Privacy Policy

Effective: 12 October 2026

At a glance

• What we collect: the details needed to open your account, complete KYC, and process your mutual fund transactions, plus basic device information for security.
• Why: to run your account and investments, to meet KYC, anti-money-laundering and tax laws, and to keep the Platform secure. Marketing only if you opt in.
• Who sees it: NSE, KYC agencies, CAMS, KFin Technologies, fund houses, your distributor, and the service providers listed in section 5. We never sell your information.
• How long: KYC and transaction records for at least 5 years after your account closes, as the law requires; most other information is deleted within 30 days of closure.
• Your control: you can see, correct or erase your information, withdraw consent, and delete your account in the app at any time.
• Questions or complaints: contact our Data Protection Officer (section 13).

1. Who we are and what this policy covers

Mool Bazaar Asset Private Limited ("Mool Bazaar Asset", "we", "us", "our"), CIN U66190DL2025PTC455312, is an AMFI-registered mutual fund distributor. This policy explains how we collect, use, share and protect personal information when you use:

• our website, moolbazaarasset.com;
• the MoolBazaar: Mutual Funds & SIP app, for investors (the "investor app"); and
• the Mool Bazaar Partner app, for mutual fund distributors and their teams (the "partner app").

The apps are available on Android.

In this policy, the website and both apps together are the "Platform". "You" means anyone whose information we handle through the Platform: website visitors, investors, partners and their team members, and people whose details others give us.

"Personal information" means any information that identifies you, or can reasonably be used to identify you. For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025, we are the data fiduciary for the personal information described here.

2. Information we collect

2.1 When you visit our website

When you send us an enquiry through our contact form, we collect your name, email address, the subject and your message. We also record your IP address, browser type, and the date and time, to respond to you and to keep evidence of your consent. Our contact form uses Google reCAPTCHA to block spam (see section 5).

2.2 When you use the investor app

• Account: your name, mobile number and email address; your password (stored only in a form that cannot be read back) and your app PIN.
• KYC and account opening: your PAN; date and place of birth; gender; marital status; father's and mother's names; address; occupation; annual income; whether you are a politically exposed person; tax residency (FATCA/CRS) details; a photograph of your PAN card; your signature; and a live photograph taken with your phone's camera.
• Aadhaar: a photograph of the front and back of your Aadhaar card, for KYC.
• Bank details: account number, IFSC and proof of ownership, such as a cancelled cheque or the first page of your passbook; and the details of any payment mandate you set up.
• Investments: your orders, SIPs, holdings, folio numbers and transaction history; your goals and risk profile answers; and details of investments made elsewhere that you choose to add yourself.
• Family: details of family members you add (name, date of birth, contact details).
• Support and referrals: your chat messages and queries; your referral code; and, if you install the app from a friend's link, the referral information Google Play provides.

2.3 When you use the partner app

• Account and registration: your name, mobile number, email address, ARN, EUIN and other AMFI details, PAN, date of birth, gender, marital status, occupation and address.
• Bank and nominee details: your bank account, IFSC, cheque details, and your nominee's name, date of birth and contact details.
• Branding: the logo, banner, brand name and profile text you choose to show your clients.
• Your team and prospects: the name, username, mobile number and email address of team members you add, and the names and contact details of prospects you record.
• Your clients: when you onboard or service an investor, you enter and see the information described in 2.2.

2.4 Information about other people

If you give us information about someone else, such as a family member, nominee, client, team member or prospect, you must first tell them what you are sharing and why, and have their consent. Partners must do this under the Partner Terms before entering client or prospect details. When we receive such information, we inform the person where we have their contact details, and we use it only for the purposes in this policy.

2.5 Device and technical information

When you sign in, request an OTP, or when an error occurs, we record your device ID and device name, IP address, and app or browser details. The investor app also stores a notification token so that we can send you alerts. We keep records of the consents you give.

We do not collect your contacts, SMS messages or call logs, and we do not record audio. We do not collect your location.

3. How we use your information

We use personal information only for the purposes below. For each, the table shows what we use and our legal basis: your consent, or a duty the law places on us.

We do not use your personal information for any other purpose without telling you and, where needed, asking for your consent.

4. Consent and legal basis

We process personal information with your consent, which you give when you register and at specific steps such as KYC. Each consent request tells you what information is needed and why. Consent to marketing is separate and optional.

Where a law requires or allows us to process information without separate consent, for example for KYC, anti-money-laundering and tax reporting, we do so on that basis. These are "legitimate uses" under Section 7 of the DPDP Act.

You can withdraw consent at any time, as easily as you gave it (section 9). Withdrawal does not affect processing already carried out. Some services cannot work without the information, and information we must keep by law is retained (section 8).

