Privacy Policy

For the purposes of this Policy:

• "Company", "JSS Capital Market", "we", "us" or "our" — means JSS Capital Market Private Limited, including its authorised employees, representatives and service providers acting on its behalf, as applicable.
• "Platform" — means INVESSTUM, including its website, mobile application, web application, digital interfaces and any other online or electronic platform through which the Company provides or facilitates its services.
• "User", "you" or "your" — means any individual who accesses, browses, registers with or uses the Platform, including prospective investors, investors, customers and persons making enquiries through the Platform.
• "Investor" — means a person who invests or proposes to invest in mutual fund schemes through the Company or otherwise avails investment-related services facilitated through the Platform.
• "Personal Data" or "Personal Information" — means any information relating to an identified or identifiable individual, including information which may constitute personal data under applicable data protection laws.
• "Processing" — includes collection, recording, organisation, storage, use, retrieval, consultation, disclosure, transmission, sharing, updating, alteration, restriction, deletion or otherwise handling Personal Data.
• "Mutual Fund Distributor" or "MFD" — means the Company in its capacity as a distributor of mutual fund products and an AMFI-registered Mutual Fund Distributor.
• "AMC" — means an Asset Management Company managing a mutual fund scheme.
• "RTA" — means a Registrar and Transfer Agent appointed by a mutual fund/AMC for providing registration, transaction processing, investor servicing and related services.
• "Applicable Law" — means all applicable statutes, rules, regulations, circulars, directions, guidelines, notifications and orders issued by competent authorities from time to time, including applicable requirements of SEBI, AMFI, RBI, the Prevention of Money Laundering Act, 2002, applicable KYC requirements, applicable data protection and information technology laws and rules, and other applicable regulatory requirements.

This Policy applies to Personal Data collected or processed by the Company through:

• the INVESSTUM website
• the INVESSTUM mobile application
• registration and onboarding processes
• KYC and account-opening processes
• mutual fund transaction and servicing processes
• electronic communications
• customer support and grievance channels
• telephone calls and other communications
• investor enquiries
• forms, applications and declarations
• cookies and similar technologies
• any other interaction with the Company in connection with its services

This Policy does not apply to websites, applications, products or services operated by third parties, including AMCs, RTAs, banks, payment gateways or other service providers, even where links to such services are made available through the Platform. Such third parties may have their own privacy policies and terms, which should be reviewed separately.

Depending upon the services used by you and the applicable regulatory requirements, we may collect the following categories of information.

3.1 Identification and KYC Information

For onboarding, KYC and regulatory purposes, we may collect:

• full name
• date of birth
• gender, where required
• PAN
• Aadhaar-related information where legally permissible and required
• KYC status and KYC identification details
• CKYC/KRA-related information
• nationality/residential status
• address and address proof
• photograph
• signature
• identity documents
• tax-related information
• FATCA/CRS-related information, wherever applicable
• other information required under applicable KYC and regulatory requirements

3.2 Contact Information

We may collect:

• mobile number
• email address
• residential/correspondence address
• communication preferences
• other contact information provided by you

3.3 Financial and Investment Information

Depending upon the services availed, we may collect:

• bank account details
• cancelled cheque or bank proof
• investment amount
• mutual fund transaction details
• folio details
• portfolio information
• transaction history
• redemption and switch instructions
• nominee details
• financial profile or information required for regulatory or suitability-related purposes, where applicable
• income-related information where required
• other information necessary for processing mutual fund transactions or providing investor services

3.4 Login and Account Information

Where registration is enabled, we may collect username, registered mobile number, registered email address, passwords or authentication credentials, device-related authentication information, login and access records, and other information necessary to maintain account security. Passwords and authentication credentials shall be handled in accordance with appropriate security practices and shall not ordinarily be accessible to our personnel in readable form.

3.5 Transaction and Payment Information

We may collect or receive information relating to investment transactions, purchase/redemption/switch instructions, transaction status, payment status, bank/payment references, payment confirmation details, and UPI or net banking transaction references. Where payment processing is undertaken through a third-party payment gateway or financial institution, payment information may be processed directly by such third party in accordance with its applicable terms and privacy policy.

