Privacy Policy.

Categories of Personal Data Collected

Identity and Contact Information: Full legal name as per PAN / Aadhaar records; date of birth and gender; residential and correspondence address (current and permanent); mobile number and email address; nationality and residential status (Resident Indian / NRI / Foreign National); occupation, income range, and tax residency details.

Official Identification and KYC Documents: Permanent Account Number (PAN); Aadhaar details (only masked/last four digits and derived KYC data as specified in Section 5.3); passport, Voter ID, or Driver's License (as address proof); live photograph for identity verification; signature for account and transaction authentication; and CKYC identifier.

Financial and Investment Information: Bank account details (account number, IFSC code, bank name, branch); cancelled cheque or bank statement; demat account details (DP ID, client ID, depository); investment preferences, risk profile, and suitability information; transaction history, portfolio holdings, and order details on the Platform; and dividend/interest payment details and bank mandate information.

Beneficiary and Nominee Information: Full name, relationship, date of birth, and contact details of nominated beneficiaries; PAN and other identification details of nominees, where required by Applicable Laws.

Authentication and Security Information: User credentials (passwords are stored in hashed/encrypted form and are never accessible to Aspero in plain text); One-Time Passwords (OTPs) used for login and transaction authentication; and device identifiers, IP addresses, and session tokens for security and fraud prevention.

Behavioral and Technical Data: Log data including IP address, browser type, operating system, referring URLs, and pages visited; device information including device type, model, and unique device identifiers; usage data including time spent on pages, clicks, search queries, and feature interactions; and geolocation data to comply with SEBI and FEMA regulations.

Communication and Interaction Data: Records of customer service interactions including voice calls, chats, and emails; feedback, grievances, and survey responses submitted by you; and marketing communication preferences and opt-in/opt-out records.

Career and Employment Data (if applicable): Resume, work history, educational qualifications, and references if you apply for a position with Aspero.

Data You Are Not Required to Provide: You are not required to submit data beyond what is mandated by Applicable Laws or necessary for the specific Service you avail. Where a field is optional, this will be indicated on the relevant form or screen on the Platform.

Collection of Aadhaar Information: In compliance with the Aadhaar Act, 2016, applicable UIDAI regulations, and the DPDPA, Aspero does not collect or store your complete 12-digit Aadhaar number directly on the Platform.

Obligation to Provide Accurate Data: As a user and Data Principal, you acknowledge and agree that you are solely responsible for providing complete, accurate, and up-to-date Personal Data to Aspero for the purposes of availing our Services. Inaccurate or incomplete data may result in your inability to complete KYC, access certain Services, or comply with regulatory obligations.

Data Collected Directly from You

Data Collected from Third-Party Sources

Data Collected Automatically — Cookies and Tracking Technologies

Voice and Call Recording: We may record telephone calls and voice interactions with our customer service team for the purposes of quality assurance, training, dispute resolution, and regulatory compliance. You will be informed of recording at the start of such calls.

Account Creation and Platform Access: Creating and managing your user account on the Platform; verifying your identity and eligibility to access the Platform and Services; updating your dashboard and maintaining your investment profile; and enabling secure login and authentication.

KYC and Regulatory Compliance: Conducting Know Your Customer (KYC) verification as mandated by SEBI and other applicable regulators; processing and validating your financial information with regulated entities, financial institutions, and service providers; complying with Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) obligations under PMLA and RBI guidelines; maintaining records as required by SEBI, depositories, stock exchanges, and other regulatory bodies; and meeting data localisation requirements under Applicable Laws.

Service Delivery and Transaction Processing: Providing access to investment products and Services available on the Platform; processing your investment orders, redemptions, and transactions; settling transactions through authorised depositories and settlement agencies; processing coupon/interest payments and other disbursements to your registered bank account; verifying and updating your bank and demat account details; and facilitating e-sign for account opening and transaction documents.

Communication and Customer Support: Communicating with you regarding your account, transactions, and regulatory requirements; responding to your queries, complaints, and grievances; sending transactional notifications including order confirmations, contract notes, account statements, and tax documents; and sharing investor education content and platform updates.

Personalisation and Platform Improvement: Analysing your usage patterns to improve Platform design, functionality, and user experience; personalising investment recommendations and content where applicable; and conducting internal analysis, reporting, and business intelligence to enhance our Services.

Risk Management, Fraud Prevention, and Security: Conducting risk assessments, including investment suitability analysis; detecting, investigating, and preventing fraudulent activity, money laundering, and other illegal conduct; monitoring Platform access for unauthorised or suspicious activity; maintaining and testing our cybersecurity systems in compliance with SEBI CSCRF; and conducting internal and external audits.