We follow the Information Technology Act, 2000 and its rules, the DPDP Act and the DPDP Rules, 2025 as they come into force, the Prevention of Money Laundering Act, 2002, and the requirements of SEBI and AMFI.

5. Who we share information with

We do not sell or rent personal information. We share it only as needed for the purposes in section 3:

If your distributor changes. If your distributor transfers their business to another distributor, we will ask for your consent before your information or your account is moved.

Google reCAPTCHA. Our contact form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

Outside India. Some providers, such as Google, may process information outside India. We only transfer information to countries permitted under Indian law, with the safeguards it requires.

Some screens open websites run by others, such as CAMS or KFin Technologies, to request a statement. What you enter there is governed by their privacy policies.

6. App permissions

The apps ask for these permissions on your phone, and use them only as described:

You can turn any of these off in your phone's settings. Some features, such as KYC, will not work without them.

7. Storage and security

Your information is stored on servers operated by our hosting provider. We protect it with reasonable security practices, including:

• encryption of data sent between the apps, the website and our servers;
• passwords stored only in a form that cannot be read back;
• sign-in with OTP, password and app PIN, and access limited to the people who need it;
• statement links that expire and cannot be altered to show another person's statement; and
• security logs, kept for at least one year, that help us detect and investigate misuse.

No system is completely secure. Keep your password, PIN and OTPs private; we never ask for them by phone or email.

If a breach affects your information, we will inform you without delay, and report it to the Data Protection Board of India and CERT-In within the timelines the law sets.

8. How long we keep information

We keep personal information only as long as needed for the purposes in section 3, or as long as the law requires.

When a retention period ends, we delete the information or make it anonymous.

9. Your rights and how to use them

Under the DPDP Act and other applicable law, you have the right to:

• get a summary of the personal information we hold about you and how we use it, and the names of those we have shared it with;
• have inaccurate or incomplete information corrected or updated;
• have your information erased, except what we must keep by law;
• withdraw your consent;
• have your grievances addressed; and
• nominate someone to exercise these rights if you die or become unable to.

How to make a request. Using your rights is free of charge.

1. Email our Data Protection Officer (section 13) from your registered email address, or write to our corporate office. Say which right you want to use.
2. We may ask you to confirm your identity, for example with an OTP to your registered mobile number, so that no one else can see or change your information.
3. We will reply within 30 days. If we cannot do what you ask, for example because the law requires us to keep a record, we will tell you why.
4. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.

Deleting your account

• In the investor app: go to Account, then Settings, then Manage Account, then Delete Account. In the partner app: tap the settings icon on the Home screen, then Manage Account, then Delete Account.
• Without the app: use our account deletion page, or email the Data Protection Officer.

When you delete your account, we close it, sign you out on every device, and stop using your information for services and marketing. We keep the records the law requires for the periods in section 8, and delete the rest.

10. Children

Our apps are for people aged 18 and over. We do not knowingly collect information directly from anyone under 18.

Where an investment is made in a minor's name, it is made and managed by a parent or legal guardian. Before we process a minor's information, we obtain verifiable consent from that parent or guardian. The same applies to children added as family members or nominees. We do not track, profile or target advertising at children.

11. Cookies on our website

Our website uses only the cookies it needs to work. It does not use analytics or advertising cookies.

You can delete cookies at any time in your browser settings. Blocking them may stop the contact form from working.

12. Links to other websites

Our website and apps link to websites run by others, such as fund houses, CAMS and KFin Technologies. This policy does not cover those websites. Please read their privacy policies before giving them any information.

13. Grievance Officer and Data Protection Officer

Our Data Protection Officer is also our Grievance Officer for personal data. Contact them for any question or complaint about your personal information.

• Name: Ajay Kumar
• Designation: Managing Director, Grievance Redressal Officer, Data Protection Officer & Compliance Officer
• Email: info@moolbazaarasset.com (please write "Attn: Data Protection Officer" in the subject line)
• Address: our registered and corporate office in section 14

We will acknowledge your complaint and try to resolve it within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India. Complaints about mutual fund transactions are handled under our Grievance Policy, which has shorter timelines.

14. Changes, governing law and contact

We may update this policy when the law or our services change. The version and date at the top show when it last changed. We will tell you about significant changes in the apps or by email before they take effect, and ask for fresh consent where the law requires.

This policy is governed by the laws of India. Subject to any rights you have under consumer protection law, the courts at Delhi have exclusive jurisdiction.

Mool Bazaar Asset Private Limited
CIN: U66190DL2025PTC455312
Registered & Corporate Office: Innov8, Asset-5A, Aerocity, JW Marriott Hotel Hospitality District, Near IGI Airport, New Delhi – 110037
Email: info@moolbazaarasset.com | Phone: +91 88605 33585