In short
- We collect only what we need to answer you, run your account and help you invest. We never sell your data or show you ads.
- Sending a form or signing in is your consent for that purpose. You can withdraw it at any time, as easily as you gave it.
- We accept masked Aadhaar only. Documents are encrypted, seen only by the people who serve you, and deleted when no longer needed.
- Your CAS statement is read in your browser and never uploaded. Calculators also run on your device.
- You can access, correct or erase your data, and complain to our grievance officer or the Data Protection Board of India.
Who we are
SIP to Retire (formerly SIPDhara) is run by Sanjay Singh Kushwaha, an AMFI-registered Mutual Fund Distributor (ARN-364557) ("we", "us"). For the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules, we are the Data Fiduciary: we decide why and how your personal data is processed.
This policy is our notice to you under the DPDP Act, and our privacy policy under the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). Contact: contact@siptoretire.com.
What this policy covers
It covers personal data we process through the SIP to Retire website and any future domain or app, our email, SMS and WhatsApp channels, phone calls, and our work as your mutual fund distributor. It does not cover services run by others, such as WhatsApp, Google, AMCs or transaction platforms, which have their own policies.
Personal data we collect
We collect only what we need for the purpose. Some items apply only once you use a feature or invest through us.
| Category | Examples | When |
|---|---|---|
| Request details | Name, mobile number, email (optional), the fund, amount or plan you were looking at, a link to your calculation, your message, language | You send a question, call-back or "invest" request |
| Account | Email address, name, sign-in identifier from Microsoft Entra External ID (and from Google if you use Google sign-in), language, sign-in times | You create or use an account |
| Saved items | Watchlist, alerts and their settings, saved calculations, anonymised portfolio snapshots | You save them while signed in |
| Conversations | Messages and replies on the Service, emails, WhatsApp chats, call notes | You talk to us |
| Investor and KYC details | PAN, date of birth, address, occupation, income range, bank account, nominee details, FATCA/CRS tax residency, signature, photograph, KYC status, folio numbers | You invest, or ask us to help with KYC |
| Documents | PAN card, bank proof, address proof, masked Aadhaar, guardian or entity documents | You upload or send them for KYC or a transaction |
| Transactions | Orders, SIPs, mandates, holdings and statements received from AMCs, registrars and transaction platforms | You invest through us |
| Preferences | Contact channels, alert and newsletter choices, unsubscribe records | You set or change them |
| Technical data | IP address, device and browser type, pages requested, timestamps, security signals from Cloudflare Turnstile, error logs | Any visit |
Financial information (such as bank account details) is sensitive personal data under the SPDI Rules, and we protect it accordingly. If you give us data about another person (for example a nominee, joint holder or minor), please make sure you are allowed to do so and that they know about this policy.
What we do not collect
- Full Aadhaar numbers: masked Aadhaar only, and we do not perform Aadhaar authentication ourselves.
- Passwords: sign-in uses one-time email codes or Google; we never see or store a password.
- OTPs, UPI PINs, card numbers, CVVs or logins of investment platforms.
- Your CAS statement: it is read in your browser and never uploaded (see section 8).
- Biometrics, and data about health, religion, caste or politics.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Reply to your question, call you back, help you invest | Consent you give by sending the request, and data you provide voluntarily for that purpose (DPDP Act s.6 and s.7(a)) |
| Run your account, watchlist, alerts and saved items | Consent you give by signing in and saving them |
| KYC, transactions, SIPs, mandates, nominations, servicing your folios | Your consent and request; legal obligations under PMLA, SEBI and AMFI rules |
| Service messages, sign-in codes, alerts you set | Consent; needed to provide what you asked for |
| Newsletters and promotional messages | Consent, which you can withdraw at any time |
| Security, fraud and abuse prevention, keeping logs | Legal obligations (IT Act, CERT-In directions, DPDP Rules) and legitimate uses permitted by the DPDP Act |
| Regulatory records, audits, inspections, tax reporting (FATCA/CRS), responding to authorities | Legal obligations and legitimate uses under DPDP Act s.7 |
| Handling complaints, legal claims and disputes | Legal obligations and legitimate uses |
| Improving the Service with aggregate, non-identifying statistics | Consent; aggregate data that does not identify you |
We do not sell or rent personal data, we do not use it for advertising networks, and we do not build profiles to show you ads.