Marketing and Promotions (With Your Consent): Sending marketing communications, newsletters, and promotional offers related to new products and Services — subject to your explicit consent for such marketing; and conducting surveys, market research, and feedback campaigns. You may withdraw your consent to marketing communications at any time by following the unsubscribe instructions in any marketing email or by contacting us directly.

Career Applications: Reviewing and assessing applications for employment or engagement with Aspero; and conducting background verification as permitted under applicable law.

Legal and Regulatory Obligations: Complying with court orders, directions from government authorities, and requests from law enforcement or regulatory agencies; protecting the legal rights and interests of Aspero, its employees, clients, and investors; and defending against legal claims and proceedings.

General Principles: Aspero will not disclose your Personal Data to any third party except in the circumstances described in this Policy, with your consent, or as required or permitted by Applicable Laws. All disclosures are made on a need-to-know basis, and recipients are subject to confidentiality obligations.

Disclosure to Regulated Entities and Market Infrastructure: As a SEBI-registered intermediary, Aspero is required to share your data with certain regulated entities in the ordinary course of providing Services:

Disclosure to Third-Party Service Providers: We work with third-party service providers who assist in delivering our services to you through the Platform. Your Personal Data may be shared with these service providers for website hosting, payment processing, KYC verification, identity authentication, financial data analysis, settlement of transactions, cloud storage, advertising, and marketing. Any Personal Data disclosed shall be limited to that which is strictly necessary for the performance of the services. A non-disclosure agreement (NDA) and/or a data processing agreement (DPA) will be signed with all third-party service providers.

Disclosure Upon Your Consent: Where Applicable Law requires us to obtain your prior express consent before disclosing your Personal Data to a third party not covered above, we will seek and obtain such consent before making the disclosure.

Disclosure for Business Transfers: In the event of a merger, acquisition, corporate restructuring, fund-raising, or sale of assets involving Aspero, your Personal Data may be disclosed in a secure manner to professional advisors, potential acquirers, or investors as part of due diligence, subject to appropriate confidentiality and data protection obligations. You will be notified of any such transaction to the extent required by Applicable Laws.

Disclosure Under Applicable Laws: We may disclose your Personal Data without prior notice if we are required to do so by law, including to respond to a court order or subpoena; comply with a direction from a government authority, law enforcement agency, or regulator; protect against or prevent fraud, security breaches, or unauthorized transactions; or protect the rights, property, or safety of Aspero, its employees, clients, or the public.

No Sale of Personal Data: Aspero does not sell, rent, or trade your Personal Data to any third party for commercial gain. Any disclosure of Personal Data is limited to what is strictly necessary for the performance of the Services or compliance with Applicable Laws.

Cessation of Relationship and Data Deletion

Secure Deletion: Once the applicable retention period has expired, Personal Data will be securely deleted, anonymised, or destroyed in a manner that prevents recovery or reconstruction, in accordance with Applicable Laws and our internal data disposal procedures.

Data Storage and Localisation: All Personal Data collected from users in India is stored on secure servers located within India, in compliance with applicable data localisation requirements under SEBI circulars and RBI guidelines. We do not transfer or store your Personal Data outside India except as specifically permitted by Applicable Laws.

Security Safeguards: Our security infrastructure includes, but is not limited to:

User Responsibilities: As a Data Principal, you must: never disclose your username, password, OTP, or any other authentication credentials to any person, including Aspero employees (Aspero will never ask for your password); immediately report any suspected unauthorised access to your account to our customer support team; ensure that your registered mobile number and email address are kept up to date on the Platform; and log out of the Platform after each session, particularly when using shared or public devices.

Access Logs and Monitoring: We maintain detailed access logs and continuous monitoring systems to track all access to Personal Data and detect unauthorised access attempts. These logs are retained for a minimum of 180 days as required by Applicable Laws.

Enhanced Safeguards for Sensitive Personal Data (SPD): In addition to the general security safeguards described above, Aspero implements the following enhanced controls specifically for Sensitive Personal Data:

Detection and Internal Escalation: Upon detection of an actual or suspected Personal Data Breach, Aspero will immediately activate its Incident Response Plan. Our Security and Compliance teams will conduct a prompt assessment to determine the nature, scope, and likely impact of the breach.

