Privacy Policy — Count Infinity Services

1. Introduction & Scope

Count Infinity Services Private Limited (“CIS” or the “Company”) operates a digital platform that facilitates access to and investment in mutual fund schemes offered by third-party asset management companies, in its capacity as a mutual fund distributor and technology platform, subject to the registrations, authorisations and regulatory requirements applicable to its activities. This Privacy Policy describes how CIS collects, uses, stores, discloses and otherwise processes Personal Data in connection with the Platform and the Services.

This Privacy Policy (“Policy”) describes how we collect, use, store, share, and protect your information. This Policy is updated and published in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 (India), read with the Digital Personal Data Protection Rules, 2025 (DPDP Rules), the Information Technology Act, 2000, and all applicable rules thereunder (“Applicable Laws”). By accessing or using any of our platforms, you acknowledge that you have read, understood, and agree to be bound by this .

This Privacy Policy may be updated from time to time, and we encourage you to review it periodically to remain informed of any changes.

2. Definitions

Unless the context otherwise requires, the following terms shall have the meanings assigned to them below:

“Act” means the Digital Personal Data Protection Act, 2023;
“Consent” means free, specific, informed, unconditional, and unambiguous indication of agreement by the Data Principal;
“Data Protection Board”/ “Board” shall mean the Data Protection Board of India established under Section 18 of the DPDP Act, 2023, responsible for adjudicating non-compliance and grievances;
“Data Principal” shall mean the individual to whom the Personal Data relates to. Where the individual is a child (below 18 years), the Data Principal includes the lawful guardian, and shall mean a User under the Terms of Use;
“Data Processor” shall mean any person who processes Personal Data on behalf of a Data Fiduciary;
“Data Fiduciary” shall mean the entity that alone or in conjunction with others determines the purpose and means of processing Personal Data. CIS acts as a Data Fiduciary in relation to processing activities for which it determines the purpose and means of processing;
“Personal Data” shall mean any data about an individual who is identifiable by or in relation to such data;
“Platform” shall be as defined under the Term of Use of CIS.
“Processing” means collection, storage, use, sharing, or deletion of personal data.

Any term not expressly defined in this Policy shall have the meaning assigned to it under the Terms and Conditions governing the use of the Count Infinity Services Private Limited website, web application and related services (“Terms of Use”) or, where not defined therein, under Applicable Laws, as the context may require.

3. Data Collection

Depending on the nature of the User's interaction with the Platform and the Services, CIS may collect and process the following categories of Personal Data, to the extent necessary for the relevant purpose and permitted under Applicable Laws:

Identity and contact information: name, date of birth, residential address, email address, telephone number and other identification details;
KYC and verification information: PAN, KYC status, identification and verification records, and information received from authorised KYC or verification service providers;
Investment and transaction information: mutual fund scheme details, investment and redemption instructions, transaction references, transaction status, holdings or portfolio information made available through the Platform, and related communications;
Banking and payment information: bank account details, payment references, transaction confirmations, reconciliation information and refund details, as applicable to the transaction mechanism;
Account and technical information: account identifiers, login and authentication records, device information, IP address, access logs, cookie identifiers and other technical information, to the extent collected;
Communication and support information: enquiries, complaints, feedback, consent records, communication preferences and correspondence with CIS; and
Other information: any other Personal Data voluntarily provided by the User or lawfully received from relevant third parties for a disclosed and lawful purpose.

4. Mode of Collection

Personal data is collected directly from Data Principals through registration, applications/forms, transactions, and communications, information received from AMCs, RTAs, KYC agencies, banks and payment service providers, and indirectly through cookies, analytics tools, and device identifiers, publicly available data and other information when you interact with us through our website, and other platforms.

5. Consent and Withdrawal

Prior to collecting any Personal Data, CIS shall provide notice to the Data Principal to seek consent, which shall:

Specify the nature of data being collected;
Provide the specified purpose(s) for collecting the data;
Direct Data Principals to the process to withdraw consent at an alternate date, exercise their rights under the Act, and make a complaint to the Board,
Along with any other disclosures/requirements as specified under the Applicable Law.

Consent may be withdrawn by the Data Principal at a later date by writing to [ to be updated ] or reaching out at [ to be updated ] to the Grievance Officer. Please note that withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where a Data Principal withdraws consent, CIS shall cease processing the relevant Personal Data on the basis of that consent, subject to any processing that may lawfully continue under another applicable legal basis. CIS shall erase the relevant Personal Data, and shall cause its Data Processors to erase such data where required, unless retention or further processing is required or permitted under Applicable Laws. CIS may retain records reasonably necessary to demonstrate compliance with its legal and regulatory obligations.