3.6 Communication Information

We may collect and maintain records of communications with you, including emails, messages, customer support interactions, complaints and grievances, feedback and survey responses. Calls with customer support or relationship personnel may be recorded, where legally permissible, for quality assurance, training, dispute resolution, fraud prevention, compliance and record-keeping purposes.

3.7 Technical and Usage Information

When you use the Platform, we may automatically collect certain technical information, including:

• IP address
• browser type
• operating system
• device information and device identifiers
• application version
• access dates and times
• pages or screens visited
• approximate location information derived from technical data, where applicable
• crash reports and diagnostic information
• log information and interaction data

3.8 Mobile Application Permissions

The INVESSTUM mobile application may request device, SMS/OTP, file/storage and camera permissions where necessary for application operation, authentication, KYC document capture and fraud prevention. SMS/OTP access is used only for authentication or verification and not to read or process unrelated SMS content. You may manage application permissions through your device settings; disabling permissions essential for a particular service may restrict its availability.

3.9 Information Provided Voluntarily

We may collect information voluntarily provided by you, including feedback, reviews, survey responses, queries, complaints, requests, preferences and information provided while communicating with us.

We process Personal Data only for lawful and legitimate purposes and, where required, on the basis of your consent or another lawful basis available under Applicable Law. The purposes may include:

4.1 Investor Onboarding

To create and maintain your account, complete investor onboarding, undertake KYC and related verification, authenticate your identity, verify documents, process account-opening requirements, and comply with applicable regulatory requirements.

4.2 Mutual Fund Transactions

To facilitate and process purchase transactions, additional purchases, redemptions, switches, systematic investment plans, systematic withdrawal plans, systematic transfer plans, nomination-related requests, bank mandate-related requests, and other permitted mutual fund transactions and service requests.

4.3 Regulatory and Legal Compliance

To comply with requirements under Applicable Law, including requirements relating to SEBI, AMFI, KYC, CKYC/KRA, the Prevention of Money Laundering Act 2002, applicable tax laws, FATCA/CRS, investor protection, fraud prevention, audit, record maintenance, regulatory reporting, and lawful requests from governmental, regulatory, judicial or law-enforcement authorities.

4.4 Investor Servicing

To respond to queries, provide transaction updates, communicate account-related information, provide statements and reports, process service requests, address complaints and grievances, and provide customer support.

4.5 Security and Fraud Prevention

To protect the Platform, authenticate users, detect and prevent unauthorised access, identify suspicious transactions, prevent fraud, investigate security incidents, protect investors and the Company, and maintain the security and integrity of our systems.

4.6 Platform Improvement

To maintain and improve the Platform, analyse usage patterns, identify technical problems, improve functionality, conduct internal analytics, and develop and improve investor experience.

4.7 Communication and Service Notifications

We may use your contact information to send transaction alerts, account-related communications, regulatory or compliance communications, service-related notifications, security alerts, changes to terms or policies, and other communications necessary for providing the services.

4.8 Marketing Communications

Where permitted under Applicable Law and subject to applicable consent requirements, we may send information relating to products, services, educational material, investor awareness initiatives or other communications. You may opt out of promotional communications through the mechanism provided in such communication or by contacting us. Withdrawal of consent for marketing communications shall not affect processing necessary for providing services, completing transactions or complying with Applicable Law. For avoidance of doubt, receipt of consent for marketing communications shall not authorise the Company to share investor transactional, portfolio or investment information with group entities, parent companies, affiliates or third parties for independent marketing or cross-selling of non-mutual fund products unless separate and specific consent is obtained where required under Applicable Law.

Depending upon the nature and purpose of processing, Personal Data may be processed:

• with your consent
• for providing services requested by you
• for processing transactions initiated or authorised by you
• for complying with legal and regulatory obligations
• for preventing, detecting and investigating fraud or other unlawful activity
• for maintaining records required by law
• for responding to lawful requests from competent authorities
• for protecting the rights, property and security of the Company, investors and other persons
• for other purposes permitted under Applicable Law

Where processing is based on consent, you may withdraw such consent, subject to applicable legal and regulatory requirements and the consequences explained at the time of withdrawal.

