Privacy Policy

Effective date: 3 July 2026 · Applies to itagfin.com and its Client Portal

This Privacy Policy explains how Green Outdoors Global Private Limited, operating as I Tag Financials ("we", "us"), an AMFI Registered Mutual Fund Distributor (ARN-319081) at Race Course Circle, Vadodara, Gujarat, collects and protects your personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and applicable SEBI/AMFI norms.

1. What we collect

• Contact form: name, mobile, email and your message.
• Client Portal account: full name, mobile, email, and your PAN and Date of Birth — stored only as one-way cryptographic hashes (we retain the last 4 digits of PAN for display). We never store your PAN or DOB in readable form.
• Saved forms (Financial Journey / Will Preparation): the information you choose to enter — family, income, expenses, assets, liabilities, investments, insurance, goals, estate preferences. Stored encrypted (AES-256-GCM).
• Technical logs: IP address, browser type and timestamps of account actions (login, save, erase) for security auditing.

2. Why we collect it (purpose limitation)

• To respond to your enquiries and provide mutual fund distribution and goal-based planning support incidental to it.
• To let you save, resume and retrieve your own forms securely.
• To meet KYC, AMFI Code of Conduct, SEBI and record-keeping obligations.
• To secure the portal (rate limiting, fraud and abuse prevention, audit trail).

We do not sell personal data, do not use it for third-party advertising, and do not share it except with regulators/AMCs where legally required or with our hosting provider as a data processor.

3. Consent

We collect personal data only after your explicit, recorded consent — the checkbox you tick on the contact form, the account-creation modal, or the form submission screens. The consent timestamp and IP are retained as evidence. You may withdraw consent at any time by erasing your data (Section 6) or writing to us.

4. How we protect it

• PAN and DOB: salted SHA-256 hashes; irreversible by design.
• Form data: AES-256-GCM encryption at rest; encryption keys stored outside the web root.
• Transport: HTTPS everywhere (HSTS enforced), Cloudflare protection.
• Access control: 30-minute sessions, HttpOnly/Secure cookies, 5-attempt lockout, full audit log.
• No plaintext identifiers in logs or emails.

5. Retention

Portal accounts and saved forms are retained while your account exists. Contact-form emails are retained as business correspondence. Where SEBI/AMFI record-keeping rules require longer retention of transaction-related records, those rules prevail for those records. Security logs are retained for up to 12 months.

6. Your rights (DPDP Act, 2023)

• Access & portability: download your saved forms anytime (JSON/PDF/Word) from the Client Portal.
• Correction: edit your forms anytime; write to us for account details.
• Erasure: use “Erase My Data” in the Client Portal for immediate, permanent deletion of your account and all saved forms — or write to us and we will action it.
• Grievance: contact our Grievance Officer below; if unresolved, you may approach the Data Protection Board of India, and for investment-service grievances, SEBI SCORES (scores.sebi.gov.in) or SMART ODR (smartodr.in).

7. Cookies

We use one strictly-necessary session cookie (itag_sess) for portal login. No advertising or cross-site tracking cookies are used.

8. Breach notification

In the event of a personal data breach, we will notify affected users and the authorities as required under the DPDP Act, 2023 and CERT-In Directions, 2022.

9. Grievance Officer / Contact

10. Changes to this policy

We may update this policy from time to time; the effective date above will change accordingly. Material changes will be highlighted on this page.

This policy is provided for transparency and does not constitute legal advice; for legal interpretation, consult a licensed legal professional.