In short: We process your data to run FinActiv. Account Aggregator access is consent-based and revocable. We do not sell Personal Data. Insights and advice use rules-based algorithms — not AI training on your data. Contact our Grievance Officer for privacy requests.
Acuity Insights Private Limited (hereinafter referred to as “Acuity”, “we”, “us” or “our”) respects your privacy and seeks to handle personal data responsibly. This Privacy Policy explains how we collect, use, retain and disclose information when you use the FinActiv mobile application, website and related digital services (together, the “Platform”).
This Policy forms part of the Terms and Conditions. We process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the rules applicable to sensitive personal data, to the extent in force and applicable, and the Digital Personal Data Protection Act, 2023 and rules as and when the relevant provisions become effective. This Policy is intended to explain our practices and does not replace any separate notice or consent required by law.
We use personal data for the purposes explained in this Policy and rely on consent or another basis permitted by applicable law, as relevant. Where a separate consent is required, including to obtain financial information through an Account Aggregator or to send optional promotional communications, we will seek it separately. You may withdraw consent where consent is the basis for processing; this will not affect processing already lawfully carried out and may affect the Services we can provide. If you do not wish your data to be processed as described, please discontinue use of the relevant Service.
In this Policy, “you” or “your” means an individual who registers for or uses the Platform. This Policy covers processing by Acuity and persons processing data on its behalf; it does not govern the independent privacy practices of third parties with whom you interact directly, such as banks, insurers or execution platforms.
1. Key terms used in this Policy
Capitalized terms not defined in this Policy have the meaning in the Terms and Conditions.
- “Account Aggregator” means a non-banking financial company holding a valid registration from the Reserve Bank of India to provide account aggregation services.
- “Consent Artefact” means the standardized record of consent used in the Account Aggregator framework to specify, among other things, the financial information requested, purpose, recipient and validity of consent.
- “DPDP Act” means the Digital Personal Data Protection Act, 2023, together with rules and notifications brought into force under it from time to time.
- “Execution Platform” means a SEBI-registered or regulated platform or intermediary through which investment advice is implemented or a Transaction is executed.
- “Group Entities” means any entity that controls, is controlled by, or is under common control with Acuity.
- “SPDI Rules” means the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- “Sub-Processor” means a third party appointed by Acuity to process personal data on its behalf, where applicable.
2. Information we handle and how we use it
Acuity does not ask you to disclose your net-banking password, card PIN, CVV, OTP or the login credentials of your trading, demat or bank accounts to Acuity. Do not share these credentials with anyone claiming to represent us.
Records of advisory interactions: As a SEBI-registered Investment Adviser, we keep records of your risk profile, suitability assessments, the advice given to you and its rationale, and of interactions with clients and prospective clients where advice is discussed, including call recordings, emails and chat logs, as SEBI requires.
Information about other people: If you give us information about family members, nominees or dependants (for example, to plan for a goal or check insurance cover), you confirm that you are authorised to share it and that you have told them how we will use it.
Children: The Platform is meant only for individuals aged 18 or above. We do not knowingly collect Personal Data of children. If we learn that we have, we will delete it.
- “Personal Data” means information about an individual who is identifiable by or in relation to that information. Certain financial, authentication or biometric information may also be subject to additional safeguards under applicable law.
- “Non-Personal Information” means information that does not identify you, including information that has been aggregated or effectively de-identified. We will not treat information as non-personal where it can reasonably be used to identify you.
Acuity does not ask you to disclose your net-banking password, card PIN, CVV, OTP or the login credentials of your trading, demat or bank accounts to Acuity. Do not share these credentials with anyone claiming to represent us.
Records of advisory interactions: As a SEBI-registered Investment Adviser, we keep records of your risk profile, suitability assessments, the advice given to you and its rationale, and of interactions with clients and prospective clients where advice is discussed, including call recordings, emails and chat logs, as SEBI requires.
Information about other people: If you give us information about family members, nominees or dependants (for example, to plan for a goal or check insurance cover), you confirm that you are authorised to share it and that you have told them how we will use it.
