Privacy Policy

Privacy notice version: 2026-10-14. This version is noted in each consent record we keep, so it is clear which notice applied when a choice was made.

Who is responsible

This website, itagfin.com, is run by Green Outdoors Global Private Limited, which carries on business as I Tag Financials, an AMFI-registered Mutual Fund Distributor (ARN-319081). Its registered office is at 5, Samarpan Society, 26 Haribhakti Society, Race Course Circle, Vadodara, Gujarat 390007, India. In this policy "we" and "us" mean that company. We decide why and how the personal data described here is used.

This policy covers this website and the accounts and tools on it. It does not cover the separate investment transaction platform or the mobile app, which run on third-party technology under their own terms and privacy notices. See Third-Party Platform Disclosure.

The law we follow

We process personal data in accordance with applicable Indian data-protection law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it as they come into force, and the Information Technology Act, 2000 and the rules made under it where they apply. As a mutual fund distributor we are also bound by the confidentiality duties in the AMFI Code of Conduct.

What we collect

When	What
You send an enquiry	Your name, phone number, email address, the topic you choose and your message. The enquiry is emailed to our business mailbox and stored so that we can answer it.
You create an account	Your name, email address and a password. We send an email to verify the address. Your password is never stored in readable form; we keep only a salted one-way hash.
You save a form	Whatever you choose to enter in the Financial Journey or Will Preparation tools, for example family details, income, expenses, assets, liabilities, existing investments, insurance, goals and your wishes for your estate. Saved drafts are encrypted before they are stored.
You use the website	The date and time of account actions such as sign-in, saving a form and deleting the account, and of enquiries. For security and to limit repeated attempts, the website also keeps a keyed one-way hash of your IP address with some of these records, not the address itself. The hosting server's standard web logs may also record IP address and browser type.
You are in touch with our staff	A contact record kept by our staff, described under Our contact record below.
You give or withdraw consent	A consent record: what it was for, whether it is granted or withdrawn, the dates, the version of this notice, and where the choice was made (registration, the contact form, a form page or the dashboard). It is linked to your account, or to your enquiry if you have no account. It does not contain your form entries, your message, your password or your IP address.

The calculators run in your browser. The figures you enter are sent to our server only when you press Download PDF Report, to create the file. They are not stored. To keep the service fair, each download is counted against a limit using a scrambled form of your network address, and the note that a report was downloaded (never the figures) is deleted about 90 days later.

What we do not collect

• We do not ask for your PAN, date of birth, Aadhaar number or bank details to create or sign in to an account.
• We do not collect card or payment details on this website. No investment money is paid through it.
• We do not use advertising or analytics cookies. See the Cookie Policy.

Please do not put PAN, Aadhaar, full bank account numbers, card numbers or passwords in the enquiry form or in free-text fields. KYC documents needed to invest are collected separately through the regulated KYC and transaction process, not through this website's account.

Why we use it

• To reply to your enquiry and, if you ask, to help you with mutual fund distribution services.
• To create and secure your account, verify your email address and let you reset your password.
• To let you save, resume, view and delete your own forms, once you have consented to a form being saved.
• To send you educational updates, newsletters and promotional communications, only if you have opted in.
• To keep the website secure, limit repeated sign-in attempts and investigate misuse.
• To meet legal and regulatory obligations that apply to us.

This website does not pass personal data to advertisers or data brokers, and saved forms are not used for marketing. A saved form, including one you mark as complete, is stored encrypted for your own use. The website does not email it to us. If you choose to share one with us, we use it only to help you with what you asked for.

Our contact record

Our staff keep a contact record in an internal part of this website that only authorised staff of the firm can sign in to. We use it to respond to enquiries and to keep a record of your contact with us.

• What it holds. Your name, email address and phone number, the kind of contact (for example an enquiry or an existing customer), how you came to us, the topic of an enquiry, its status, a follow-up date, the member of staff it is assigned to, and your marketing choice with its date. It also holds a timeline: notes written by our staff, and entries recording changes such as a new status, a follow-up date or a marketing choice.
• Where it comes from. Authorised staff can make a contact record from an enquiry you sent through the website. The text of your message is not copied into it. Staff can also enter a record themselves when you contact us in another way, for example by phone, in person, through a referral, at an event or on social media.
• Your website account. If you have an account on this website and have confirmed its email address, a contact record with the same email address is linked to it automatically. Our administrators can then see that you have an account and the marketing choice you made in it. They cannot see your saved forms.
• Your marketing choice. If a record is made from an enquiry on which you ticked the marketing box, that choice is recorded on it, unless an earlier contact record for your email address shows a withdrawal, or you have a website account with a confirmed email address, whose own marketing choice then applies. Only an administrator can record a marketing consent given in another way, with a note of how and when you gave it. A withdrawal can be recorded by any authorised member of staff and then takes priority.
• Who can see it. Only authorised staff of the firm, after signing in. A member of staff sees the records assigned to them. Administrators see all records and can delete them or export them as a spreadsheet (CSV) file with the name, email address, phone number, type, status, follow-up date and marketing choice. An export needs the administrator's password again, and every export is recorded. Authorised staff can also produce PDF reports from the records they can see.
• How long it is kept. A contact record is kept until our staff remove it. An administrator first deletes the record, which takes it out of the contact book, and can then erase it permanently together with its notes and timeline. Deleting an enquiry does not remove a contact record made from it. Deleting your website account does not remove the contact record either: its link to the account is removed, a marketing consent shown on it is cleared, and a withdrawal stays recorded. You can ask us to delete your contact record.