The Company shall process Personal Data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the rules and regulations made thereunder and other applicable data protection requirements, to the extent applicable and as and when the relevant provisions come into force. The Company shall adopt appropriate measures concerning:

• lawful processing of Personal Data
• notice and transparency
• consent management
• purpose limitation
• data security
• retention and erasure
• grievance redressal
• rights and choices available to Data Principals
• other obligations applicable to the Company under Applicable Law

As a Mutual Fund Distributor, the Company is required to comply with applicable KYC, anti-money laundering, investor identification, record-keeping and regulatory requirements. Accordingly, certain information may be collected and processed even where you subsequently request deletion or withdrawal of consent, where retention or processing is required under Applicable Law.

Your information may be verified through authorised KYC Registration Agencies, CKYC systems, registrars, mutual fund entities and other authorised or regulated entities, as applicable. The Company may also undertake appropriate due diligence and verification to prevent fraud, money laundering, terrorist financing, identity theft and other unlawful activities.

We do not sell, rent or commercially trade your Personal Data. We may share Personal Data where necessary and permitted under Applicable Law with the following categories of recipients.

7.1 Mutual Funds and AMCs

Where you invest in mutual fund schemes, relevant information may be shared with the concerned mutual fund, AMC and their authorised service providers for transaction processing, account maintenance, KYC, investor servicing, communication, reconciliation, regulatory reporting and other purposes necessary to administer your investment.

7.2 RTAs and Other Authorised Intermediaries

Information may be shared with RTAs and other authorised intermediaries involved in processing or servicing mutual fund transactions.

7.3 KYC and Registration Agencies

Information may be shared with authorised KYC Registration Agencies, CKYC systems and other entities involved in KYC verification and maintenance.

7.4 Banks and Payment Service Providers

Where necessary to process transactions, information may be shared with banks, payment gateways, payment service providers and other authorised entities.

7.5 Technology and Service Providers

We may engage third-party service providers for hosting, cloud infrastructure, information technology, cybersecurity, customer support, communication, SMS/email delivery, document management, data processing, analytics, audit, fraud monitoring and other operational requirements. Such service providers shall be permitted access only to the extent necessary for the services being provided and shall be required to maintain appropriate confidentiality and security safeguards.

7.6 Third-Party Software Development and Technology Service Providers

The Company may engage third-party software developers, technology providers, cloud service providers, cybersecurity providers, analytics providers and other vendors for developing, maintaining, operating, securing or supporting the Platform. Such third parties may provide services including application development, software maintenance, cloud hosting, data storage, cybersecurity, authentication, OTP/SMS services, email delivery, document management, analytics, application monitoring, customer support and fraud monitoring. Such service providers shall have access to Personal Data only to the extent reasonably necessary for providing their services and shall be subject to appropriate confidentiality, contractual, security and data protection obligations.

7.7 Government, Regulatory and Law-Enforcement Authorities

We may disclose Personal Data where required or permitted by Applicable Law or pursuant to a court order, governmental direction, regulatory direction, statutory requirement, law-enforcement request, or investigation relating to fraud, cyber incidents or unlawful activities.

7.8 Professional Advisers and Auditors

Information may be disclosed to professional advisers, auditors, consultants and other professional service providers where reasonably necessary and subject to appropriate confidentiality obligations.

JSS Capital Market Private Limited distributes Regular Plans of Mutual Fund schemes and receives trail commissions from Asset Management Companies ("AMCs") in accordance with applicable SEBI and AMFI regulations, circulars and guidelines. The commission received by JSS is associated with the distribution of investments under Regular Plans. Details of commissions earned by JSS shall be made available to investors upon request and/or through such disclosures as may be required under Applicable Law, SEBI requirements and AMFI guidelines. Investors are advised to carefully review the applicable scheme-related documents and disclosures before investing.