Notice, consent and withdrawal
- How you consent. Our forms do not use tick-boxes. Each form shows a short notice, "By sending, you agree to our Terms and Privacy Policy", with links to this page. By choosing to send the form, sign in, upload a document or message us, you give consent for the purpose of that action, as described here. Your consent is recorded with the time it was given.
- Withdrawing consent is as easy as giving it: use the unsubscribe link, reply STOP, delete your account or saved items, or email contact@siptoretire.com. We then stop the processing, except where the law requires us to keep data (see section 11). Withdrawal does not affect processing already done, and we may not be able to help with an investment request without the data it needs.
- Consent managers. When consent managers registered with the Data Protection Board become available, you may also manage your consent through one.
Documents, PAN and masked Aadhaar
- Why: only to help complete KYC, account updates or transactions that you ask for.
- Masked Aadhaar only: as required by the Aadhaar Act, 2016 (section 29) and its regulations, share Aadhaar only with the first eight digits hidden. If a full Aadhaar number reaches us, we will mask it or delete the copy and ask you for a masked one.
- Where KYC happens: KYC is completed on the systems of KYC Registration Agencies, the Central KYC Registry, AMCs, MF Utilities or BSE StAR MF. We send documents only to the platform that needs them for your request.
- Protection: uploads travel over encrypted connections, are stored encrypted, are not publicly accessible, and open only through short-lived signed links.
- Who sees them: only the distributor and any named staff or sub-distributor who services you, bound by confidentiality, on a need-to-know basis; access is logged.
- How long: until the KYC or transaction is complete, and then deleted within 90 days, unless the law requires us to keep a copy as a record (see section 11). You can ask us to delete them sooner.
Portfolio analysis stays on your device
The Portfolio X-Ray reads your Consolidated Account Statement (CAS) PDF inside your browser. The file, its password, your PAN, name and transactions are not uploaded to us. Only public fund data is downloaded to compare returns. If you are signed in and choose to save a snapshot, we store only an anonymised list of holdings (scheme, units and cost, without PAN, name, email or folio numbers), which you can delete at any time.
Where data is stored and transfers
- Email sending by Azure Communication Services is configured with its data location in India.
- Our sign-in directory (Microsoft Entra External ID) is set up with India as its country, and Microsoft keeps its data in its Asia Pacific data centres.
- Cloudflare serves the site from its global network, so requests may be handled at the data centre nearest to you, which may be outside India. Our application data is held in Cloudflare's database and storage services.
- Under section 16 of the DPDP Act, personal data may be transferred outside India except to countries the Government restricts. Where we or our processors transfer data abroad, we do so under contracts and safeguards, and we will follow any data localisation requirement of SEBI or other law for records that must be kept in India.
Data retention and security
How long we keep data
| Data | Kept for |
|---|---|
| Questions, call-back requests and conversations (if you do not invest) | 3 years from our last contact, then erased |
| Account, watchlist, alerts, saved calculations, portfolio snapshots | Until you delete them or your account; accounts unused for 3 years are erased after notice |
| Documents (PAN, bank proof, masked Aadhaar) | Until the KYC or transaction is complete, then deleted within 90 days unless required as a record below |
| Investor, KYC and transaction records, and related communications | While you invest through us and for at least 8 years after the relationship ends or the transaction, or longer if PMLA, SEBI, AMFI, tax law or a pending dispute requires |
| Security and access logs | At least 180 days (CERT-In) and up to 1 year (DPDP Rules) |
| Unsubscribe and consent records | As long as needed to honour your choice and prove consent |
| Backups | Overwritten on a rolling basis, within 35 days |
When a purpose is served and no law requires us to keep data, we erase it or make it anonymous. Where the DPDP Rules require, we will tell you at least 48 hours before erasing data because you have been inactive, so you can log in or ask us to keep it.
How we protect it
- Encrypted connections (HTTPS/TLS) everywhere, and encryption of stored data and backups.
- Sign-in through Microsoft Entra External ID; secure, HTTP-only, signed session cookies; no passwords stored.
