Privacy Policy

This Privacy Policy governs the collection, use, storage, and protection of personal data provided by users to E-Square Financials ("Company", "we", "us") through our website esquarefinancials.in and associated applications (the "Platform").

This Policy is published in compliance with the Information Technology Act 2000, IT (Amendment) Act 2008, IT (Reasonable Security Practices) Rules 2011, and the Digital Personal Data Protection Act 2023 (DPDP Act), along with applicable SEBI, RBI, and IRDAI guidelines.

By using our Platform, you consent to the practices described herein.

E-Square Financials Alkapuri Township, Neknampur Road, Puppalguda, Hyderabad, Telangana — 500089

Grievance Officer: Sudheer Kommu Email: [email protected] | Phone: +91 96522 19351

All data privacy complaints will be addressed within 30 days as required under applicable law.

Identity & Contact: Full name, date of birth, PAN, Aadhaar (last 4 digits), residential address, email, mobile number.

Financial Data: Bank account details, income information, investment portfolio, tax filing records, loan application data, credit information (with explicit consent), GSTIN.

KYC Documents: PAN card, Aadhaar, bank statements, ITR copies — collected as required by SEBI, RBI, and PMLA regulations. These constitute Sensitive Personal Data under IT Rules 2011.

Technical Data: IP address, device identifiers, browser type, pages visited, session duration, and cookies.

Communication Data: Support queries, advisor correspondence, feedback, and survey responses.

Service Delivery: Providing investment advisory, tax filing, real estate consultation, and loan facilitation; executing transactions; generating reports.

Regulatory Compliance: Meeting KYC/AML obligations under PMLA 2002; reporting to SEBI, RBI, Income Tax authorities, and other regulators.

Account Management: Creating and maintaining your account, verifying identity, processing payments and subscriptions.

Analytics & Improvement: Understanding usage patterns, improving Platform features, providing personalised recommendations (only with consent).

Marketing (Opt-In Only): Newsletters and research updates — only if you have explicitly opted in. Opt out anytime via email unsubscribe link.

Legal Defense: Fraud prevention, money laundering detection, and protecting our legal rights.

Under the DPDP Act 2023, we process your data on the following lawful bases:

Consent — For marketing, personalisation, and optional data collection. You may withdraw consent at any time. Contract Performance — To deliver the financial services you have engaged us for. Legal Obligation — KYC, AML, tax reporting, and regulatory compliance. Legitimate Interests — Fraud prevention and service security, where such interests do not override your fundamental rights.

We do not sell your personal data. We share data only with:

Regulated Financial Partners: SEBI-registered mutual fund houses, BSE/NSE brokers, NBFC/bank lending partners — strictly for executing your instructions.

KYC & Verification Agencies: Authorised KRAs, credit bureaus (CIBIL, Experian), and Digio/NSDL for Aadhaar e-KYC and PAN verification.

Technology Service Providers: Cloud infrastructure (AWS/Supabase), payment processors (Razorpay), email providers — under strict data processing agreements.

Legal Authorities: SEBI, RBI, Income Tax Department, UIDAI, FIU-IND, law enforcement — when required by law or valid legal process.

Business Transfers: In a merger or acquisition, under the same privacy protections.

KYC & identity documents — 8 years from account closure (PMLA requirement) Financial transaction records — 8 years (Income Tax Act requirement) Tax filing records — 8 years Account data — Duration of engagement + 3 years Marketing preferences — Until opt-out or 3 years of inactivity Technical/log data — 12 months Support correspondence — 3 years

After the applicable retention period, data is securely deleted or anonymised.

Encryption at Rest: All sensitive data including PAN, Aadhaar references, and financial records is encrypted using AES-256.

Encryption in Transit: All communications use TLS 1.3.

Access Controls: Role-based access ensures employees access only the data necessary for their function. All access is logged.

Audit Logs: All financial transactions and data access events are logged for compliance and fraud detection.

Infrastructure: Hosted on enterprise-grade cloud infrastructure with ISO 27001 certified data centres in India.

Despite these measures, no electronic system is 100% secure. We will notify affected users of any confirmed data breach within 72 hours as required by law.

Right to Access: Request a summary of your personal data we hold and how it is being used.

Right to Correction: Request correction of inaccurate or incomplete data.

Right to Erasure: Request deletion of data no longer necessary for its original purpose, subject to statutory retention requirements.

Right to Withdraw Consent: Withdraw consent for non-mandatory processing at any time.

Right to Grievance Redressal: Lodge a complaint with our Grievance Officer. If unresolved, approach the Data Protection Board of India.

Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any right, email [email protected] with subject: "Data Rights Request — [Your Name]". We respond within 30 days.

Essential Cookies: Required for authentication and security. Cannot be disabled.

Analytics Cookies: Help us understand how the Platform is used. You may opt out via browser settings.

Preference Cookies: Remember your settings and dashboard layout.

We do not use third-party advertising or cross-site tracking cookies.

Our Platform is not directed at persons under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us immediately at [email protected] and we will delete such data promptly.

We may update this Policy periodically. Material changes will be communicated by email (to registered users) and a notice on the Platform at least 15 days before they take effect. Continued use after the effective date constitutes acceptance.