Privacy Policy

1. Introduction

Providential Platforms Private Limited, operating under the brand ‘Nivesh’ (“Nivesh”, “Company”, “we”, “us”, “our”), respects your right to privacy and to control how your personal data is collected, accessed, used and disclosed. This Privacy Policy (“Policy”) explains how we handle the personal data of users, investors and customers (“User”, “you”, “your”, or “Data Principal”) who access or use www.nivesh.com and the Nivesh mobile application (together, the “Nivesh Platform”), in accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”), read with applicable SEBI, AMFI and PMLA requirements.

This Policy is an integral part of, and must be read together with, the Terms and Conditions of the Nivesh Platform. If you do not agree with this Policy, please do not access or use the Nivesh Platform. Continued use of the Platform after an update to this Policy constitutes your acceptance of the updated Policy.

You must be a natural person of at least 18 years of age to independently use the Nivesh Platform. Where you access the Platform on behalf of a minor (for example, to invest in the minor's name), the consent and verification requirements in Section 15 (Children's Data) will apply.

2. Definitions

• “App” means the Nivesh mobile application available on Android, iOS or any other app store.
• “Nivesh Platform” means www.nivesh.com and the Nivesh App, together with any other digital interface through which Nivesh offers its services.
• “Group Companies” means any holding, subsidiary, fellow subsidiary or associate company of Nivesh.
• “KYC” means Know Your Customer and customer due-diligence requirements prescribed by applicable regulatory authorities.
• “Data Principal” means the individual to whom the personal data relates, and, where that individual is a child or a person with disability, includes their lawful parent or guardian.
• “DPDP Rules” means the Digital Personal Data Protection Rules, 2025 framed under the Digital Personal Data Protection Act, 2023.

3. Personal Data We Collect

The categories of personal data we may collect depend on how you use the Nivesh Platform. You may choose not to provide certain personal data, but this may limit our ability to provide you with the relevant service.

4. How We Collect Personal Data

• Direct interactions - information you provide while registering, completing KYC forms, applying for investments, risk-profiling questionnaires, or communicating with our representatives.
• Third-party sources - data received from mutual fund houses, KYC Registration Agencies (such as CVL, NSDL, CDSL), RTAs, banks and other authorised financial partners, subject to applicable consent.
• Automated means - through cookies and similar technologies when you use the Platform (see Section 8).

5. How We Use Your Personal Data

Nivesh processes your personal data only for the purposes disclosed to you at the time of collection or set out in this Policy. We do not use your personal data for any purpose incompatible with these.

5.1 Processing based on your consent

• To register and onboard you on the Nivesh Platform, and to administer your account
• To facilitate mutual fund investments, redemptions, switches, SIPs and other transactions between you and mutual fund companies/RTAs
• To carry out obligations under arrangements with AMCs, RTAs and other authorised business partners for investment products distribution, pre/post-sale servicing and portfolio reporting
• To perform risk profiling and provide goal-based investment tools
• To provide investment-related information, alerts, notifications, statements and portfolio reports
• To conduct KYC verification and comply with regulatory requirements (SEBI, AMFI, PMLA, Income Tax)
• To provide customer support and handle grievances or service requests
• To track investments held outside the Nivesh Platform, strictly where you have separately opted in (see Section 7)
• To send educational content, market insights and investment guidance
• To conduct internal research, analytics and service improvement, with appropriate safeguards
• To send promotional communications, only where you have opted in; you may opt out at any time

5.2 Processing based on legal obligation and legitimate use

• To comply with KYC, Anti-Money Laundering (AML), SEBI, AMFI, tax reporting and audit requirements
• To respond to a court order, summons, or a lawful request from a regulatory or law-enforcement authority
• To detect, prevent or investigate fraud, security incidents or violations of these policies

Where we rely on legitimate use for a purpose (for example, fraud prevention or improving Platform security), we ensure this does not override your rights as a Data Principal, and we do not use it to justify unrelated or intrusive processing.

6. Email-Based Investment Tracking (Restricted-Scope Access)

If you wish to track investments made outside the Nivesh Platform, you may choose - entirely at your option - to connect the email account in which you receive Consolidated Account Statements (CAS), using a secure authentication method (such as Google/Microsoft OAuth).

