Privacy notice — DPDPA 2023

PSS Ventures Pvt Ltd is the Data Fiduciary for personal data collected on this site and via our Android app. This notice is issued under the Digital Personal Data Protection Act, 2023 (the "DPDPA"), the rules notified on 13 November 2025, and our voluntary commitments under SEBI / AMFI norms.

1. Data Protection Officer

Email pssventures.india@gmail.com. We respond to verifiable requests within 30 days; statutory deadlines under DPDPA may apply earlier.

2. What we collect

• Identity: name, mobile, email, PAN, Aadhaar (last 4 + hash only), demographic information returned by CKYC / DigiLocker.
• Financial: bank account details, transaction history, folio/holdings via BSE StAR MF + RTA feeds.
• Device & usage: browser type, IP address (truncated for analytics), pages visited.
• Communications: messages you send us; phone-call records with your consent.

3. Why we collect it

• To provide the service (KYC, transactions, reporting, statements).
• To comply with SEBI / AMFI / PMLA record-keeping (5–8 year retention may override deletion requests for transactional records).
• To prevent fraud and meet our cyber-resilience obligations.
• To support you (grievance redressal, dispute resolution).

4. Lawful basis

We rely on (a) your itemised consent at signup for the processing of your contact details and marketing communications, and (b) legitimate uses under DPDPA Section 7 for legal compliance and grievance handling.

5. Retention

• Account + transactions: 8 years post-closure (SEBI / PMLA).
• Marketing data: 90 days after consent withdrawal.
• Audit logs: 7 years.

6. Where your data lives

All personal data is stored in AWS ap-south-1 (Mumbai). Aggregated, non-PII analytics may be processed in non-India regions. No PII is replicated outside India.

7. Sharing

We share data with: KYC partner (Signzy), BSE StAR MF, AMCs and RTAs for the transactions you place, Razorpay for payments, MSG91/Resend for OTP/comms. Each is a Data Processor under contract.

8. Your rights under DPDPA

• Right to access a summary of personal data we hold.
• Right to correction and erasure (subject to SEBI/PMLA retention).
• Right to grievance redressal via our DPO; escalation to the Data Protection Board.
• Right to nominate a person to exercise rights on your behalf.

Submit an erasure request via our erasure form.

9. Breach notification

We will notify the Data Protection Board and affected Data Principals within 72 hours of becoming aware of a breach involving your personal data.

10. Children

We do not knowingly collect data of persons under 18 except as part of a guardian-nominated nominee flow on a parent's folio. If you believe a minor's data is held, contact the DPO for deletion.

This draft will be replaced by counsel-reviewed wording before public launch.