Your data, in plain language.
What we collect, why, how long we keep it and how to change your mind — under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
What we collect
Only what a purpose needs: contact details for enquiries; KYC and bank details for transactions, via KRA/exchange platforms.
Why
To respond to you, process investments you instruct, meet SEBI/AMFI/PMLA obligations — and, only if you opt in, send updates.
How long
Enquiries: [90] days unless you become a client. Client records: as long as the law requires, then erased.
Your rights
Access, correction, erasure, grievance redressal, nominating someone, and withdrawing consent — anytime.
What we process, why, and for how long
Each purpose is listed separately, and we ask for consent for each on its own.
| PURPOSE | PERSONAL DATA | BASIS | RETENTION |
|---|---|---|---|
| Respond to an enquiry | Name, mobile, email, city, topic | Your consent | [90] days, or until you withdraw |
| Onboard you as an investor | KYC details, PAN, bank account, nominee, FATCA/CRS — on KRA / BSE StAR MF platforms | Consent; legal obligation (SEBI, PMLA) | Relationship + period required by law |
| Process transactions you instruct | Folio, scheme, amount, bank mandate | Consent; legal obligation | As above |
| Resolve grievances | Contact details, folio, complaint | Consent; legal obligation | [3] years after closure |
| Investor-education updates | Email, WhatsApp number | Separate, optional consent | Until you withdraw |
| Website analytics | Pseudonymous usage data | Optional consent | [13] months |
Who we are
Chalamala Revanth, trading as WealthyVault, is the Data Fiduciary. Privacy contact: Chalamala Revanth, Grievance Officer — [email protected], +91 8801111814.
Who we share it with
Only where needed: KRAs, BSE StAR MF, AMCs and their Registrars (CAMS, KFintech), CKYC Registry, payment aggregators and banks for mandates, and our India-hosted cloud and email processors under contract. Regulators where the law requires. Never sold, never used for advertising.
Children's data
Investments for a minor are made through a guardian; we process a minor's data only with verifiable consent of the parent or lawful guardian, never for tracking or targeted advertising.
Security & breaches
Encryption in transit and at rest, role-based access with logging, and multi-factor authentication for staff. If a breach occurs, we inform affected individuals and the Data Protection Board of India as required.
Your rights
Access, correction, completion, erasure, withdrawal of consent, nomination and grievance redressal. We respond within [30] days; you may also complain to the Data Protection Board of India.
Consent managers & cookies
You may manage consent through a Consent Manager registered with the Data Protection Board, once available. Analytics cookies and embedded maps load only after you opt in.