Privacy Notice

What we collect

• Login credentials: your email address, password (hashed by our authentication provider — never stored or seen by us in plain text), and one-time login codes.
• Device and access metadata: IP address, browser/device identifiers, and timestamps of login attempts, used to detect and prevent unauthorized access.
• Investment and folio records you hold with Munoth Capital Market Limited (MCML), needed to show you your own account statements and documents.
• Records of your consent under this notice, including the notice version, date, and access metadata at the time you consented.

Why we collect it

Solely to authenticate you, secure your account against unauthorized access and credential-guessing attacks, and give you access to your own investment documents and statements. We do not use this data for marketing, and we do not sell or share it with third parties for their own independent purposes. Limited disclosure to regulators (e.g. SEBI) or law enforcement may be required by law.

How long we keep it

• Login/access security logs are retained only as long as needed for fraud prevention — typically a short operational window, not the life of your account.
• Records of your consent under this notice are retained for as long as your account exists, as evidence that consent was given, and are never deleted while your account is active.
• Account and KYC-linked records are retained per SEBI/PMLA recordkeeping norms, which generally require a minimum of 10 years after the end of your relationship with MCML for identification and transaction records, or longer if an investigation, dispute, or regulatory proceeding is ongoing.

Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to: access a summary of the personal data we hold about you and how it is processed; correct, complete, or update inaccurate or outdated personal data; request erasure of personal data that is no longer necessary for the purpose it was collected for (subject to any longer retention MCML is legally required to observe, e.g. the SEBI/PMLA records above); withdraw consent at any time for any processing that isn't otherwise required by law or contract, without affecting the lawfulness of processing before withdrawal; and nominate another individual to exercise these rights on your behalf in the event of death or incapacity. You can review your own consent history from your account page after signing in.

Grievance redressal

If you have a question or complaint about how your personal data is handled, or wish to exercise any right above, contact our Compliance Officer:

• Siddharth Jain, Compliance Officer, Munoth Capital Market Limited
• Email: sjain@munoth.com (data/privacy queries) or grievances@munoth.com (general investor grievances)

We aim to acknowledge grievances promptly and resolve them within 90 days, in line with the DPDP Act, 2023.