Privacy Policy

This Privacy Policy is issued by Fintastic Fincorp, operating under the brand name Track My Funds (hereinafter referred to as "Track My Funds", "We", "Us", or "Our"). We are an AMFI Registered Mutual Fund Distributor carrying Registration Number ARN-309245 and an APMI Registered Portfolio Management Service (PMS) Distributor holding APRN-06118.

Our principal place of business is located at:
S-6, 2nd floor, Ishaan Corporate Tower, C-23, Sector 13, Vasundhara, Ghaziabad, Uttar Pradesh – 201010, India.

Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (collectively referred to as the "DPDP Framework"), Track My Funds acts as a Data Fiduciary with respect to the digital personal data collected, stored, processed, and transmitted through our website (www.trackmyfunds.in), partner portals, communication channels, and physical inquiry offices.

In adherence to Section 5 and Section 6 of the DPDP Act, 2023 and the DPDP Rules, 2025:

• Itemized Notice: Prior to or at the time of requesting your consent, Track My Funds provides an itemized notice stating clearly the specific personal data requested and the exact purpose for which such data will be processed.
• Unconditional & Affirmative Consent: Your consent is obtained through explicit, unambiguous, and affirmative action (such as opt-in checkboxes or validated OTP verification). We never use pre-ticked consent boxes or bundled consent agreements.
• Multilingual Accessibility: As mandated by the DPDP Rules, Data Principals possess the option to view consent notices and access privacy communications in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India upon request.
• Right to Withdraw Consent: You have the absolute right to withdraw your consent at any time as easily as giving consent. Withdrawal may be exercised by contacting our Grievance Officer at info@trackmyfunds.in. Upon withdrawal, we shall cease processing your personal data, subject to lawful statutory retention obligations under financial regulatory and anti-money laundering laws.

In strict adherence to the principle of Data Minimization, Track My Funds collects only the personal data that is strictly necessary to perform distribution, transaction facilitation, and statutory compliance:

Your personal data is collected and processed exclusively for specified, explicit, and legitimate purposes:

1. Mutual Fund & Investment Distribution: Setting up investor folios, executing financial transactions with Asset Management Companies (AMCs), Registrar & Transfer Agents (RTAs like CAMS and KFintech), and accredited exchange platforms (BSE StAR MF / NSE NMF II).
2. Mandatory Statutory KYC/AML Compliance: Fulfilling statutory requirements under the Prevention of Money Laundering Act (PMLA), 2002, statutory KYC guidelines, AMFI regulations, and Income Tax legislation.
3. Portfolio Reporting & Account Servicing: Providing portfolio statements, capital gains statements, calculation estimates (SIP, PPF, Goal Plan), dividend notifications, and periodic performance reviews.
4. Customer Support & Redressal: Responding to investor inquiries, advisory requests, and resolving grievances in a timely manner.
5. Fraud Prevention & Cyber Defense: Monitoring suspicious access, verifying transactional integrity, and maintaining secure login environments.

Pursuant to Section 9 of the DPDP Act, 2023:

• Verifiable Parental Consent: Where mutual fund investments are made in the name of a minor (child below 18 years of age), processing of such minor's personal data is conducted only after obtaining verifiable consent from the parent or lawful guardian.
• Prohibition on Behavioral Tracking: Track My Funds does not engage in behavioral monitoring, tracking, or targeted advertising directed at children, nor do we process children's data in any manner detrimental to their well-being.
• Persons with Disabilities: Consent for individuals with physical or mental disabilities who have a lawful guardian appointed shall be verified through such lawful guardian in accordance with the DPDP Rules, 2025.

Under Sections 11, 12, 13, and 14 of the DPDP Act, 2023, you possess the following statutory rights which you may exercise without fee:

To execute mutual fund investments and fulfill our fiduciary distributor duties, Track My Funds shares personal data strictly on a need-to-know basis under binding data processing agreements with:

• Asset Management Companies (AMCs) & Mutual Fund Houses: For folio creation, unit purchase, redemption, and regulatory reporting.
• Registrar & Transfer Agents (RTAs): Authorized entities including Computer Age Management Services (CAMS) and KFin Technologies Limited (KFintech).
• Accredited Transaction Infrastructure: Regulated exchange transaction platforms (BSE StAR MF, NSE NMF II, MFU) and payment gateway aggregators authorized by the Reserve Bank of India.
• KYC Registration Agencies (KRAs): Certified KYC repositories for identity validation.
• Statutory & Law Enforcement Authorities: Exclusively where strictly mandated under applicable Indian law, judicial summons, or lawful regulatory directives.

Track My Funds stores and processes your digital personal data within secure data servers located in the Republic of India. In accordance with Section 16 of the DPDP Act, 2023, transfer of personal data outside India will only occur if permitted by the Central Government and subject to countries not restricted on the negative list, while strictly ensuring identical levels of statutory data protection.

In adherence to Section 8(5) of the DPDP Act, Track My Funds deploys robust administrative, physical, and technical safeguards to protect personal data against loss, unauthorized access, destruction, or disclosure:

• Transport Layer Security (TLS): 256-bit SSL encryption on all digital communications and web sessions.
• Encryption at Rest: Cryptographic storage for all sensitive identifiers and financial documents.
• Access Controls: Multi-factor authentication (MFA) and strict role-based access restrictions for all advisory and operational staff.
• Audits & Vulnerability Checks: Periodic system audits, log monitoring, and regular vulnerability assessments.

Personal data shall not be retained longer than necessary to fulfill the specified purpose for which it was collected. However, as an AMFI registered entity, Track My Funds is legally subject to mandatory statutory retention rules:

• Anti-Money Laundering Laws (PMLA): Client KYC documents, transaction logs, and folio account records are legally required to be maintained for a statutory period of at least 5 to 8 years following the termination of the business relationship or completion of transaction.
• Tax & Accounting Records: Financial records are maintained as prescribed under the Income Tax Act, 1961.
• Secure Erasure: Upon expiration of the statutory retention window, data is permanently erased or irreversibly anonymized using secure electronic shredding standards.

Under Section 8(6) of the DPDP Act, 2023, in the unlikely event of a confirmed personal data breach affecting your records:

• Track My Funds shall notify the Data Protection Board of India (DPBI) without delay and within the timeframe mandated by the DPDP Rules, 2025.
• We shall concurrently notify every affected Data Principal directly via email or SMS, detailing the nature of the breach, the personal data involved, the likely consequences, and the immediate mitigation measures recommended.
• Our technical response team will initiate containment and forensic investigation protocols immediately.

In accordance with Section 13 of the DPDP Act, 2023 and the DPDP Rules, 2025, Track My Funds has appointed a dedicated Grievance Redressal Officer to address all privacy questions, consent withdrawals, and statutory requests: