1.  Introduction

This Privacy Policy describes how Ipofever and its affiliated entities, including Fiscaltown and Bhadani Finance (collectively, “Ipofever”, “we”, “us” or “our”), collect, use, store, share and protect the personal data of individuals who interact with our website www.ipofever.in (the “Website”) and our services.

This Policy is issued in compliance with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and other applicable data protection laws.

2.  Personal Data We Collect

We may collect the following categories of personal data:

2.1  Information you provide directly

  • Identity information.  Name, designation, company affiliation, professional credentials.
  • Contact information.  Email address, phone number, postal address, country of residence.
  • Financial and investor information.  For prospective investors: investor category, investment ticket size, KYC documentation, AUM thresholds, source of funds declarations and other regulatory disclosures required under SEBI, RBI and FEMA.
  • Founder and company information.  For founders: company details, financial information, cap table, business plans and other materials submitted in connection with advisory engagements or Private Boardroom applications.
  • Communications.  Records of correspondence, enquiry forms, application materials, NDAs and engagement documents.

2.2  Information collected automatically

  • Technical data.  IP address, browser type, device identifiers, operating system, referring URLs.
  • Usage data.  Pages visited, time spent, navigation patterns and interactions with the Website.
  • Cookies and similar technologies.  As described in Section 7 below.

3.  Lawful Bases and Purposes of Processing

We process personal data on the following lawful bases and for the following purposes:

  • Consent.  Where you have given clear consent for us to process your personal data for a specific purpose, including marketing communications and Website analytics.
  • Contractual necessity.  To provide advisory services, manage investor relationships, deploy capital through our regulated vehicles, and fulfil our obligations under engagement letters and investment documents.
  • Legal obligation.  To comply with applicable laws including SEBI regulations for AIFs, RBI regulations for NBFCs, FEMA regulations for cross-border transactions, anti-money laundering laws, KYC requirements, and tax reporting obligations.
  • Legitimate interest.  To maintain the security of the Website, prevent fraud, conduct due diligence on counterparties, and improve our services.

4.  How We Share Personal Data

We may share personal data with the following categories of recipients:

  • Affiliated entities within the Ipofever group, including Fiscaltown and Bhadani Finance.
  • Regulators and government authorities including SEBI, RBI, the Income Tax Department, the Financial Intelligence Unit (FIU-IND) and other authorities as required by law.
  • Service providers and professional advisors including auditors, legal counsel, fund administrators, custodians, KYC service providers and IT service providers, all of whom are bound by appropriate confidentiality and data protection obligations.
  • Counterparties to specific transactions, including investor partners, founders and their respective advisors, where such sharing is necessary for the transaction and subject to confidentiality obligations.
  • In connection with corporate transactions, including mergers, acquisitions and reorganisations of the firm or any of its affiliated entities.

We do not sell personal data to third parties for marketing purposes.

5.  International Data Transfers

Given the firm’s engagement with investor partners across the Gulf, Singapore, the United Kingdom and other international jurisdictions, personal data may be transferred outside India. Such transfers are conducted in accordance with applicable Indian data protection laws and any guidelines issued by the Government of India under the DPDP Act regarding permitted countries for cross-border data transfer.

Where personal data is transferred to a jurisdiction with different data protection standards, we implement appropriate safeguards including contractual data protection clauses with recipients.

6.  Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including:

  • The duration of any active engagement, investor relationship or investment held in our regulated vehicles.
  • The longer of: (a) seven years following the conclusion of an engagement or transaction, in line with regulatory record-keeping requirements under SEBI, RBI and tax laws; or (b) any longer period required by applicable law or contract.
  • For Website visitors who do not engage with the firm: such data is retained only for the period necessary for analytics and security purposes, typically not exceeding two years.

7.  Cookies and Tracking Technologies

The Website uses cookies and similar technologies for the following purposes:

  • Strictly necessary cookies.  Required for the Website to function correctly, including session management and security.
  • Analytics cookies.  Help us understand how visitors interact with the Website (e.g. Google Analytics), used in aggregate and anonymised form.
  • Functional cookies.  Remember your preferences and settings to improve your experience on subsequent visits.

You can control or disable cookies through your browser settings. Note that disabling certain cookies may limit Website functionality.

8.  Your Rights

Under the DPDP Act and other applicable laws, you have the following rights with respect to your personal data:

  • Right to access the personal data we hold about you.
  • Right to correction of inaccurate or incomplete personal data.
  • Right to erasure of personal data, subject to our legitimate retention obligations.
  • Right to grievance redressal through our designated grievance officer.
  • Right to nominate another individual to exercise your rights in the event of your death or incapacity.
  • Right to withdraw consent for processing based on consent (without affecting the lawfulness of prior processing).

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 11 below.

9.  Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction, including:

  • Encryption of data in transit and at rest.
  • Access controls limiting personal data access to authorised personnel only.
  • Regular security assessments and updates.
  • Confidentiality obligations on all employees, advisors and service providers handling personal data.
  • Incident response procedures in the event of a personal data breach.

10.  Children’s Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

11.  Contact and Grievance Redressal

For any questions, complaints or requests regarding this Privacy Policy or your personal data, please contact:

Data Protection Officer  ·  Ipofever

dpo@ipofever.in

[Postal address — to be inserted by Legal]

We will acknowledge receipt of your enquiry within seven business days and respond substantively within thirty days, in line with the timelines prescribed under the DPDP Act.

12.  Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, regulatory requirements or technology. The ‘Last updated’ date at the top of this Policy will indicate when it was most recently revised. We encourage you to review this Policy periodically.