Privacy Policy

About this Privacy Policy

This Privacy Policy explains the types of personal data we collect, the purposes for which we collect and process such personal data, how we use, store, share and protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Our processing of your personal data is governed by the DPDP Act, the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“IT Rules”) and other applicable laws.

Who are we?

Flameback Capital Private Limited, a company incorporated under the Companies Act, 2013 bearing Corporate Identification Number U65999KA2016PTC096684 and having its registered office at # 61, KBG Road, Srirampuram, Bangalore, Bangalore, Karnataka, India, 560021 (“Company”). We are committed to protecting the integrity and security of your personal data while providing our services.

What do we mean by personal data?

By personal data, we mean any data that relates to an identified or identifiable individual. This includes not only the data that directly identifies an individual (such as the phone number associated with your name) but also the data that can be indirectly used to identify an individual (such as investment portfolio information, approximate geographic location etc.).

What kinds of personal data do we collect and when?

We collect only the personal data that we need for providing our services to you. What types of personal data we collect depends on the nature of the service you opt to avail from us, and the nature of your engagement with us on our website.

We collect the following kinds of personal data:

  • When you contact us for your queries: your name, email address, phone number and any other information that you may choose to provide in the Contact Form on our website or while scheduling a call with a Flameback investment advisor.

  • When you are onboarded as a user on our website:

  • Personal information for account creation: your full name, email address, phone number, city, opt-in preference for WhatsApp updates.
  • Financial Information: your age, annual income, expenses, EMI, total assets & liabilities, number of financial dependants, existing investment portfolio, risk appetite, investment goals and preferences.
  • KYC details required by SEBI: your PAN, Aadhaar and photograph.

  • Investment information: starting amount, monthly SIP, investment horizon.

  • When you use our investment advisory services: information regarding your portfolio and transactions which you may provide from time to time by communicating with our investment advisors or by changing your preferences on your account and records of communications, including but not limited to, phone calls received and made for making enquiries or giving feedback.

  • When you visit our website: IP address (anonymised), browser type, device, pages visited, time on page, referrer, and approximate geographic region.

For what purposes do we use your personal data?

We use your personal data only for lawful purposes and after obtaining your consent. The specific purposes for which we use your personal data are:

  • To provide our services: we use your personal data to provide you with our services. This includes onboarding you as a customer, improving the functionality and quality of our services based on the feedback we receive from you, and other internal purposes such as audits, data analysis, system testing and troubleshooting.

  • To communicate with you: we use your personal data to respond to your queries or requests for a scheduled call with a Flameback investment advisor. We will need your personal data to send important communications such as changes in the terms of our service or to this Privacy Policy and updates about the services availed by you. We may also contact you for marketing our services on WhatsApp, if you opt-in for the same during the onboarding process.

  • Security and fraud prevention: we may use your personal data, for preventing fraud, cyber security incidents and other illegal acts, protecting our users and other stakeholders from harm, and controlling and minimising risks.

  • Compliance with the law: we may have to use your personal data to comply with applicable laws such as reporting or record-keeping obligations, or with the orders of courts or government authorities. We may also use your personal data to defend ourselves against legal claims.

With whom do we share your personal data?

We share your personal data only with the following persons and entities:

  • Our personnel and affiliates: Flameback’s employees and personnel managing its services and administering its operations and other corporate entities that are Flameback’s affiliates or sister concerns.

  • Business partners: we often need to avail services from third-parties (including but not limited to financial institutions) to provide our services. When we share your personal data with such partners, we ensure that our business partners protect your personal data by implementing data security safeguards that are compliant with the applicable laws.

  • Auditors and advisors: we may have to share your personal data with our legal advisors, auditors and insurers who shall be bound by their respective professional norms of confidentiality.

  • Data processors: we may share your personal data with third-party Data Processors for processing your personal data on our instructions. We ensure that such third-party processing is in accordance with this privacy policy and applicable laws.