The Company recognises that investor data is confidential and shall handle such information responsibly. Accordingly:

• Personal Data shall be accessed only by persons who require access for legitimate business, service, regulatory or operational purposes.
• Investor information shall not be disclosed or published in public or private forums without appropriate authorisation or lawful basis.
• Investor transactional, portfolio, KYC and investment-related information shall not be shared with group entities, parent companies, affiliates or third parties for their independent marketing or cross-selling of non-mutual fund products without the investor's specific and informed consent, where such consent is required under Applicable Law.
• Such restriction includes, without limitation, independent marketing or cross-selling of loans, credit cards, insurance products or other non-mutual fund financial products.
• Consent for such independent marketing or cross-selling shall be separate from and shall not be bundled with consent required for account opening, KYC, transaction processing or provision of mutual fund services.
• The Company shall comply with applicable SEBI and AMFI requirements concerning confidentiality, purpose limitation and restrictions on sharing investor data for cross-marketing purposes.
• Where service providers process Personal Data on our behalf, appropriate contractual and security safeguards shall be adopted.
• Data shall be shared only to the extent reasonably necessary for the stated purpose or as required by Applicable Law.

The Company shall comply with applicable SEBI and AMFI requirements relating to protection and sharing of investor data. SEBI has specifically required digital platforms involved in mutual fund distribution to respect user data privacy, including restrictions on sharing investor data between group entities and cross-marketing of group-company products.

The Platform may use cookies, web beacons, pixels, SDKs and similar technologies to improve functionality, security and user experience. Cookies may be used to:

• remember user preferences
• maintain login sessions
• understand Platform usage
• improve performance
• analyse traffic
• detect security issues
• provide relevant functionality

Certain cookies may be necessary for the operation of the Platform, while others may be optional. You may modify your browser or device settings to accept, reject or delete cookies. However, disabling certain cookies may affect the functionality of the Platform. Where required, appropriate consent mechanisms shall be provided for non-essential cookies and similar technologies.

The Platform may contain links to third-party websites, applications or services. These third-party platforms are not controlled by the Company and are governed by their own privacy policies and terms. The Company shall not be responsible for the privacy practices, security practices, content or policies of third-party websites or services. You should review the applicable privacy policy of any third-party platform before providing Personal Data to such platform.

The Company takes reasonable and appropriate technical and organisational measures to protect Personal Data against:

• unauthorised access
• unauthorised disclosure
• alteration
• misuse
• destruction
• loss
• theft
• other reasonably foreseeable security risks

Depending upon the nature of information and applicable requirements, security measures may include:

• access controls
• authentication mechanisms
• encryption or equivalent safeguards
• secure transmission mechanisms
• logging and monitoring
• vulnerability management
• restricted access
• employee confidentiality obligations
• vendor controls
• incident management procedures

Access to Personal Data shall be restricted on a need-to-know basis. However, no electronic system or method of transmission over the internet can be guaranteed to be completely secure. While we take reasonable measures to protect Personal Data, we cannot guarantee absolute security against every possible security threat.

In the event of a suspected or confirmed Personal Data breach or security incident, the Company shall take appropriate steps in accordance with Applicable Law, including:

• identifying and assessing the incident
• taking reasonable steps to contain and mitigate the incident
• investigating the cause and impact
• implementing remedial measures
• maintaining appropriate records
• notifying affected persons or competent authorities, where required by Applicable Law

The Company shall retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected or processed, subject to statutory, regulatory, contractual and legal retention requirements. Under the Prevention of Money Laundering Act, 2002 ("PMLA"), applicable SEBI/AMFI requirements and other Applicable Law, the Company may be required to retain certain investor information, including KYC records, transaction records, AML-related records, communications, audit trails, investor servicing records and regulatory records. Depending upon the nature of the record and applicable legal requirement, such information may be retained for a period of five (5) to eight (8) years or such longer period as may be prescribed under Applicable Law. Closure or deletion of an account, or withdrawal of consent, shall not result in immediate deletion of information where the Company is legally required to retain such information. The Company's statutory and regulatory retention obligations shall prevail over an immediate erasure request to the extent legally required. Once the applicable statutory or regulatory retention period expires, and where the information is no longer required for any lawful purpose, the Company shall take reasonable steps to delete, erase, anonymise or securely dispose of such Personal Data in accordance with Applicable Law.

