Privacy Policy

1. Information We Collect

We collect the following categories of personal information when you use Ponvalam's services:

• Identity Information: Full legal name, date of birth, PAN number, Aadhaar number (masked post verification), government-issued photo ID.
• Contact Information: Mobile number, email address, residential address, and PIN code.
• Financial Information: Bank account details (for payment processing), UPI handles, and transaction history within the Ponvalam platform.
• Device Information: IP address, browser type, operating system, device identifier, and session data.
• Usage Data: Pages visited, features used, time spent, and interaction patterns on our website and mobile app.

2. How We Use Your Information

We use your personal data for the following purposes:

• To verify your identity and complete mandatory KYC procedures as required by law.
• To process gold purchases, sales, and scheme enrollments on your behalf.
• To send transaction confirmations, account statements, and important service updates.
• To improve our products, services, and customer experience through anonymised analytics.
• To comply with legal, regulatory, and tax obligations including income tax reporting.
• To detect and prevent fraud, money laundering, and other illegal activities.
• To respond to your queries, complaints, and support requests.
• To send marketing communications (only with your explicit consent, which may be withdrawn at any time).

3. Data Sharing & Disclosure

We do not sell your personal data to third parties. We may share your data with:

• Gold Vault Custodians: Licensed vault operators who hold your physical gold on your behalf, requiring your name and scheme details.
• Payment Processors: RBI-regulated payment gateways for transaction processing (e.g., Razorpay, PayU).
• KYC Service Providers: Licensed third-party KYC verification agencies as required by law.
• Legal Authorities: Regulators, law enforcement, or courts when required by applicable law or valid legal process.
• Partner Jewellers: Only at redemption, and only the minimum data required to fulfil your jewellery order.

All third-party partners are contractually obligated to maintain data confidentiality and security standards.

4. Data Security

We employ industry-leading security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Regular penetration testing and security audits by certified third-party security firms.
• Multi-factor authentication (MFA) for account access.
• Role-based access control — employees only access data necessary for their specific role.
• 24/7 security monitoring and incident response protocols.

5. Cookies & Tracking

Our website uses cookies and similar tracking technologies to enhance your experience. Types of cookies we use:

• Essential Cookies: Required for basic website functionality. Cannot be disabled.
• Analytical Cookies: Help us understand how visitors use our website (Google Analytics, anonymised).
• Preference Cookies: Remember your settings and preferences for a personalised experience.
• Marketing Cookies: Only with your explicit consent. Can be withdrawn at any time via cookie settings.

You can control cookie preferences through your browser settings or our Cookie Consent Manager.

6. Your Data Rights

Under applicable Indian data protection law, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data, subject to legal retention requirements.
• Right to Portability: Receive your data in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw consent for marketing communications at any time.
• Right to Object: Object to processing of your data for certain purposes.

To exercise any of these rights, contact us at privacy@ponvalam.com. We will respond within 30 days.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Active Account Data: Retained for the duration of your account relationship with Ponvalam.
• KYC Records: Retained for a minimum of 5 years after account closure as required by PMLA regulations.
• Transaction Records: Retained for 7 years for tax and regulatory compliance purposes.
• Marketing Data: Deleted within 90 days of consent withdrawal.

8. Children's Privacy

Ponvalam's services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a child's data has been inadvertently collected, we will promptly delete it. Parents or guardians who believe their child has provided data should contact us immediately at privacy@ponvalam.com.

9. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. We will notify you of significant changes via email or prominent notice on our website at least 14 days before the changes take effect. Continued use of our services after notification constitutes acceptance of the updated policy.

10. Contact Us

For any privacy-related questions, concerns, or requests: