SHEFIN PRIVACY ADDENDUM

Applicable to SheFin Platform

Effective Date: 9th March 2026 | Last Updated: 25th June 2026

1. INTRODUCTION

This SheFin Privacy Addendum supplements the Finanza InvesTek Private Limited Master Group Privacy Policy (“Master Policy”) and applies specifically to the SheFin mobile application, website (www.shefin.org), and related services (collectively, the “Platform”).

In the event of conflict between this Addendum and the Master Policy, this Addendum shall prevail with respect to SheFin-specific data processing activities.

SheFin is a women-focused financial platform operated by Finanza InvesTek Private Limited.

2. ABOUT SHEFIN

SheFin is designed to support women in accessing financial education, financial products, and technology-enabled wealth facilitation tools. SheFin may provide:

• financial literacy content
• investment-related educational resources
• onboarding assistance
• mutual fund distribution facilitation
• insurance facilitation
• financial goal tracking tools
• webinars and community engagement

Nothing contained in the Platform shall be construed as providing investment advisory, tax, legal, accounting, or fiduciary advisory services, unless specifically permitted by applicable law and expressly agreed in writing.

3. PERSONAL DATA COLLECTED

In addition to the data categories described in the Master Policy, SheFin may collect the following platform-specific data.

A. Personal Information

• full name
• date of birth
• age
• gender
• email address
• mobile number
• residential address
• PAN
• Aadhaar or masked Aadhaar (where legally permissible)
• nominee information
• photograph

B. Financial Information

• bank account details
• cancelled cheque copy
• UPI identifiers
• transaction history
• investment records
• portfolio details
• investment preferences
• financial goals
• risk profile

 

Note: Payment card details, UPI credentials, PINs, OTPs, CVV, or other authentication credentials are not stored by SheFin unless required through regulated payment service integrations compliant with RBI guidelines.

C. Device & Technical Information

• IP address
• device ID
• operating system
• app version
• device model
• crash logs
• analytics events
• usage behaviour
• fraud detection signals

D. App Usage Information

• features accessed
• frequency of usage
• session duration
• clicks and navigation events
• educational content engagement
• webinar participation

4. DEVICE PERMISSIONS

To enable core Platform functionality, the SheFin application may request the following limited device permissions. Permissions are requested only when required, through explicit device-level consent prompts. Users may revoke permissions at any time through device settings, though some features may become unavailable as a result.

A. Camera Permission

Used solely for KYC verification, document uploads, profile photo upload, and identity verification.

B. Location Permission (if enabled)

Approximate location may be used for fraud prevention, suspicious login detection, device risk assessment, security monitoring, and regulatory compliance where necessary. We do not use location data for targeted advertising or profiling.

5. BIOMETRIC / FACIAL DATA

SheFin may request facial images or biometric verification data solely for identity verification, KYC compliance, fraud prevention, and prevention of impersonation, in accordance with applicable law.

KYC Methodology

Biometric KYC is conducted via one of the following methods, as applicable:

• Video KYC: conducted in accordance with RBI Master Direction on KYC (updated 2023) and SEBI’s circular on Video-based Customer Identification Process (V-CIP)
• eKYC via UIDAI-licensed KYC User Agency (KUA): where the user is a resident Indian and has provided explicit Aadhaar-linked eKYC consent

Biometric Data Safeguards

Biometric data:

• is processed only for the verification purposes stated above
• is not sold or shared for advertising purposes
• is not used to build behavioural profiles
• may be shared with authorised KYC verification partners strictly for regulatory compliance
• shall be deleted or anonymised once no longer required for lawful processing, where legally permissible

6. PURPOSE OF PROCESSING

SheFin processes personal data for the following purposes:

• account creation and user verification
• KYC compliance and fraud prevention
• onboarding and transaction facilitation
• customer support and service notifications
• product improvement and security monitoring
• operational analytics
• financial education delivery
• event and webinar participation
• marketing communications (subject to specific, affirmative consent where required by the DPDP Act)

7. DATA SHARING

In addition to sharing described in the Master Policy, SheFin may share data with:

• KYC Registration Agencies (KRAs) and mandatory recipients for KYC compliance under SEBI KYC Registration Agency Regulations, 2011
• KYC verification providers and Video KYC partners
• payment processors (subject to RBI data localisation requirements)
• mutual fund transaction platform
• cloud infrastructure vendors (India-resident infrastructure for regulated data)
• analytics and communication service providers
• regulated financial intermediaries

All such entities are required to implement reasonable data protection safeguards. We do not sell personal data.