Subject to Applicable Law and the manner and timing of commencement of the applicable provisions, you may have rights in relation to your Personal Data, including the right to:

• obtain information about the processing of your Personal Data
• access Personal Data maintained by us
• request correction or updating of inaccurate or incomplete Personal Data
• request deletion/erasure of Personal Data where legally permissible
• withdraw consent where processing is based on consent
• raise a grievance regarding the processing of Personal Data
• exercise other rights available under Applicable Law
• nominate another individual to exercise applicable rights in the event of death or incapacity, where such right is applicable under law

Certain rights may be subject to statutory, regulatory, contractual or operational limitations. For example, we may be unable to delete information that we are required to retain under KYC, AML, tax, SEBI, AMFI or other applicable regulatory requirements.

Where consent is required for processing Personal Data, the Company may provide an electronic consent management mechanism through the Platform or another authorised channel. Such mechanism may enable you to:

• provide consent for specified processing purposes
• understand the purposes for which consent is requested
• provide consent through an affirmative action
• withdraw consent where legally permissible
• review applicable consent records
• manage applicable communication or data-sharing preferences

Consent shall not ordinarily be inferred merely from inactivity or silence where Applicable Law requires affirmative consent. Where electronic consent is obtained, the Company may maintain records evidencing the consent, including the date, time, purpose and relevant version of the notice or consent request, as required under Applicable Law. Withdrawal of consent shall not affect processing lawfully undertaken before such withdrawal and shall not prevent the Company from continuing processing where such processing is otherwise permitted or required under Applicable Law.

You are responsible for ensuring that information provided to us is accurate, complete and up to date. You may request correction or updating of Personal Data by contacting us or, where enabled, by using the relevant functionality available on the Platform. For security and regulatory purposes, we may require appropriate verification or supporting documentation before making changes to certain information.

If you create an account on INVESSTUM, you are responsible for maintaining the confidentiality of your login credentials and for activities carried out through your account, subject to Applicable Law. You should:

• use a strong password
• not disclose your password or authentication credentials
• avoid sharing OTPs
• log out from shared devices
• immediately notify us of suspected unauthorised access
• keep your registered contact details updated

The Company will not ordinarily ask you to disclose your password, PIN, OTP or other confidential authentication credentials through unsolicited communications.

The Platform is intended primarily for persons who are legally competent to enter into contracts and undertake investment transactions. We do not knowingly seek to collect Personal Data of children except where such collection is permitted or required under Applicable Law and appropriate safeguards are followed. Where applicable law requires verifiable parental or lawful guardian consent for processing the Personal Data of a child, the Company shall adopt appropriate mechanisms for obtaining and verifying such consent.

The Company uses cloud-based infrastructure and authorised technology service providers for storage, processing, backup, security and management of data relating to the Platform. Personal Data collected through INVESSTUM is stored on cloud servers and infrastructure operated by the Company and/or its authorised service providers. The Company shall implement appropriate technical and organisational safeguards for such cloud-based storage and shall ensure that storage, processing, transfer and access to Personal Data comply with Applicable Law, including applicable data localisation, cross-border transfer, security and regulatory requirements. Where Applicable Law or a competent regulatory authority requires particular categories of data to be stored or processed within a specified jurisdiction, the Company shall comply with such requirement.

Where you provide Personal Data relating to another person, including a nominee, joint holder, authorised representative, guardian or family member, you represent that you are authorised to provide such information and that the information provided is accurate to the best of your knowledge. Where required, the Company may request appropriate confirmation or documentation concerning such person's information.

Employees, representatives, contractors and service providers who have access to Personal Data shall be subject to appropriate confidentiality and security obligations. Access to information shall be restricted based on role, business necessity and applicable internal controls. Any misuse or unauthorised disclosure of Personal Data may result in appropriate disciplinary, contractual or legal action.