Children: The Platform is meant only for individuals aged 18 or above. We do not knowingly collect Personal Data of children. If we learn that we have, we will delete it.
| Category | Information processed and purpose |
|---|---|
| Personal particulars | Name, contact details, date of birth and other details you provide. Used to create and administer your account, verify identity where needed and communicate about the Services. |
| KYC particulars | PAN, KYC identifiers, identity/address documents, signature and verification information required for onboarding or regulatory checks. Aadhaar-based verification, if offered, will be handled through an authorised process and in accordance with applicable law. |
| Financial and risk profile | Income, occupation, financial position, investment experience, objectives and risk tolerance. Used for financial insights, risk profiling and suitability assessment where relevant, and for applicable compliance requirements. |
| Account Aggregator and investment data | Financial information received through an Account Aggregator or other authorised source, including account, investment, loan, insurance or transaction information. Used only for the purpose disclosed and authorised, including dashboards, financial health features or advisory services. |
| Banking and payment information | Payment or mandate details needed to collect fees or process refunds. Payment-card information may be handled by the payment provider; Acuity does not store your full card details such as card number, CVV or card PIN. |
| Advisory and transaction information | Financial objectives, agreements, advice, communications and instructions you approve. Used to provide the relevant Service, maintain required records and communicate transaction status. |
| Technical and device information | IP address, device/browser details, app version, security logs and feature usage. Device permissions are requested only when needed for a feature and, where required, with your permission. |
| Cookies and analytics | Essential technologies for security and operation and, where used, optional analytics or preference tools. These help maintain the Platform and understand performance. You can manage optional cookies and analytics tools through the cookie settings on the Platform. |
| Communications and preferences | Support requests, emails, chats, feedback and communication preferences. Promotional messages are sent where permitted and with consent where required; essential service, security and regulatory messages may still be sent. |
| Information from authorised third parties | Information from KYC registries, regulated platforms, product providers or professionals where legally permitted and, where required, with your authorisation. Used to verify details and provide requested Services. |
| Complaints and legal compliance | Information needed to investigate grievances, meet regulatory or legal duties, maintain records, conduct audits and protect legal rights. |
| Automated analysis | Insights and investment advice on the Platform are generated by a rules-based algorithm that applies pre-defined, documented rules to your data. No artificial intelligence or machine-learning tools are used to generate insights or advice, and we do not use your Personal Data to train any AI model. Users who have not signed the investment advisory agreement see factual information about their own accounts and general educational content only. If we begin to use AI tools, we will update this Policy and tell advisory clients the extent of such use before it applies to them. |
3. When and with whom we share information
Acuity may disclose Personal Data to the recipients described below where the disclosure is connected with providing or supporting the Platform, acting on your instructions, meeting a legal obligation or protecting legitimate rights. We do not sell Personal Data. Access is limited to what is reasonably required for the relevant purpose, and consent will be obtained where applicable law requires it.