Mandatory Notification to the Regulator: In compliance with Section 8(6) of the DPDPA and applicable SEBI CSCRF requirements, upon confirmation of a Personal Data Breach, Aspero will:

Notification to Affected Data Principals: We will notify you if a Personal Data Breach is likely to result in significant harm or risk to your privacy, rights, or freedoms. Such notification will be made via your registered email address and/or registered mobile number, and via a prominent notice on the Platform if the breach affects a large number of users, not later than 72 (seventy-two) hours after the risk assessment is complete.

Content of Breach Notification: Any breach notification provided to you will include: a clear description of the nature of the Personal Data Breach and the type of data affected; the approximate number of Data Principals and records concerned; the likely consequences resulting from the breach; the measures taken or proposed to be taken by Aspero to address the breach; contact information for our Grievance Officer; and steps you can take to protect yourself, including changing passwords or monitoring your financial accounts.

Right to Access and Correction: You have the right to obtain a summary of Personal Data that Aspero has processed about you; know the identities of all Data Fiduciaries and Data Processors with whom your Personal Data has been shared; and request correction or completion of any inaccurate, incomplete, or outdated Personal Data. We will action valid access or correction requests within 30 (thirty) days of receipt.

Right to Withdraw Consent: You may withdraw your previously given consent for the processing of your Personal Data at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to its withdrawal. Processing that is required under Applicable Laws (including KYC maintenance, AML compliance, and regulatory reporting) will continue even after withdrawal of consent. You may withdraw consent by contacting our Compliance Team or through the account settings on the Platform.

Right to Erasure: You may request the erasure of your Personal Data. However, this right is subject to applicable legal retention obligations. We will not be able to erase data that we are required to retain under Applicable Laws (including SEBI regulations, PMLA, and DPDPA). Upon expiry of the applicable retention period, data will be securely deleted as described in Section 9.

Right to Nominate: You have the right to nominate another individual to exercise your data rights on your behalf in accordance with the DPDPA, including in the event of your death or incapacity. You may exercise this right by emailing our Data Privacy Team with the subject line "Data Principal Nomination." We will require basic identity verification for both you and your nominee.

Right to Grievance Redressal: If you have any grievances regarding the processing of your Personal Data or a breach of this Policy, you have the right to register a grievance with our Privacy Office (see Section 17). We will respond to all legitimate grievances within 30 (thirty) days. If not satisfied with our response, you may escalate the matter to the Data Protection Board of India.

Right to Opt-Out of Automated Decision-Making: We may use automated systems to process your data for service personalisation and credit eligibility. Under the DPDPA, you have the right to be informed when a significant decision is made solely by automated means; to request a manual review of any automated decision that significantly impacts you; and to object to automated profiling used for marketing or behavioral tracking. To contest a decision or opt-out, please contact our Privacy Office at privacy@aspero.in.

How to Exercise Your Rights: You may exercise any of the rights described above by writing to our Privacy Team at privacy@aspero.in. Please include your registered name, registered mobile number, and a description of your request. We may request additional information to verify your identity before processing your request.

Information Accuracy: You must ensure that all Personal Data submitted to Aspero is accurate, complete, and up to date. You are expected to promptly notify us of any changes to your information, including changes to your residential status, marital status, contact details, bank account, or demat account.

No Impersonation or Misrepresentation: You must not provide false, misleading, or another person's Personal Data. Impersonation or misrepresentation of identity is a violation of Applicable Laws.

Proper Conduct: You must not submit false grievances, misuse data access rights, or engage in any conduct that disrupts or impairs the Platform or its Services.

Compliance with Applicable Laws: Any access requests, grievances, or exercise of data rights must be legitimate, in good faith, and compliant with the DPDPA, this Policy, and all other Applicable Laws.

Account Security: You are responsible for maintaining the confidentiality of your login credentials and for all activities conducted through your account. Aspero shall not be liable for losses arising from your failure to secure your credentials.

Escalation to SEBI and Regulatory Bodies: If your grievance is not resolved to your satisfaction through our internal mechanism, you may escalate to:

Governing Law: This Privacy Policy and all matters related thereto shall be governed by and construed in accordance with the laws of the Republic of India, including but not limited to the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, SEBI regulations, and all other Applicable Laws and the rules and regulations framed thereunder.

Dispute Resolution Hierarchy: In the event of any grievance or dispute relating to the processing of your Personal Data or a breach of this Policy, the following resolution hierarchy shall apply:

Civil Jurisdiction: Subject to the specialized jurisdiction of the Data Protection Board of India and the Appellate Tribunal under the DPDPA, all other legal proceedings arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of competent jurisdiction located in Chennai, Tamil Nadu, India.