- Access only for people who need it, with multi-factor authentication on administrative accounts, and logs of access to personal data.
- Protection against abuse: Cloudflare's network security, the Turnstile human check, rate limits and input validation.
- Service providers chosen for their security certifications (such as ISO/IEC 27001 and SOC 2), under contract.
- Practices modelled on IS/ISO/IEC 27001, as recognised by the SPDI Rules, and the security safeguards in the DPDP Rules, reviewed regularly.
No system is perfectly secure. Please keep your email account and devices safe and tell us at once if you notice anything suspicious.
If a breach happens
If a personal data breach affects you, we will tell you without delay, in plain language: what happened and when, the likely consequences, what we are doing about it, what you can do to protect yourself, and whom to contact. We will report it to the Data Protection Board of India as the DPDP Rules require (including a detailed report within 72 hours of becoming aware), and report cyber security incidents to CERT-In within 6 hours as its directions require.
Messages, alerts and marketing
- Service messages (replies, sign-in codes, alerts you set, transaction and KYC updates) are sent because you asked for them.
- Newsletters, market updates, SIP reminders and offers by email, SMS, WhatsApp or push are sent only if you asked for them or the law allows. Every message tells you how to stop it: an unsubscribe link, STOP reply, or your account settings.
- Email is sent through Azure Communication Services. We record delivery status, not whether you open emails.
AI-assisted features
If we offer AI features (such as summaries or a chat assistant), the text you enter is processed to answer you, by us or a processor under contract that does not use it to train its models. We do not make decisions with legal or similar effect about you by automated means alone. Do not enter identity numbers, passwords or OTPs in AI features.
Your rights
Under the DPDP Act and the SPDI Rules you can:
- Access: get a summary of your personal data we process, the processing, and whom we shared it with.
- Correct, complete and update inaccurate or incomplete data.
- Erase data that is no longer needed, unless the law requires us to keep it.
- Withdraw consent at any time (see section 6).
- Nominate another person to exercise your rights if you die or become incapable.
- Grievance redressal, and then a complaint to the Data Protection Board of India.
Write to contact@siptoretire.com, or use your account page to delete saved items or the account. We may ask you to verify your identity. We respond within 30 days, and in any case within the 90 days allowed by the DPDP Rules. Rights are free of charge.
Children and persons with disability
The Service is meant for adults. A child (a person under 18) can invest only through a parent or lawful guardian. We process a child's personal data only with the verifiable consent of the parent or guardian, as the DPDP Act (section 9) and DPDP Rules require, and only for the child's investments. We do not track, monitor the behaviour of, or target advertising at children. For a person with a disability who cannot decide for themselves, we act on the verifiable consent of their lawful guardian.
NRIs and investors abroad
If you live outside India, we also collect information needed under FEMA and for FATCA/CRS tax reporting, which AMCs and registrars report to Indian tax authorities, who may share it with other countries under tax treaties. If the law of your country gives you further privacy rights, write to us and we will honour them where they apply.
Third-party sites and news
News headlines and many pages link to other sites (regulators, exchanges, AMCs, YouTube). When you follow a link, that site's own privacy policy applies. We do not embed advertising or social-media trackers.
Change of brand, domain or owner
If SIP to Retire changes its name or domain, or the business is transferred (for example to a company formed by the distributor, or in a merger or sale), your personal data may move to the new operator, who must continue to protect it under this policy. We will tell you before that happens.
Changes to this policy
We will update this policy when our services, our providers or the law change. The version and date appear at the top. We will announce material changes on the Service and, if you have an account, by email, at least 15 days before they take effect, and ask for fresh consent where the law requires.
Grievance officer and Data Protection Board
- Grievance officer
- Sanjay Singh Kushwaha
- sanjayskushwaha@gmail.com
- Phone
- +91 99496 84000
We acknowledge complaints within 2 working days and aim to resolve them within 15 days, and in any case within 30 days (and never later than the 90 days the DPDP Rules allow). If you are not satisfied, you can complain to the Data Protection Board of India through its online platform, after using our grievance process. For complaints about mutual fund distribution, see the escalation routes in our Terms (AMC, AMFI, SEBI SCORES, Online Dispute Resolution).
Version 2.1 · Last updated 12 October 2026 ·Back to top