Privacy policy

This policy explains what personal data we collect, why we collect it, whom we share it with, and the rights you have over it. It is written to meet the requirements of the Digital Personal Data Protection Act, 2023 and the regulations of the Securities and Exchange Board of India (SEBI) that apply to us as a Registered Investment Adviser.

1. Who we are

GYR Financial Planners Private Limited (“GYR”, “we”, “us”) is the Data Fiduciary for the personal data described in this policy. Our registered office is at 201 Corporate Arena, Sitaram Patkar Marg, Piramal Nagar, Goregaon (W), Mumbai 400 104.

2. What personal data we collect

• Identity and contact details — name, date of birth, address, PAN, Aadhaar (where required for KYC), email, mobile number, photograph, signature.
• Financial information — income, assets, liabilities, bank and demat account details, existing investments, insurance, tax records, goals and risk profile responses.
• Family details — names and relationships of dependants and nominees, where relevant to your plan.
• Engagement records — emails, call records, meeting notes, WhatsApp messages and forms you submit to us, including the Financial Health Checkup.
• Website data — pages visited, device and browser type, and approximate location, collected through standard analytics tools.

3. Why we collect it

• To assess your financial situation and provide investment advice or financial planning services you have engaged us for.
• To complete KYC, risk profiling and suitability assessment as required by the SEBI (Investment Advisers) Regulations, 2013.
• To execute transactions on your instructions through registered platforms.
• To maintain records for the period SEBI requires and to respond to regulatory inspections, audits and grievance proceedings.
• To communicate with you about your plan, market updates and our services, where you have agreed to receive them.
• To respond to enquiries you make through our website.

4. Data we must collect by law

Some data — KYC documents, risk profile, suitability records and transaction records — is collected because SEBI regulations require it. We cannot provide advisory services without it, and we cannot delete it on request while the retention period set by SEBI is running (currently five years from the end of the engagement, or longer if a dispute or regulatory proceeding is pending).

5. Whom we share it with

We share personal data only where needed to deliver our services or meet a legal obligation:

• Regulators and statutory bodies — SEBI, BSE Administration & Supervision Ltd (BASL), SEBI SCORES and the ODR platform, when required.
• KYC Registration Agencies — for verification and record-keeping mandated under SEBI’s KYC framework.
• Transaction platforms and registrars — MF Utilities, CAMS, KFintech and similar registered intermediaries, only to execute transactions you have instructed.
• Service providers — email, cloud storage, planning software, form and survey tools, and communication platforms that process data on our behalf under contract.
• Auditors and professional advisers — where needed for statutory audit or legal advice.

We do not sell personal data and we do not share it with anyone for their own marketing.

6. How long we keep it

Client records are retained for a minimum of five years after the engagement ends, as required by SEBI, and longer where a regulatory or legal matter is open. Website enquiry data that does not lead to an engagement is deleted within twelve months. Marketing consent lasts until you withdraw it.

7. How we protect it

Data is held on access-controlled systems with encryption in transit and at rest, two-factor authentication on our accounts, and role-based access within our team. Physical documents are stored in locked storage at our office.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• Ask for a summary of the personal data we hold about you and how it is being processed.
• Ask us to correct, complete or update your data.
• Ask us to erase data that we are not required by law to retain.
• Withdraw consent for marketing communications at any time.
• Nominate a person to exercise these rights on your behalf if you are unable to.
• Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

To exercise any of these rights, write to the contact below. We will respond within thirty days.

9. Website and cookies

Our website uses cookies and analytics tools to understand how visitors use it. These do not identify you personally unless you submit a form. You can disable cookies in your browser settings; the site will continue to work.

10. Changes to this policy

We review this policy annually and whenever the law or our practices change. The version number and effective date at the top of this page will tell you when it was last updated.