  • Judicial and governmental authorities: we may be obligated under law to disclose your personal data to courts, tribunals, law enforcement agencies, regulatory authorities, and other judicial, quasi-judicial and governmental authorities.

For how long do we retain your personal data?

We retain your personal data only for as long as necessary and permissible under law.

In particular,

  • the DPDP Rules require us to retain personal data and associated logs for a minimum period of one year from the date of last processing, and
  • under applicable SEBI regulations, we are required to maintain client records (which include personal data) for a minimum of five years from the end of your relationship with us.

You have the right to request the deletion of your personal data collected by us. We will make the best efforts to comply with such a request unless retaining your personal data is necessary for us:

  • to continue providing our services to you, or
  • to comply with any law.

What are your rights with respect to your personal data?

The DPDP Act gives you the following rights:

  • Right to obtain a summary of your personal data being processed by us and the processing activities being undertaken with respect to such data;
  • Right to know the identities of other Data Fiduciaries with whom Flameback shares your personal data;
  • Right to the correction and erasure of your personal data;
  • Right to withdraw your consent for the processing of your Personal Data;
  • Right to nominate any other individual to exercise your rights in the event of your death or incapacity (physical or mental);
  • Right of grievance redressal; and
  • Right to make a complaint to the Digital Personal Data Protection Board.

Should you wish to exercise any of the above rights, please reach out to our Grievance Officer using the contact information provided at the end of this Privacy Policy.

Please note that if you withdraw your consent to the processing of your personal data for core operational purposes, then we may no longer be able to provide services to you.

How do we protect your personal data?

Security of your personal data is of utmost importance to us. We use a combination of administrative, technical, and physical measures designed to protect your personal data from unauthorised access, use, transfer, alteration, corruption or destruction. We have implemented the reasonable security standards mandated by the applicable laws including the DPDP Rules and IT Rules.

In the event of a data breach, we will promptly report the incident to:

  • you,
  • the Digital Personal Data Protection Board as required under the DPDP Act, and
  • CERT-In (within 6 hours) as required by the Directions issued by the Central Government under Section 70B of the Information Technology Act, 2000.

What is our cookie policy?

“Cookies” are small text files that are sent to your browser when you are browsing our website. Cookies enable and improve the functioning of our website by remembering information about you. Temporary (session) cookies are stored in your browser’s memory for only as long as you browse our website. Permanent (or persistent) cookies are placed on the hard drive of your device typically for [●], although you may manually delete them at any time.

Based on functionality, cookies on our website are classified broadly into Essential and Non-essential cookies. Essential cookies are required for the regular operation of our website. Non-essential cookies are meant to improve your experience, collect data on the use of our website and for targeted advertising.

You may refuse to consent to our website’s use of Non-essential cookies by clicking on the cookie banner that appears on your screen when you visit our website. You can change your cookie preferences at any time by clicking on the Cookie Preferences link on our website. Rejecting non-essential cookies does not affect your ability to use our services.

How do we handle the personal data of children and differently abled persons?

Our services are not directed at individuals below the age of eighteen (18). We do not knowingly collect personal data of minors without the verifiable consent of their parents or lawful guardians. If you believe we have collected data from a minor, please contact our Grievance Officer immediately.

If you are the lawful guardian of a person with disability and are using our website to avail our services on behalf of such a person, we will observe due diligence to verify that you have been lawfully appointed as the guardian of such person by a competent court or other authority. This is to ensure that you are legally empowered to share the personal data of the person with disability under your care.

How do we address your privacy concerns and queries?

If you wish to:

  • exercise any of your rights under the DPDP Act (which we have listed above)
  • withdraw your consent to the processing of your personal data
  • raise any grievance with respect to the processing of your personal data or
  • ask any query about this Privacy Policy or our privacy practices,

then please feel free to contact our Grievance Officer. The Grievance Officer is the single-point of contact for all your privacy-related communications. The contact details of the Grievance Officer are as under:

We will respond to your queries, requests and complaints typically within 30 days. In the event that you are not satisfied with our handling of your grievance, you may file a complaint with the Digital Personal Data Protection Board.