6. Purpose of Processing

CIS processes Personal Data only for specified and lawful purposes and on a basis permitted under Applicable Laws. Depending on the relevant processing activity, this may include:

processing pursuant to valid consent obtained from the Data Principal for the specified purpose;
processing for a legitimate use expressly recognised under the Digital Personal Data Protection Act, 2023, where the relevant statutory conditions are satisfied; and
processing or disclosure required or authorised under other Applicable Laws, to the extent applicable.
CIS shall not treat the existence of a contractual relationship or a general business interest, by itself, as sufficient authorisation for processing Personal Data under the Digital Personal Data Protection Act, 2023. The basis for processing shall be assessed with reference to the relevant purpose, the nature of the Personal Data and the Applicable Laws in force at the relevant time.
comply with applicable legal, regulatory, contractual, and compliance requirements;
maintain internal records, conduct audits, manage business operations, and improve operational efficiency; and
send business-related communications, including product updates, promotional materials, and marketing communications, where permitted under Applicable Law.

The Company processes Personal Data only for the purposes for which it is collected for or as otherwise permitted under the DPDP Act, 2023 and Applicable Laws, and does not process Personal Data for any unrelated purpose unless required or permitted by law. As non-personal information does not personally identify you, we may use and disclose non-personal information at our discretion, subject to Applicable Laws.

7. Processing of Data

CIS may process Personal Data, to the extent necessary and permitted under Applicable Laws, for the following purposes:

creating and administering Accounts by Users and facilitating investor onboarding;
undertaking or facilitating KYC, identity verification, eligibility checks and other applicable compliance procedures;
receiving, transmitting, processing and tracking Transaction Instructions, including investment, redemption, switch and systematic transaction instructions;
facilitating payment processing, transaction reconciliation, refunds and the maintenance of transaction records, as applicable to the relevant transaction mechanism;
communicating transaction status, acknowledgements, account information, service updates and customer support responses;
complying with applicable legal, regulatory, tax, record-keeping and reporting requirements;
protecting the Platform, detecting and preventing fraud, investigating security incidents and safeguarding Accounts;
maintaining, securing and improving the performance and functionality of the Platform, subject to Applicable Laws and the relevant consent requirements; and
sending promotional or marketing communications where permitted under Applicable Laws and subject to any required consent or preference mechanism.

The Company does not sell, rent, or trade your Personal Data to any third party for their independent marketing or commercial purposes.

8. Data Sharing

Subject to Applicable Laws and the purposes disclosed to the Data Principal, CIS may disclose or make Personal Data available to the following categories of recipients, to the extent necessary for the relevant purpose:

asset management companies and their registrars and transfer agents, for investor onboarding, transaction processing, allotment, redemption, servicing and maintenance of investor records;
banks, payment service providers and other authorised payment intermediaries, for payment processing, settlement, reconciliation and refunds, as applicable;
KYC registration agencies, verification providers and other service providers involved in investor onboarding and regulatory compliance;
technology, hosting, cybersecurity, communications and customer-support providers engaged in connection with the Platform;
professional advisers, auditors and insurers, where necessary for their relevant professional functions;
governmental, judicial, regulatory and law-enforcement authorities, where disclosure is required or authorised under Applicable Laws; and
other recipients where the Data Principal has provided the relevant consent or disclosure is otherwise permitted under Applicable Laws.

The role of each recipient, including whether it acts as a Data Processor on behalf of CIS or as an independent Data Fiduciary, shall depend on the actual arrangement and the applicable law. CIS shall implement appropriate contractual and operational safeguards where required.

9. Data Retention

We retain your Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by Applicable Law.

Upon expiry of the retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual, in accordance with Section 8(7) of the DPDP Act, 2023.

10. Data Security

CIS implements reasonable technical and organisational measures, appropriate to the nature of the Personal Data processed and the risks involved, to protect Personal Data against unauthorised access, disclosure, alteration, loss or destruction, in accordance with Applicable Laws.

CIS periodically reviews its security measures and maintains procedures for identifying, responding to and managing security incidents.

11. Your Rights Under the DPDP Act, 2023

As a Data Principal, you have the following rights under the DPDP Act, 2023:

Right to Access - You have the right to obtain a summary of your Personal Data being processed by us and the processing activities undertaken with respect to such data.
Right to Correction - You have the right to request correction of inaccurate or misleading Personal Data, and completion of incomplete Personal Data.
Right to Erasure - You have the right to request erasure of your Personal Data that is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
Right to Grievance Redressal - You have the right to register a grievance with us regarding the processing of your Personal Data and receive a response within the prescribed time.
Right to Nominate - You have the right to nominate any individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.