| Recipient category | Purpose and limits of disclosure |
|---|---|
| Acuity group entities | To support Platform operations or deliver a requested Service, where access is necessary. Information concerning investment-advisory clients remains subject to applicable SEBI requirements, including confidentiality and conflict-of-interest controls, and will not be used by any group entity to market or distribute products to advisory clients or their family members. |
| Technology and operational vendors | To provide hosting, infrastructure, identity checks, KYC, e-signing, payment processing, messaging, analytics, cybersecurity and customer support. Vendors must act within their assigned role and applicable contractual safeguards. |
| Account Aggregators and authorised financial-data sources | To request or receive financial information through the relevant consent process and only for the purpose and scope authorised by you. |
| Execution platforms and regulated intermediaries | To transmit or implement an instruction you have approved, or to deliver a Service you have requested. |
| Financial product providers | To facilitate a service or transaction specifically requested by you, including the implementation of investment advice through an Execution Platform offering direct plans, where applicable. Any other product-related services, including those involving insurance, lending or fixed deposits, shall be provided or facilitated, as applicable, by an independent third party or a Group Entity onboarded on the Platform for such purpose, which shall be responsible for providing such services in accordance with applicable laws and the registrations, licences or authorisations required for the same. Acuity shall share your Personal Data with such third parties only to the extent necessary for the requested service and in accordance with applicable law and your authorisation, wherever required. |
| Professionals nominated by you | To share relevant information with a financial professional, adviser or other recipient you have specifically designated, within the scope of your authorisation. |
| Regulators and public authorities | To respond to a lawful request or comply with applicable legal, regulatory, judicial or law-enforcement requirements; disclosures may also be made where legally permitted. |
| Professional advisers and assurance providers | To obtain legal, accounting, audit, risk, compliance or security-assessment support, subject to appropriate confidentiality obligations. |
| Business transaction counterparties or successors | In connection with a proposed or completed merger, restructuring, financing, sale or transfer of all or part of the business, subject to applicable law and suitable safeguards. |
| Other recipients authorised by you | Where you direct us to share particular information or otherwise provide valid authorisation for a defined purpose. |
Where a specific disclosure requires your consent, we will seek it before sharing the relevant information. The actual service providers engaged by Acuity may change over time.
4. Service providers and processors
We engage service providers for the functions listed below. They process data only on our instructions and under confidentiality and security obligations. You can ask the Grievance Officer for the names of the providers that have received your data.
- Account Aggregator connectivity, consent management and financial-data transfer
- Retrieval of mutual fund portfolio or investment-holding information
- KYC verification, identity validation, Aadhaar-based electronic KYC and electronic signing
- KYC record validation, retrieval and updating
- Payment collection, payment processing and refunds
- Cloud infrastructure, hosting, storage, backup and disaster recovery
- SMS, email, messaging applications and push notifications
- Platform analytics, usage measurement and crash/error reporting
- Customer support, ticketing and user communications
- Cybersecurity, fraud detection, access monitoring and technical diagnostics
- Document management, workflow automation and secure file exchange
5. Financial information through Account Aggregators
- Before financial information is accessed through an Account Aggregator, you will be presented with a Consent Artefact describing the information requested, the purpose, recipient, validity and other required details. Data will be requested only after the consent process has been completed.
- You may manage or revoke an Account Aggregator consent through the available Platform or Account Aggregator interface. Revocation prevents further access under that consent. Data already received will be handled under this Policy and applicable law; it will be deleted when no longer required, except where retention is legally required.
- An Account Aggregator operates under the RBI framework and transfers financial information on the basis of customer consent. The Account Aggregator is not permitted to use the financial information for unrelated purposes. The precise handling of consent records and technical data is governed by the applicable RBI directions and the relevant Account Aggregator’s own disclosures.
- Acuity, when acting as a Financial Information User, will use financial information received through the Account Aggregator only for the purpose specified in the Consent Artefact and in accordance with applicable law. It will not disclose or use that information for an unrelated purpose.
6. Retention and deletion
We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, regulatory, accounting, dispute-resolution and security requirements. Actual retention periods depend on the type of record and the law applicable to the relevant Service.
At the end of the applicable retention period, we will delete or de-identify the data, unless it must be retained by law or is reasonably required to establish, exercise or defend a legal claim. Any data retained for such reasons will be access-restricted and used only for the relevant purpose.
- Investment-advisory and related client records: retained for the period required under applicable SEBI requirements, including the applicable minimum record-retention period.
- Payment, tax and accounting records: retained for the period required by applicable law and legitimate accounting or dispute-resolution needs.
- Complaint and grievance records: retained for the period required by applicable law and reasonably necessary to document resolution.
- Account Aggregator data: retained only for the permitted purpose and period, subject to the Consent Artefact and applicable law, and deleted at the end of the data life specified in the Consent Artefact. Consent and access logs are retained for the period required by the applicable RBI framework.
- Technical logs, call recordings and incomplete registration data: retained according to documented internal retention periods, security needs and applicable legal requirements.