We may communicate with you through:

• email
• SMS
• telephone
• push notifications
• WhatsApp or other permitted communication channels
• other electronic or physical communication methods

Certain communications are necessary for providing the services and cannot ordinarily be opted out of, including:

• transaction confirmations
• payment notifications
• security alerts
• KYC communications
• regulatory communications
• account-related notices
• material changes to services or policies

You may opt out of promotional communications where such option is provided.

The Company may process Personal Data for identifying and preventing:

• fraud
• identity theft
• money laundering
• suspicious transactions
• unauthorised access
• cyber incidents
• misuse of accounts
• other unlawful or prohibited activities

Information may be shared with relevant entities or authorities where such sharing is required or permitted by Applicable Law.

As a Mutual Fund Distributor, the Company is required to comply with applicable SEBI, AMFI and other regulatory requirements. The Company may therefore process and retain information necessary for:

• investor identification
• KYC
• transaction processing
• investor servicing
• regulatory reporting
• audits
• inspection
• grievance handling
• fraud prevention
• AML compliance
• investor protection
• other regulatory purposes

The AMFI Code of Conduct for Mutual Fund Distributors requires MFDs to maintain confidentiality of investor data, use data only for the purpose for which it was obtained, protect such data appropriately and comply with applicable data-protection requirements.

We may modify or update this Policy from time to time to reflect:

• changes in applicable laws
• regulatory requirements
• changes to our services
• technological developments
• changes in our data-processing practices
• other legitimate business requirements

The revised Policy shall be published on the Platform with the updated "Last Updated" date. Where required by Applicable Law, we shall provide appropriate notice or obtain consent before implementing material changes. Your continued use of the Platform after the revised Policy becomes effective shall be subject to the updated Policy, to the extent permitted under Applicable Law.

If you have any complaint, concern or grievance regarding:

• collection or processing of your Personal Data
• access or correction of Personal Data
• privacy practices
• unauthorised use or disclosure
• security of your information
• any other privacy-related matter

you may contact the Company's designated Grievance Officer/Data Protection contact at the details below.

Grievance Officer / Privacy Contact

Email: grievance@invesstum.com · Contact Number: 9561401555. The Company shall endeavour to address privacy-related grievances within the timelines prescribed under Applicable Law. Where a separate grievance redressal mechanism is prescribed by SEBI, AMFI, an AMC, RTA or other regulatory authority for a particular matter, you may also avail such mechanism, as applicable.

For questions, requests or concerns relating to this Privacy Policy or the processing of your Personal Data, you may contact us at:

JSS Capital Market Private Limited

Platform: INVESSTUM · Email: support@invesstum.com · Address: 22 Hemanta Basu Sarani, Kolkata, PIN 700001, 6th Floor, Room No. 6E. For requests concerning your Personal Data, we may require reasonable information to verify your identity before processing the request.

This Policy shall be governed by and construed in accordance with the laws of India. Any dispute concerning this Policy shall be subject to the applicable jurisdiction of the courts and authorities having jurisdiction in India, subject to applicable law and regulatory grievance mechanisms.

If any provision of this Policy is held to be invalid, unlawful or unenforceable, such provision shall be interpreted to the maximum extent permissible under Applicable Law, and the remaining provisions shall continue to remain valid and enforceable.

This Privacy Policy forms part of the terms governing your use of the INVESSTUM Platform and shall be read together with the Platform's Terms and Conditions, applicable disclaimers, consent notices and other policies or disclosures. In the event of any conflict between this Policy and a mandatory requirement of Applicable Law, the applicable law or regulatory requirement shall prevail to the extent of such conflict.

The Company may make this Privacy Policy, key privacy notices, consent notices and relevant data protection disclosures available in English and such other Indian languages as may be supported by the Platform, based on the nature of the service and Applicable Law. Where a multilingual version is made available, reasonable steps shall be taken to ensure that material privacy information, consent purposes, rights, choices and relevant disclosures are communicated in a clear and understandable manner. In the event of any inconsistency between translated versions, the version specified by the Company as the legally controlling version shall prevail, subject to Applicable Law.

JSS Capital Market Private Limited

Platform: INVESSTUM · AMFI-Registered Mutual Fund Distributor / ARN Holder.