Privacy Policy

1. Scope and Our Role

This Privacy Policy applies to personal data we process when you visit, register for, or use the platform, or otherwise interact with us. It does not apply to the privacy practices of any third party (including any issuer, sponsor, fund, distributor, intermediary, or other provider whose opportunity or service is accessed through the platform, each a "Third-Party Provider"), whose own privacy policies govern their processing of your data.

For the purposes of the Digital Personal Data Protection Act, 2023 and other applicable data-protection laws, XALT acts as the data fiduciary (controller) in respect of personal data for which it determines the purposes and means of processing.

2. Information We Collect

We may collect and process the following categories of personal data:

• Identity and contact data — full name, date of birth, gender, photograph, email address, postal address, and telephone number
• KYC and verification data — government-issued identifiers and documents required for identity verification and regulatory compliance, such as PAN, Aadhaar (collected and used in accordance with applicable law), passport, and other proof of identity, address, or status
• Financial and investor-profile data — bank or payment account details, investor category or eligibility information, investment preferences, and transaction and holding history relating to your use of the platform
• Usage and technical data — device, browser, and operating-system information, IP address, log data, and information about how you interact with the platform
• Communications data — records of your correspondence and interactions with us, including support requests

We collect personal data directly from you, automatically through your use of the platform, and, where applicable, from KYC/AML and verification service providers and other authorised sources. You are responsible for ensuring that personal data you provide is accurate and that you have the right to provide any data relating to other individuals.

3. How We Use Your Data

Your information is used to:

• Create and administer your account and provide access to the platform on your initiative
• Verify your identity and eligibility and carry out KYC, AML, sanctions, and fraud-prevention checks
• Facilitate your user-initiated access to opportunities and enable transactions, payments, and payouts between you and the relevant Third-Party Provider
• Operate, maintain, secure, and improve the platform and personalise your experience
• Communicate with you about your account, service updates, and support
• Comply with legal, regulatory, tax, and reporting obligations and respond to requests from competent authorities
• Establish, exercise, or defend legal claims and enforce our Terms of Use

We process personal data on the basis of your consent and/or such other lawful bases as are available under applicable law, including processing necessary for the performance of services you have requested, for compliance with legal obligations, and for our legitimate business and security interests. Where we rely on consent, you may withdraw it as described in Section 7.

4. How We Share Your Data

We do not sell your personal data. We may share your data with:

• Third-Party Providers and the intermediaries supporting a transaction you choose to pursue (e.g., registrars and transfer agents, custodians, trustees, and payment gateways), to the extent necessary to give effect to that transaction
• Service providers and data processors who perform functions on our behalf (e.g., KYC/AML verification, cloud hosting, analytics, communications, and customer support), under contractual obligations of confidentiality and data protection
• Regulatory, governmental, tax, law-enforcement, and judicial authorities, where required or permitted by law or to respond to lawful requests
• Professional advisers, and any actual or prospective successor, acquirer, or affiliate in connection with a reorganisation, merger, or transfer of business, subject to appropriate safeguards

Where personal data is transferred to or processed in a location outside India, we will do so only in accordance with, and to countries permitted by, applicable law, and subject to appropriate safeguards.

5. Data Storage and Security

We implement reasonable technical and organisational security measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction, including encryption of data in transit and at rest, access controls, and monitoring. While we take security seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will take appropriate steps and provide notifications where and to the extent required by applicable law.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, to provide the platform, and to comply with our legal, regulatory, tax, and record-keeping obligations (including those applicable to KYC/AML records). When personal data is no longer required, we will delete, anonymise, or securely dispose of it in accordance with applicable law.

7. Cookies and Tracking

We use cookies and similar technologies to operate the platform, remember your preferences, maintain session security, and analyse site traffic and usage so that we can improve the platform. You can manage or disable non-essential cookies through your browser settings; disabling certain cookies may affect the functionality of the platform.

8. Your Rights

Subject to applicable law, you have the right to:

• Access, and obtain a summary of, the personal data we hold about you and information about its processing
• Request correction, completion, or updating of inaccurate or incomplete personal data
• Request erasure of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal and regulatory retention obligations
• Withdraw any consent you have given, on a prospective basis, without affecting the lawfulness of prior processing or processing on other lawful bases
• Nominate another individual to exercise your rights in the event of your death or incapacity, where permitted by law
• Make a grievance or complaint as set out in Section 9, and escalate to the relevant data- protection authority

You may exercise these rights by contacting us using the details in Section 9. We may need to verify your identity before acting on a request. Withdrawal of consent or a request for erasure may mean we are unable to continue providing you access to the platform or to particular opportunities.

9. Children's Data

The platform is intended only for persons who are 18 years of age or older. We do not knowingly collect personal data from children. If we become aware that we have collected personal data of a child without appropriate consent, we will take steps to delete it in accordance with applicable law.

10. Grievances and Contact Us

If you have any questions, requests, or complaints regarding this Privacy Policy or our processing of your personal data, or wish to exercise your rights, please contact us at:

Email: [email protected]
206, Peninsula Center, Dr SS Rao Marg, Parel, Mumbai 400012

We will acknowledge and seek to resolve grievances within the timelines prescribed by applicable law. If you are not satisfied with our response, you may escalate your complaint to the relevant data-protection authority.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The current version will be posted on the platform with a revised "last updated" date. Your continued use of the platform after any update constitutes acknowledgement of the updated Privacy Policy.

12. Governing Law

This Privacy Policy is governed by the laws of India, and any dispute in connection with it shall be resolved in accordance with the dispute-resolution provisions of our Terms of Use.