Privacy Policy

This platform is used by two entities owned by the same person:

• Whitestone Capital, a proprietorship and SEBI-registered Research Analyst (Reg. No. INH000020794).
• Whitestone Prime Capital Pvt. Ltd., an AMFI-registered Mutual Fund Distributor (ARN-281897) and PMS distributor (APRN08220).

This section covers only these two entities.

Depending on the services you use, we collect:

• Identity and KYC details: name, date of birth, gender, father's or spouse's name, PAN, address, photograph and signature as held in your KYC record, and details obtained through DigiLocker and Aadhaar-based e-KYC.
• Contact details: e-mail address, mobile number and postal address.
• Bank and mandate details: bank account, IFSC and mandate (auto-debit) details.
• Investment details: nominee details, tax residency (FATCA/CRS), occupation and income range, orders, SIPs, holdings and their values.
• Documents you upload: for example consolidated account statements (CAS), insurance policies and KYC documents.
• Risk profile: your answers to our risk-profile questionnaire and the result.
• Service records: support requests, change requests, communications with us, and your consent and acceptance records.
• Technical data: sign-in records, IP address, device and browser details, and system logs.

• to open and maintain your account and verify your identity (KYC);
• to register you with BSE StAR MF and process your mutual fund orders, SIPs, switches, redemptions and mandates;
• to provide research reports, model portfolios and alerts you subscribe to;
• to show your holdings and reports, including from statements you upload;
• to send you service e-mails, sign-in codes and other messages about your account;
• to handle requests and complaints;
• to meet legal and regulatory duties (SEBI, AMFI, anti-money-laundering and tax laws) and keep the records they require;
• to keep the platform secure and working, and to improve it.

We do not use your data for any purpose not listed here without asking you first.

We do not sell, rent or trade your personal data. We share it only with:

(a) Service providers who process it for us under contract, only for the purposes above:

(b) Market bodies and product providers, as needed to carry out your instructions: BSE (BSE StAR MF); the KYC registration agency (CVL KRA); mutual fund houses and their registrars (such as CAMS and KFin Technologies); portfolio managers for PMS you choose; insurers for insurance you choose.

(c) Regulators and authorities — such as SEBI, AMFI, the RA administration body, FIU-IND, tax authorities and courts — when the law requires.

Where a provider processes data outside India, we transfer it only to countries the Government of India has not restricted under the DPDP Act, 2023.

The two entities share your personal data with each other, in both directions, only as described here. We never sell it.

What is shared: identity and KYC details and documents; contact details; bank and mandate details; transactions and holdings; risk-profile answers and result; and service records (support and change requests, communications, consent records).

Why it is shared:

• to give you one platform and one login for both services;
• to reuse your KYC so you do not repeat it;
• to service your account and handle complaints;
• to meet legal and regulatory duties, including SEBI's requirement to keep research and distribution separate, and the records each entity must keep;
• to prepare reports on your own account.

Data shared between the entities is not used by one entity to offer or sell you the other entity's services. Sharing does not widen who inside Whitestone can see your data: research staff cannot see your mutual fund transactions, and each entity's access is limited to the staff who need it for that entity's service.

We protect your data with encryption in transit, access controls that limit each staff member to the data their role needs, database-level access rules, encrypted backups, and logging of access and changes. No method of transmission or storage is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

Our website uses cookies for session management and to understand how visitors use our public pages. You may disable cookies in your browser settings, though some features may not function properly.

We use the following third-party analytics services, and only on our public marketing pages:

• Google Analytics 4 (Google LLC) — aggregate traffic measurement: pages viewed, referring source, approximate location and device type. IP addresses are anonymised.
• Microsoft Clarity (Microsoft Corporation) — aggregate usability measurement such as scroll depth and click patterns, to identify pages that confuse visitors.

Neither service operates on any page you see after signing in. Your client portal, KYC and document-upload pages, holdings, valuations, bank details and PAN are never transmitted to, recorded by, or accessible to these providers. We also exclude our staff and administrative systems.

We additionally record first-party campaign information — which channel or campaign link brought you to our website — so we can understand which of our communications are useful. This is stored on our own systems, is not shared with any third party, and contains no personal data.

Our services are for persons aged 18 or over. We do not knowingly open an account for a person under 18. An investment for a minor can be made only through the minor's guardian, with the guardian's verifiable consent.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed
• Request correction or completion of inaccurate or incomplete data
• Request erasure of your personal data, subject to records we must retain by law
• Nominate another individual to exercise your rights in the event of death or incapacity
• Grievance redressal, and escalation if your request is not resolved
• Opt out of marketing communications at any time

Withdrawing consent: You may withdraw the consent you gave for processing your personal data at any time, as easily as it was given. Withdrawal does not affect processing already carried out, and certain data must be retained to meet our legal and SEBI obligations (see Data Retention below), so some services may no longer be available to you after withdrawal. How to withdraw: see Your consent and how to withdraw it below.

To exercise any of these rights, or to withdraw consent, contact our Grievance / Nodal Officer, Aditya Patil, at invest@white-stone.co.in. If you are not satisfied with our response, see our Grievance Redressal page (/grievance), or complain to the Data Protection Board of India.

You can withdraw your consent at any time, in either of two ways:

• in the portal, under Account → Your consents → Request withdrawal;
• by e-mail to the Grievance Officer.

From then on we stop processing and sharing your data on the basis of consent. Records the law requires us to keep (for example KYC, transaction and research records) are kept for the required period and used only for that purpose. Withdrawal does not affect anything done before it. Our team will tell you which services can continue; services that depend on this consent, such as transacting through the portal, may stop. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We keep your personal data while your account is open, and afterwards for the periods that SEBI, AMFI, anti-money-laundering and tax laws require us to keep records. After that we delete it or make it anonymous.

This notice is in English. On request, we will give it to you in any language listed in the Eighth Schedule to the Constitution of India. Write to invest@white-stone.co.in.

We will post any change on this page with a new version number and date. When we change how we use your data, we will ask for your consent again in the portal.

Privacy requests: invest@white-stone.co.in

Grievance Officer (both entities): Aditya Patil — grievance.invest@white-stone.co.in

Whitestone Capital and Whitestone Prime Capital Pvt. Ltd., Office No. 1201, Ivory Tower, Pune Satara Road, Bibwewadi, Pune – 411037