• We access, on a read-only basis, only attachments from a defined, limited set of senders - namely CAMS, KFintech (formerly Karvy), NSDL and CDSL - that carry Consolidated Account Statement or capital-gains-statement content. We do not read, scan or process any other email in your inbox.
• The information extracted (folio numbers, transaction dates, subscription/redemption amounts, dividends, and similar CAS data) is used solely to display your consolidated holdings within the Platform.
• We do not use data obtained through this access for advertising of any kind, including retargeting, personalised or interest-based advertising.
• You may disconnect this access at any time by writing to support@nivesh.com, or directly through your email provider's third-party access/permissions settings.
• If you prefer not to connect your email account, you may manually upload your external investment statements instead; declining this feature does not restrict any other service on the Platform.

7. Legal Grounds for Processing

• Performance of services - processing necessary to provide mutual fund distribution and related services you have requested.
• Compliance with legal obligations - SEBI, AMFI, PMLA, Income Tax and KYC norms.
• Consent - for processing that is not otherwise necessary for the service, such as promotional communication or the email-based tracking feature in Section 6.
• Legitimate use, within the limited circumstances recognised under the DPDP Act (for example, where you have voluntarily provided data for a specified purpose and have not indicated you do not consent to its use).

8. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform securely, remember your preferences, and understand how the Platform is used.

• Essential cookies - required for authentication, session management and security; these cannot be disabled without affecting core functionality.
• Functional cookies - remember your preferences and settings.
• Analytics cookies - help us understand usage patterns and improve performance.

You can manage or disable non-essential cookies through your browser or device settings. We do not use cookies placed by other websites to collect data about you.

9. Sharing and Disclosure of Personal Data

We do not sell or rent your personal data to anyone, under any circumstances. We disclose personal data only as described below, or where we are legally required to do so.

Financial Institutions and Service Providers

• Mutual Fund Asset Management Companies (AMCs), for processing your investments
• Registrar and Transfer Agents (RTAs) such as CAMS and KFintech, for transaction processing
• Banks and payment gateways, for processing payments and settlements
• KYC Registration Agencies (KRAs) and depositories (NSDL/CDSL), for KYC verification
• Stock exchanges, where required to meet regulatory obligations

Technology and Infrastructure Providers

• Cloud storage and hosting providers
• Email, SMS and communication service providers
• Analytics and research service providers, on an aggregated/anonymised basis wherever feasible
• Customer support and IT security service providers

Professional Advisors

• Legal, accounting and other professional advisors
• Auditors and compliance consultants

Regulatory and Legal Authorities

• SEBI, AMFI, RBI, the Income Tax Department, PMLA authorities and other competent regulators
• Courts, law-enforcement or judicial authorities, where legally required
• Any recipient, where reasonably necessary to prevent a life-threatening emergency

Business Transfers

In the event of a merger, acquisition, reorganisation or sale of assets, personal data may be transferred to the successor entity, who will continue to be bound by this Policy (or a policy that is no less protective).

Your Advisor or Distributor

• Where you are onboarded through an advisor or distributor empanelled with Nivesh, your data may be shared with them for servicing your account.
• If that advisor/distributor moves to another AMFI-registered entity, your servicing data may transfer with them unless you instruct Nivesh otherwise before the transfer takes effect.

All third parties who process personal data on our behalf (Data Processors) are contractually bound to process it only on our instructions, to maintain confidentiality, to implement appropriate security safeguards, and to delete or return the data once their engagement ends.

10. No Use for Advertising Based on Financial Data

We do not use your financial, investment or transaction data to serve targeted or interest-based advertising, and we do not share this category of data with advertising networks. Any promotional communication you receive from us is based only on your explicit opt-in, and you may opt out at any time (see Section 13).

11. Cross-Border Transfer

Your personal data is primarily stored within India. We do not transfer personal data outside India except where necessary (for example, to a technology sub-processor) and only with the safeguards prescribed under the DPDP Law and any restrictions notified by the Central Government from time to time.

12. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required under applicable law, including the Prevention of Money Laundering Act, 2002, SEBI and AMFI record-keeping requirements, and the DPDP Rules.

