purposes.
14. Third-Party Links and Services
Our Services may contain links to third-party websites, apps and tools (such as AMC/insurer portals, KYC platforms and payment gateways). This Policy does not apply to those third parties. We encourage you to read their privacy policies before sharing any information.
15. Aadhaar and Biometric Information
15.1 We collect and use Aadhaar details only where permitted by law and only for purposes such as KYC/e-KYC, with your consent. We follow UIDAI guidelines, including using masked Aadhaar where possible.
15.2 We do not store full Aadhaar numbers or biometric data except where required by law and permitted by UIDAI, and we do not share Aadhaar data other than as permitted by applicable law.
15.3 Providing Aadhaar is voluntary where other officially valid documents are accepted. Refusing it may require you to use an alternative KYC method.
16. Changes to This Policy
16.1 We may update this Policy from time to time to reflect changes in law, regulation, technology or our practices.
16.2 The updated version will be published on our website/app with a revised "Last Updated" date. For material changes, we will notify you through email, SMS or in-app notice and, where required, seek fresh consent.
16.3 Your continued use of the Services after the changes take effect indicates your acceptance of the updated Policy.
17. Contact Us
ERRITARA WEALTH
306, Trinity Orion, B/S Jolly Residency, Vesu Main Road ,Surat, Gujarat – 395007 India
Email: secure@erritarawealth.com
Phone: +91 9601339353
Website: www.erritarawealth.com/
AMFI ARN:354877 | IRDAI Registration/Licence No.: ABLIC1003411114, CTH1132161
Statutory Notices
Mutual Fund investments are subject to market risks. Please read all scheme-related documents carefully before investing.
Insurance is the subject matter of solicitation. For more details on risk factors, terms and conditions, please read the sales brochure/policy document carefully before concluding a sale.
ERRITARA WEALTH is an AMFI-registered Mutual Fund Distributor and an IRDAI-registered insurance intermediary. Registration does not imply any assurance of performance or returns.