Consent and withdrawal

We keep three things apart, because they are not the same.

• Consent, which is optional and can be withdrawn. We ask for it in two places. First, for educational updates, newsletters and promotional communications: an unticked box on the registration and contact forms, which you can leave empty. Second, before the Financial Journey or Will Preparation form is first saved to our server: until you agree, what you enter stays in your browser tab and is not sent to us.
• Acknowledgement. To create an account you agree to the Terms of Use and acknowledge that you have read this notice. Before a Will Preparation form is saved you also acknowledge that the tool only gathers information and does not make a Will legally valid. These are not marketing consents.
• Processing needed to answer an enquiry you sent. When you send the contact form we use your details to reply to that enquiry. The box you tick on that form confirms this and nothing more.

Marketing consent never affects whether you can register, send an enquiry or save a form. You can withdraw it at any time: from the Communication preferences section of the dashboard if you have an account, or by writing to us if you gave it on the contact form. Consent to store a form is withdrawn by deleting that draft from the dashboard or the form page, and we ask again before saving it again. The Terms of Use and privacy acknowledgement cannot be withdrawn while you keep the account; deleting the account ends it. The Consent & Data Protection Notice sets out each item. Withdrawal does not affect anything lawfully done before it.

Who we share it with

• Our hosting provider. The website and its database are kept on a shared hosting server provided by HostGator India. It holds the data as a service provider acting for us, in order to provide the hosting service.
• Our email provider. Emails from this website, such as account emails and enquiries, are sent from itagfin@gogpl.in through Google, using its Google Workspace mail service. Our business mailbox is on the same service. Google handles the content of those emails as a service provider acting for us.
• Regulators, courts and law enforcement, where the law requires us to disclose.
• AMCs, registrars and KYC agencies, only if you decide to invest and only as needed for that transaction. This happens through the regulated investment process, not from your website account.

If you would like to know where your data is processed, write to us and we will tell you what we can.

How we protect it

• Passwords are stored only as salted one-way hashes (Argon2id or bcrypt). We cannot read your password.
• Saved form drafts are encrypted at rest with AES-256-GCM.
• The website is served over HTTPS.
• Sign-in uses one HttpOnly session cookie, protection against cross-site request forgery, and limits on repeated attempts.
• Email verification is required before an account can be used.

No system is completely secure. Please choose a strong, unique password and tell us at once if you think your account has been accessed by someone else.

How long we keep it

• Account and saved drafts: until you delete them. Deletion from the dashboard removes them from the live database immediately and permanently. See the Account & Data Deletion Policy. If you register but never confirm your email address, the account is deleted automatically 30 days after registration.
• Consent records: for as long as the account exists. They are deleted with the account. A record for an enquiry is kept with that enquiry.
• Enquiries: for as long as needed to deal with the enquiry and as ordinary business correspondence afterwards. You can ask us to delete an enquiry.
• Contact records: until our staff remove them, as described under Our contact record.
• Security records: for as long as they are needed for security and to meet legal requirements.
• Backups: a backup copy of the database is made every night and each copy is kept for 15 days. Something you have deleted can therefore remain in a backup copy for up to 15 days after deletion.
• Records the law requires us to keep: where SEBI, AMFI or other law requires a record to be kept for a set period, we keep that record for that period even if you ask for deletion.

Your rights

Applicable data-protection law, including the DPDP Act as it comes into force, gives you rights over your personal data. You can ask us for any of the following:

• Access. Ask what personal data of yours we hold and how it is being used. You can view your saved forms at any time from the dashboard.
• Correction. Edit your name and your forms yourself, or ask us to correct or update anything else.
• Erasure. Delete your account and all saved drafts yourself, or ask us to do it.
• Withdraw consent at any time, as easily as you gave it. The dashboard lists the consents on record for your account with their dates.
• Grievance redressal. Complain to us and receive a response.
• Nominate another person to exercise your rights if you die or become incapable.

To use any of these rights, write to us using the contact details below. We do not charge for this.

Children

This website and its accounts are intended for adults aged 18 and over. An account should not be created by or for a minor. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please tell us and we will delete it.

If there is a data breach

If a personal data breach affects you, we will inform you and report it to the relevant authorities as applicable law requires. We will tell you what happened, what it may mean for you and what we are doing about it.

Privacy questions and complaints

Privacy questions, requests and data protection grievances are handled by our Grievance Officer.

Mr. Dev Patel, Grievance Officer
Green Outdoors Global Private Limited (I Tag Financials)
Email: itagfin@gogpl.in
Telephone (office): +91 75750 24455
Post: 5, Samarpan Society, 26 Haribhakti Society, Race Course Circle, Vadodara, Gujarat 390007, India
Monday to Saturday · 09:00 AM – 05:00 PM IST

Please write "Privacy" in the subject line. We aim to acknowledge a privacy request or complaint within 48 hours and to resolve it within 15 days. If you are not satisfied with our response, you may use any further remedy that applicable Indian data-protection law gives you, including a complaint to the authority set up under the DPDP Act where that route is available. Complaints about investment services follow a different route, set out in Grievance Redressal.

Changes to this policy

We will update this policy when the website or the law changes, and the "Last updated" date at the top will change with it. If a change materially affects how we use data you have already given us, we will tell you by email or by a notice on the website. This policy will be updated before any analytics or similar technology is introduced.