Legal

Privacy Policy

Effective 5 November 2026

This policy explains what personal data Sumit Kumar Singh, a SEBI-registered Investment Adviser (individual), trading as Xumit Capital (“we”, “us”) collects through xumitcapital.com, why, and what rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 and our record-keeping duties under SEBI regulations.

1. What we collect

Data	When	Why
Name, email address, mobile number	Sign-up, contact form	To create your subscription, send confirmations, holdings and rebalance updates, and reply to you
PAN and date of birth	Sign-up	KYC verification, which SEBI requires before we can advise you
Risk profile answers (income, investment experience, goals, risk appetite)	Before your portfolio is shared	Risk profiling and suitability assessment required by SEBI
Plan, amount, payment reference	Payment	Billing, GST invoices, refunds and accounting records
Basic technical data (browser type, pages visited)	Website visits	Running and securing the website

We do not collect or store your card numbers, UPI PIN or bank login details. Payments are processed entirely by Razorpay. We never ask for your broker login, password or OTPs.

2. Who we share it with

We do not sell your data or share it for marketing. We share only what is needed with:

• KYC Registration Agencies (such as CVL KRA), to verify your KYC.
• Razorpay, to process payments and refunds.
• Service providers who run parts of our service on our behalf: website hosting (Hostinger), email delivery (Twilio SendGrid) and our contact and CRM system (HubSpot). They may process data outside India under their own security commitments.
• SEBI, BASL and other authorities, when the law requires it.

3. How long we keep it

SEBI requires investment advisers to keep client records, including KYC, risk profiles, agreements and advice given, for at least five years. We keep subscription records for the period required by law and then delete them. Contact-form enquiries that do not lead to a subscription are deleted within 60 months.

4. How we protect it

Data is sent over encrypted (HTTPS) connections and stored on access-restricted servers. Only the adviser and authorised staff can access client records.

5. Your rights

You can ask us to:

• tell you what personal data we hold about you,
• correct or update it,
• delete it, except where the law requires us to keep it (for example, SEBI record-keeping),
• withdraw consent for future processing. This may mean we can no longer provide the service.

Email sumit.singh@xumitcapital.com. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

6. Cookies

The website uses cookies needed for it to work and, where enabled, basic analytics. You can block cookies in your browser settings; some parts of the site may then not work properly.

7. Contact

We may update this policy. The effective date at the top shows when it last changed.