• Where the purpose for which data was collected is no longer being served and you have not exercised any right in relation to it, we will retain the data only for the period prescribed under the DPDP Rules, and will notify you at least 48 hours before erasure due to inactivity, so that you may log in or contact us if you wish to continue.
• Transaction records, KYC data, and related regulatory data are retained for the minimum periods mandated under SEBI, AMFI and PMLA requirements, even after account closure.
• Where proceedings, disputes or regulatory inquiries are ongoing, relevant records are retained until their conclusion.

13. Consent Withdrawal, Opt-Out and Account Deletion

• You may withdraw consent for any processing that is based on consent (such as promotional communications or the email-tracking feature) at any time, by writing to support@nivesh.com or contacting our Grievance Officer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may result in cessation of the specific service linked to that consent.
• You may request deactivation of your account, which will suspend your access until you request reactivation.
• You may request deletion of your account and associated data, subject to our obligation to retain KYC, transaction and regulatory records for the periods mandated under SEBI, AMFI and PMLA, and subject to any active investments or pending obligations.
• We will process withdrawal, deactivation or deletion requests within the timelines prescribed under the DPDP Rules, extendable where the request is complex, with notice to you.

14. Your Rights as a Data Principal

• Right to Access: Obtain a summary of the personal data we hold, the processing activities carried out, and the identities of third parties with whom it has been shared.
• Right to Correction and Erasure: Ask us to correct, complete, update or erase your personal data where it is inaccurate, incomplete, outdated, or no longer necessary - subject to our regulatory retention obligations under SEBI, AMFI and PMLA.
• Right to Grievance Redressal: Raise a grievance with our Grievance Officer, and escalate an unresolved grievance to the Data Protection Board of India.
• Right to Nominate: Nominate another individual to exercise your rights under the Act on your behalf, in the event of your death or incapacity, in the manner prescribed under the DPDP Rules.

To exercise any of these rights, please contact us using the details in Section 18 (Grievance Redressal).

15. Children's Data

The Nivesh Platform is not intended for independent use by individuals below 18 years of age. Where an investment is made on behalf of a minor:

• we collect personal data of both the minor and the parent/legal guardian;
• processing occurs only with verifiable parental or guardian consent, established through PAN/Aadhaar and OTP verification and supporting documentation;
• we do not track, profile, or target minors for behavioural advertising of any kind; and
• the parent or legal guardian may review, correct, or request deletion of the minor's data, subject to applicable retention requirements.

16. Data Security

We implement reasonable technical and organisational safeguards to protect personal data against unauthorised access, disclosure, alteration, loss or misuse, including:

• access to personal data restricted to personnel who need it to perform their role;
• data encrypted in transit and, where applicable, at rest;
• regular security review and monitoring of our systems; and
• contractual security obligations imposed on all Data Processors.

No system can guarantee absolute security. You are responsible for keeping your login credentials confidential, for not sharing your password, and for promptly reporting any suspected unauthorised access to support@nivesh.com.

17. Breach Notification

In the event of a personal data breach, we will notify affected Data Principals and the Data Protection Board of India as required under the DPDP Law, describing the nature of the breach, its likely consequences, the measures taken to address it, and the steps you may take to protect yourself.

18. Grievance Redressal

If you have a complaint or concern regarding the processing of your personal data, or wish to exercise any right under this Policy, please contact our Grievance Officer:

19. Third-Party Links

The Platform may contain links to third-party websites or services. This Policy does not govern, and we are not responsible for, the privacy practices of those third parties. We encourage you to review their privacy policies independently before sharing any information with them.

20. Changes to this Policy

We may update this Policy periodically to reflect changes in law, regulatory guidance, or our business practices. Material changes will be notified to you through the Platform or by email, and the “Effective Date” above will be updated accordingly. Your continued use of the Platform after such notice constitutes acceptance of the updated Policy.

21. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Courts at Gautam Buddha Nagar, Noida, Uttar Pradesh shall have exclusive jurisdiction over any dispute arising from or relating to this Policy.

22. Legal Compliance

This Policy is framed with reference to, and is intended to comply with:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025;
• the Information Technology Act, 2000 and rules made thereunder, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• applicable SEBI and AMFI regulations and circulars; and
• other applicable Indian laws, as amended from time to time.