Privacy Policy

Introduction & Scope

This Privacy Policy applies to NovaRock Group and its operating subsidiaries, including NovaRock Advisory, NovaRock Technology, and NovaRock Financial (collectively "NovaRock," "we," "us," or "our"). It outlines our practices regarding personal data collection across novarock.co.in, associated subdomains, client portals, and offline advisory engagements.

We process personal data in accordance with the Information Technology Act, 2000 (and associated rules), the Digital Personal Data Protection Act, 2023 (DPDP Act), Securities and Exchange Board of India (SEBI) guidelines, Association of Mutual Funds in India (AMFI) codes of conduct, and international data standards including the EU General Data Protection Regulation (GDPR) where applicable.

Information We Collect

We collect information strictly necessary to provide mutual fund distribution, financial planning, cross-border tax preparation, and technology services:

2.1 Identity & Contact Information

• Full legal name, date of birth, nationality, residential address, and contact numbers.
• Government-issued identifiers: Permanent Account Number (PAN), Aadhaar (masked/offline verification), Passport numbers, Social Security Numbers (SSN), or Individual Taxpayer Identification Numbers (ITIN) for US tax filings.
• Corporate registration credentials, Director Identification Numbers (DIN), and entity tax documents for institutional clients.

2.2 Financial & KYC Data

• Bank account numbers, IFSC codes, investment holdings, transaction records, mutual fund folio numbers, and risk assessment questionnaires.
• Income statements, salary slips, Form 16, Form 26AS, AIS/TIS records, and US W-2/1099 statements.
• FATCA/CRS self-declarations and Central KYC (CKYC) registry records.

2.3 Technical & Analytical Data

• Internet Protocol (IP) address, browser type, device specifications, operating system, referring URLs, and session interaction metrics.
• Aggregate calculator usage patterns and anonymized tool performance diagnostics.

How We Use Information

Your personal and financial information is processed for specific, legitimate business purposes:

• Executing mutual fund investments, systematic investment plans (SIPs), redemptions, and folio creation via registered Asset Management Companies (AMCs) and Registrar and Transfer Agents (RTAs) like CAMS and KFintech.
• Preparing and filing individual and cross-border US federal and state tax returns with the Internal Revenue Service (IRS) under PTIN P03472019.
• Delivering objective portfolio review guidance, risk profiling, and goal-based financial roadmaps.
• Fulfilling mandatory statutory obligations: Anti-Money Laundering (AML) checks, Know Your Customer (KYC) verifications, and SEBI compliance audits.
• Responding to direct client inquiries, scheduling consultations, and transmitting essential transaction alerts.

Legal Basis for Processing

Under the DPDP Act 2023 and GDPR, we process personal information under the following lawful bases:

• Consent: Clear, affirmative consent provided when submitting inquiry forms, onboarding as an advisory client, or subscribing to research briefs.
• Contractual Obligation: Execution of advisory service agreements, portfolio execution mandates, and tax filing engagements.
• Legal Compliance: Adhering to statutory requirements enforced by SEBI, AMFI, the Reserve Bank of India (RBI), the Income Tax Department of India, and the US IRS.
• Legitimate Interests: Securing our technological systems, preventing financial fraud, and ensuring institutional integrity.

Data Sharing & Disclosure

NovaRock Group does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We disclose data strictly to entities essential for service fulfillment:

• Regulatory Authorities: SEBI, AMFI, Financial Intelligence Unit (FIU-IND), Income Tax Department, and the US IRS when required by applicable law or judicial decree.
• Financial Infrastructure Partners: Mutual fund houses (AMCs), RTAs (CAMS, KFintech), clearing corporations (BSE Star MF, NSE NMF II), and custodian banks for trade execution.
• Technology Service Providers: Encrypted cloud hosting providers, form transmission APIs (e.g., Web3Forms for secure enquiry submission), and enterprise communication infrastructure operating under strict non-disclosure agreements.

Cross-Border Data Transfers

Given NovaRock's dual-jurisdiction mandate (India and the United States), tax and financial documentation for Non-Resident Indians (NRIs) and US residents may be transmitted cross-border to prepare IRS filings. All international data transfers comply with statutory cross-border transfer requirements under the DPDP Act 2023 and utilize standard contractual clauses, ensuring data protection standards remain equivalent to Indian law.

Data Security & Encryption

We maintain comprehensive administrative, technical, and physical safeguards to prevent unauthorized access, alteration, disclosure, or destruction of client records:

• Transport Layer Security (TLS 1.3) encryption for all web communications and data transmissions.
• Restricted internal access protocols: financial and tax records are strictly compartmentalized and accessible only by authorized personnel.
• Periodic system audits, automated threat monitoring, and secure database architecture.

Retention of Records

Personal and transaction records are retained only for as long as necessary to fulfill advisory mandates and comply with statutory retention laws:

• SEBI / AMFI Regulations: Client interaction logs, KYC documentation, and transaction advice records are maintained for a minimum of 5 to 8 years as mandated by securities law.
• Income Tax & IRS Regulations: Tax preparation working papers and filed returns are retained for a minimum of 7 years.
• General Inquiries: Contact form submissions with no subsequent advisory relationship are purged after 24 months.

Your Statutory Rights

Subject to statutory exceptions under applicable securities and tax laws, you retain the following rights regarding your personal data:

• Right to Access: Request a summary of your personal data processed by NovaRock.
• Right to Correction: Request the correction of inaccurate or incomplete personal information.
• Right to Erasure: Request data deletion, subject to mandatory regulatory retention requirements.
• Right to Withdraw Consent: Withdraw consent for non-statutory data processing at any time.
• Right of Grievance Redressal: Direct complaints to our designated Data Protection Officer.

Cookies & Tracking Technologies

We use essential and analytics cookies to optimize site navigation, analyze aggregate visitor traffic, and evaluate calculator usage. Non-essential analytics cookies are deployed only after you grant consent via our Cookie Consent banner. You may update your cookie preferences or decline tracking at any time by configuring your browser settings or selecting "Reject Non-Essential".

Third-Party Platforms

Our website may include links to third-party portals, regulatory registries (AMFI, SEBI, IRS), AMC portals, and scheduling tools (Calendly). NovaRock Group is not responsible for the privacy policies, content, or security practices of external websites. We encourage users to review the privacy notices of each third-party platform they access.

Minor's Privacy

Our services and platforms are not directed to individuals under 18 years of age without explicit parental or legal guardian consent. Where investments or folios are created for minor beneficiaries, all data processing is conducted exclusively through authorized parents or legal guardians.

Policy Amendments

NovaRock Group reserves the right to modify this Privacy Policy to reflect regulatory changes, operational updates, or business developments. The updated date will be noted at the top of this page. Material modifications will be highlighted via a site notice or direct client communication.

Grievance Officer & Contact Information

For questions, statutory rights requests, or privacy grievances, contact our compliance desk: