Privacy Policy

1. Identity of the Data Fiduciary

Under the DPDP Act, 2023, the Data Fiduciary responsible for determining the purpose and means of processing your personal data is:

2. Principles of Data Minimization (“Only Necessary Data”)

In accordance with Section 6 of the DPDP Act, we strictly observe the principle of data minimization. We do not gather extraneous, non-essential, or intrusive personal data. We collect only what is strictly necessary to evaluate your inquiry, provide wealth management services, and comply with statutory obligations:

• Enquiry & Communication Data: Full name, verified email address, telephone number, area of advisory interest, and the message content you voluntarily submit through our contact forms.
• Client Advisory & KYC Data (Engaged Clients Only): When you formally engage our advisory services, we collect statutory Know Your Customer (KYC) documents, PAN, identity and address proofs, financial goals, asset distribution, and tax residency particulars required by SEBI, RBI, and anti-money laundering (PMLA) regulations.
• Technical & Security Logs: Basic server logs, IP addresses (used strictly for rate-limiting, anti-abuse, and cybersecurity defense pursuant to CERT-In directions), and browser type.

We do not collect sensitive biometric information, religious beliefs, political affiliations, or any personal data belonging to children under the age of 18 through this website.

3. Lawful Grounds and Purpose of Processing

We process your personal data exclusively under legitimate, legally recognized grounds:

1. Consent (Section 6, DPDP Act): By submitting our contact forms or requesting a consultation, you provide voluntary, explicit, and informed consent for our team to contact you regarding your specific financial advisory request.
2. Contractual Necessity: To prepare, administer, and execute wealth management and financial advisory agreements.
3. Legal & Regulatory Compliance: To satisfy mandatory statutory disclosures, audit procedures, prevention of fraud, and reporting requirements stipulated by financial regulatory authorities in India and partner jurisdictions.

4. Cookie & Tracking Technologies Policy

Our website employs a minimal and transparent cookie architecture. We do not engage in cross-site behavioral tracking, nor do we partner with third-party ad networks or data brokers.

You can review, modify, or revoke your cookie choices at any time by clicking: Cookie Preferences.

5. Third-Party Embeds & External Integrations

To assist clients visiting our corporate headquarters, our website embeds an interactive map service provided by Google Maps. We implement stringent technical safeguards to govern this integration:

• Sandboxed Execution: All map iframes operate under strict sandbox restrictions (sandbox="allow-scripts allow-same-origin allow-popups") to prevent unauthorized script execution or storage access.
• Strict Referrer Policy: HTTP headers enforce strict-origin-when-cross-origin, ensuring full URLs and sensitive paths are never leaked to third-party endpoints.
• Content Security Policy (CSP): Our server headers explicitly restrict frame origins strictly to authorized Google Maps domains.

6. Intellectual Property & Image Copyright

All brand marks, emblems, trade names, graphics, logos (specifically including the Alfa Global globe-and-growth-arrow trademark mark), proprietary editorial copy, and visual layouts on this website are the exclusive intellectual property of Alfa Global Wealth Advisors Pvt Ltd. and are protected under the Copyright Act, 1957, the Trade Marks Act, 1999, and applicable international treaties.

No portion of our logos, brand marks, or digital assets may be copied, reproduced, distributed, reverse-engineered, or used in connection with any third-party product without our prior express written authorization.

7. Information Sharing & Third-Party Disclosures

We do not sell, rent, monetize, or trade your personal data. Your information is disclosed only under the following strict conditions:

• Authorized Institutional Partners: Licensed custodians, depository participants, statutory auditors, and designated partner banks necessary for executing your agreed wealth advisory instructions.
• Legal & Regulatory Authorities: Law enforcement agencies, courts, SEBI, RBI, or tax authorities pursuant to lawful process, summons, or statutory mandate.
• Secure Technical Processors: Infrastructure and email dispatch providers who process data under binding confidentiality covenants and robust security standards.

8. Data Security and Technical Safeguards

We employ enterprise-grade administrative, physical, and technical safeguards designed to shield personal data against accidental loss, unauthorized access, destruction, alteration, or disclosure:

• Transport Security: 256-bit TLS/SSL encryption across all web traffic and form submissions.
• Access Controls: Role-based access control (RBAC), multi-factor authentication, and least-privilege principles for advisory personnel.
• Automated Rate Limiting: Sliding-window rate limiters per IP to prevent brute-force attacks and volumetric abuse.

9. Your Rights under the DPDP Act, 2023

As a Data Principal under Indian law, you are endowed with enforceable statutory rights regarding your personal information:

• Right to Access Information (Section 11): Request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Erasure (Section 12): Request the correction of inaccurate or misleading data, the completion of incomplete data, or the erasure of data that is no longer required for the purpose for which it was collected.
• Right of Grievance Redressal (Section 13): Right to have your data protection concerns investigated and resolved expeditiously.
• Right to Nominate (Section 14): Right to designate another individual to exercise your data rights in the event of death or incapacity.
• Right to Withdraw Consent: You may withdraw your consent at any time with ease, without retroactive effect on lawful processing previously completed.

10. Data Protection & Grievance Redressal Officer

In accordance with Section 13 of the DPDP Act, 2023, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, any questions, requests to exercise statutory rights, or privacy grievances should be addressed to our designated Grievance Officer:

11. Amendments to this Policy

We may update this Privacy Policy periodically to reflect changes in regulatory directives, judicial interpretations of the DPDP Act, or enhancements in our service architecture. Any modifications will be posted to this URL with an updated effective date.