This Privacy Policy explains how Vijay Malik Financial Services (“we”, “our”, “us”) collects, uses, shares, and protects your personal data when you visit vmfinancialservices.com or interact with our services.

We are committed to processing personal data lawfully under India’s Digital Personal Data Protection Act, 2023 (DPDP).

1. Data we collect

1.1 Data you provide directly

• Lead form / Contact form: name, email, phone (if provided), subject, message, investment intent and amount (if disclosed).
• Newsletter subscription: email address.
• Unsubscribe requests: email address and timestamp.

1.2 Data collected automatically

• Technical logs: IP address (for rate limiting and security), browser user-agent, timestamp, requested URL, HTTP response code.
• Analytics (Google Analytics 4): anonymised page views, session duration, device category, country/region, referring source. We do not use User-ID linking.
• Advertising cookies (Google AdSense, when enabled): cookies set by Google to serve ads based on your prior visits. See section 5.

2. How we use your data

• To reply to inquiries you submit via lead, contact, or subscription forms.
• To send transactional emails (lead acknowledgement, contact response).
• To send the periodic newsletter / digest only if you opted in. You can unsubscribe via the one-click link in every email.
• To rate-limit abusive requests, prevent spam and fraud.
• To improve the site through aggregated, anonymised analytics.
• To comply with legal, tax, and regulatory obligations (KYC for distribution onboarding).

3. Legal basis for processing (DPDP)

• Consent for marketing emails, AdSense personalised ads.
• Legitimate interest for security logging, rate limiting, basic analytics.
• Legal obligation for AMFI / SEBI / tax record-keeping where applicable.
• Contractual necessity when you onboard with us as a distributor client.

4. Data sharing

We share your personal data only with:

• AMCs / RTAs (Asset Management Companies, Registrar & Transfer Agents like CAMS, KFin) — only when you proceed with an investment transaction.
• Our distribution partners (NJ Wealth, SBI Mutual Fund) — only for transactions you authorise.
• Zoho Mail — for transactional and digest email delivery (we use Zoho SMTP).
• Google (Analytics 4, AdSense when enabled) — for analytics and ads.
• Hostinger — our cloud hosting provider; site logs and database are on Hostinger India infrastructure.
• Law enforcement — when legally required (court order, regulatory request).

We do not sell personal data to third parties.

5. Cookies and advertising

We use cookies for:

• Essential: session, admin authentication (httpOnly, SameSite=Lax cookie, 8-hour lifetime).
• Analytics: Google Analytics 4 (anonymised, with IP anonymization enabled).
• Advertising (when AdSense is enabled):Google sets DoubleClick cookies to serve ads relevant to your prior browsing. Third-party vendors (including Google) use cookies to serve ads based on a user’s prior visits to this and other websites.

You can opt out of personalised Google ads via Ads Settings or visit aboutads.info to opt out of third-party vendor cookies.

6. Data retention

• Leads and contact submissions: retained for 36 months for follow-up and audit.
• Newsletter subscribers: until you unsubscribe.
• Security and access logs: 30 days, then automatically rotated.
• Distribution KYC records: retained as required by AMFI / SEBI (minimum 7 years).

7. Your rights under DPDP

• Right to access — request a copy of the data we hold about you.
• Right to correct — request correction of inaccurate data.
• Right to erasure — request deletion (subject to legal retention obligations).
• Right to grievance redressal — complain to our Data Protection Officer (see Section 9).
• Right to nominate — appoint a nominee to exercise rights in event of incapacity.

8. Security

We use industry-standard safeguards: HTTPS / TLS encryption in transit, encrypted database backups, restricted admin access, rate limiting on public endpoints, and least-privilege server access. No system is 100% secure; we cannot guarantee absolute security.

9. Grievance redressal / Data Protection contact

We respond to DPDP requests within 30 days as required.

10. Children

Our services are intended for adults (18+) only, since mutual fund distribution requires legal capacity to contract. We do not knowingly collect data from minors. If you believe we have inadvertently received data from a minor, contact us at hello@vmfinancialservices.com and we will delete it.

11. Changes to this policy

We may update this policy as our services evolve or as regulation changes. Material changes will be noted with an updated effective date at the top of this page. Continued use of the site after updates constitutes acceptance.