8. DATA SECURITY

Given the sensitive nature of financial and identity data processed by SheFin, we implement enhanced safeguards including:

• encrypted transmission of sensitive data
• encrypted storage of sensitive identifiers (PAN, Aadhaar records, banking data)
• restricted internal access with role-based permissions
• secure storage systems and authentication controls
• vendor security assessments and contractual data protection obligations
• periodic security reviews and penetration testing

Despite these safeguards, no electronic system is completely secure.

9. DATA RETENTION

Data Category	Retention Period
App account data	Active account + up to 24 months post-inactivity
KYC records	As required by law
Transaction records	5–10 years or longer if required by law
Biometric / facial data	Deleted or anonymised once verification is complete, unless required by law
Analytics data	Up to 24 months
Marketing consent logs	Until withdrawal + applicable audit period
Support communications	As operationally necessary

Data may be retained longer where necessary for fraud investigations, dispute resolution, litigation, or regulatory compliance.

10. PERSONAL DATA BREACHES

In the event of a personal data breach involving SheFin users, we will:

• identify, contain, and assess the breach as soon as practicable
• notify the Data Protection Board of India within the prescribed timeline (approximately 72 hours from discovery, once the Board is constituted)
• notify affected SheFin users promptly where the breach is likely to result in significant harm to their rights
• maintain internal breach records for audit purposes

11. ACCOUNT DELETION

Users may request deletion of their SheFin account by:

• emailing Women.Power@SheFin.org with subject line “Account Deletion Request”, or
• using any in-app account deletion functionality, if available

Upon receiving a deletion request, the account may be deactivated and personal data no longer required for lawful purposes may be erased. Certain records will be retained where required by law, fraud prevention obligations, or mandatory financial record retention requirements under PMLA and SEBI regulations. We will notify you of which data is retained and on what legal basis.

12. YOUR RIGHTS

In addition to rights under the Master Policy, SheFin users may request access to, correction of, or deletion of personal data, withdraw consent, raise a grievance, or nominate another person to exercise their rights in case of death or incapacity. Requests may be sent to Women.Power@SheFin.org with subject line “Privacy Rights Request”.

Note: For unresolved investment-related complaints, you may also raise a complaint on the SEBI SCORES portal at https://scores.gov.in.

13. CHILDREN’S PRIVACY

SheFin is intended only for users aged 18 years and above. We do not knowingly permit minors to create or operate accounts. Information relating to minors may be processed where such minors are nominees, beneficiaries, or dependents under financial products held by an authorised adult user. Such information is used strictly for lawful and regulatory purposes.

14. COOKIES

SheFin’s web platform uses the following categories of cookies:

• Strictly Necessary: Required for platform functionality, cannot be disabled.
• Functional: Enable personalised features.
• Analytics: Help improve the platform, used with consent.
• Marketing: Measure campaign performance, used only with explicit consent.

Users may manage cookie preferences through the cookie consent banner or browser settings.

15. CHANGES TO THIS ADDENDUM

This Addendum may be updated periodically to reflect legal changes, regulatory updates, or platform feature changes. Updated versions will be posted with revised effective dates. Material changes affecting the purposes for which your data is processed will be communicated directly and, where required, fresh consent will be sought.

16. CONTACT

For SheFin-specific privacy concerns:

SheFin Privacy Team

Finanza InvesTek Private Limited

18th Floor, One Horizon Centre, Phase 5, Sector 43, Golf Course Road, Gurgaon – 122002, India

Email: Women.Power@SheFin.org