7. Your privacy choices and rights
Subject to applicable law and the stage at which the relevant provisions are in force, you may be entitled to -
To make a request, contact the Grievance Officer using the details in Section 9. We may need to verify your identity before acting on a request. We will respond within 15 working days of receiving your request, or within any shorter period prescribed by applicable law. Withdrawal of consent or erasure may limit our ability to provide a Service, and some records may need to be retained to meet legal or regulatory obligations.
- Request information about the personal data we process and the purposes of processing.
- Request correction or updating of inaccurate or incomplete personal data.
- Request erasure of personal data where it is no longer required and no legal or regulatory retention obligation applies.
- Withdraw consent where our processing is based on consent. You may separately revoke Account Aggregator consent through the relevant consent interface.
- Raise a privacy grievance with Acuity and use any further remedy available under applicable law.
- Nominate another individual to exercise rights where, and in the manner, permitted by applicable law.
8. Security and data transfers
We maintain technical and organisational safeguards appropriate to the nature of the information and risks involved. These may include access controls, authentication, encryption, monitoring, security testing, staff guidance and contractual safeguards for service providers. We also follow applicable information-security and SEBI requirements to the extent they apply to our business.
Personal Data, including financial information received through Account Aggregators and the records we keep as an Investment Adviser, is stored on servers located in India. Any transfer outside India will be made only in accordance with applicable law and restrictions in force at the time.
No technology or storage method can be guaranteed to be completely secure. If a personal-data breach occurs, Acuity will take appropriate steps to contain, assess and address it and make notifications to affected individuals and authorities where required by applicable law and within the prescribed timelines, including reporting cyber incidents to CERT-In within six hours and, once the relevant provisions apply, informing the Data Protection Board of India and affected users.
9. Third-party websites and services
The Platform may contain links to third-party websites, applications or services. Those parties operate independently and have their own privacy practices. Please review their privacy notices before providing information to them. This Policy does not govern their processing.
10. Contact and privacy complaints
For questions or concerns about this Policy or our handling of Personal Data, please contact the Grievance Officer using the details below.
Grievance Officer: Rahul Desai | Email: [email protected] | Phone: 022 3557 0753 | Address: 502, Boston House, Suren Road, Andheri East, Mumbai - 400093 | Working hours: Monday to Friday, 10:00 a.m. to 6:00 p.m.
We acknowledge complaints within 24 hours and aim to resolve them within 15 working days. If you are not satisfied with our response, you may approach the relevant regulatory or statutory authority, as applicable. For investment-advisory matters, you may lodge a complaint on SEBI's SCORES platform (https://scores.sebi.gov.in) and, if you remain dissatisfied, use the SMART ODR portal (https://smartodr.in). For personal data matters, you may approach the Data Protection Board of India once the relevant provisions are in force. For Account Aggregator matters, you may approach the relevant Account Aggregator or the Reserve Bank of India through its applicable grievance-redressal mechanism.
Grievance Officer: Rahul Desai
Email: [email protected]
Phone: 022 3557 0753
Address: 502, Boston House, Suren Road, Andheri East, Mumbai - 400093
Working hours: Monday to Friday, 10:00 a.m. to 6:00 p.m.
11. Updates to this Policy
We may revise this Policy to reflect changes in our Services, data practices, technology or applicable law. The current version and its update date will be published on the Platform. Where required, we will notify you of a material change or seek fresh consent before processing on the revised basis.
12. Applicable law and jurisdiction
This Policy is governed by the laws of India. Subject to any mandatory jurisdiction of a regulator or forum under applicable law, disputes will be subject to the competent courts at Mumbai, Maharashtra, India.
Disclaimer: Registration granted by SEBI, enlistment of IA with Exchange and certification from NISM in no way guarantee performance of the intermediary or provide any assurance of returns to investors.
Standard warning: Investment in securities market are subject to market risks. Read all the related documents carefully before investing.
Standard warning: Investment in securities market are subject to market risks. Read all the related documents carefully before investing.