To exercise any of these rights, please write to us at [ to be updated ] with the subject line “Data Principal Rights Request.” We will verify your identity and respond to your request in accordance with Applicable Law, within a reasonable period.

12. Grievance Redressal

We have established the following internal grievance redressal mechanism in compliance with Section 13 of the DPDP Act, 2023:

Acknowledgement: All grievances submitted to our Grievance Officer will be acknowledged within 48 hours of receipt.
Resolution: We aim to resolve all grievances within 30 days not exceeding 90 days from the date of receipt.
Communication: You will receive updates on the status of your grievance via the email address provided in your request.

Grievance / Compliance Officer: [ to be updated ]
Name: [ to be updated ]
Email: [ to be updated ]
Phone: [ to be updated ]
Address: [ to be updated ]

Escalation: If you are not satisfied with our response, or if your grievance is not resolved within the stipulated period, you may escalate the matter to our senior office [ to be updated ] at [ to be updated ].

If the grievance is still not resolved, you can file a complaint with the Data Protection Board of India established under the DPDP Act, 2023 as prescribed under the Act.

13. Data involving Children and Minors

Our platforms and services are not directed at children under the age of 18. We do not knowingly collect, process, or store Personal Data from children.

In compliance with Section 9 of the DPDP Act, 2023, if we become aware that we have inadvertently collected Personal Data from a child without verifiable parental or guardian consent, we will take immediate steps to delete such data from our records. If you believe we may have collected data from a minor, please contact us immediately at [ to be updated ].

14. Data involving persons with disability

Where the Company processes Personal Data of a person with a disability whose consent is required to be provided through a lawful guardian under Applicable Law, the Company obtains consent from lawful guardian prior to processing such Personal Data. If you believe we may have collected data from a person with disability, who is not eligible to contract as under Section 11 of the Contract Act, without appropriate consent from the lawful guardian, please contact us immediately at [ to be updated ].

15. Cookies and Tracking Technologies

The Company uses cookies to enhance user experience, analyze performance, and provide personalized services. We categorise cookies as follows:

Strictly Necessary Cookies - Essential for platform functionality, authentication, and security. These cannot be disabled without affecting core features (e.g., session management, CSRF protection).
Performance Cookies - Collect anonymized data about how users interact with our platforms (e.g., page load times, error rates) to help us optimise performance.
Functional Cookies - Remember your preferences and settings (e.g., language, region, dashboard layout) to personalise your experience.
Analytics Cookies- They are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc
Marketing Cookies - Used to deliver relevant advertisements and measure campaign effectiveness. These are only activated with your explicit consent.
Managing Your Preferences: You can manage your cookie preferences through our cookie consent banner displayed on your first visit, or at any time through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may limit the functionality of our platforms.

16. Breach Notification

CIS shall maintain procedures for identifying, containing, investigating and responding to Personal Data Breaches. Upon becoming aware of a Personal Data Breach, CIS shall take appropriate steps to mitigate its effects, preserve relevant records, investigate the incident and implement corrective measures.

CIS shall provide notifications to the Data Protection Board of India and affected Data Principals in the manner, within the timelines and subject to the requirements prescribed under Applicable Laws, as and when the relevant provisions become applicable. This includes any applicable requirement for an initial intimation without delay and the submission of further information within the prescribed period.

Nothing in this clause shall be construed as postponing or limiting any breach-reporting obligation that is independently applicable to CIS under another law or regulatory requirement.

17. Third-Party Links

Our platforms may contain links to external websites, services, or applications operated by third parties. These links are provided for your convenience and informational purposes only. We do not control, endorse, or assume responsibility for the content, privacy policies, or practices of any third-party websites.

We strongly encourage you to review the privacy policy of every external website you visit. The Company shall not be liable for any loss or damage arising from your interaction with third-party websites or their handling of your Personal Data, not arising out of Our own negligence, misconduct or fraud.

18. Liabilities

We shall not be liable for any indirect, incidental, consequential, special or exemplary damage(s) arising due to loss of data or use arising out of or in connection with your access or use of or inability to access or use the Platform.

We shall not be liable for any third party products, software or service provided by any third party applications on the Platform. You shall assume all risks arising out of or resulting from any transaction undertaken by you with any third party application on the Platform, and you agree that we shall not be responsible or liable for any loss to you due to your usage of such third party application.

19. Governing Law

This Policy shall be governed by the laws of India and subject to the jurisdiction of competent courts of Delhi.

20. Contact Information

We are committed to protect your personal information collected and processed by us and look forward to your continued support for the same. In case of any questions, requests, feedback or concern regarding protection of your personal information, or any privacy related feedback or concerns you may contact us:

Corporate Office[ to be updated ]

Email[ to be updated ]

Compliance Officer[ to be updated ]