Privacy Policy
How your personal data is collected, used and protected under the Digital Personal Data Protection Act, 2023
Last updated: 25 August 2026
Who We Are
Data Fiduciary
This website, investfirst.co.in, is operated by Amol Deshmukh, trading as InvestFirst. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), I act as the Data Fiduciary for the personal data described in this policy. That means I determine why and how your personal data is processed, and I am accountable to you for it.
Registration and Contact
Amol Deshmukh is an AMFI Registered Mutual Fund Distributor holding ARN-220322, and a licensed insurance advisor under IRDAI regulations.
Data Fiduciary: Amol Deshmukh (InvestFirst)
AMFI Registration: ARN-220322
Email: amol@investfirst.co.in
Address: Kolhapur, Maharashtra, India
Who This Policy Covers
This policy applies to anyone who visits this website or submits information through it. Under the DPDP Act you are the Data Principal — the person the data is about — and the rights set out below are yours to exercise at any time.
What Personal Data Is Collected
Information You Give Directly
Personal data is only collected when you choose to submit it through a form on this website. Nothing on this list is gathered in the background.
- Contact enquiry form: your full name, email address, phone number, the service you are interested in, and the message you write.
- Equity research course enquiries: your name, mobile number and email address, submitted when you request course material.
- Course waitlist: your name, mobile number, email address and the user type you select, submitted when you join the waitlist.
Technical Information
This website sets no cookies. It runs no analytics, no advertising pixels and no tag managers. Your browsing is not tracked across pages, sessions or other websites, and no profile is built about you.
Some technical information is nevertheless unavoidable, because it is inherent in how any website is delivered over the internet:
- Server request logs. The site is hosted on Google Firebase Hosting, which records standard request data such as your IP address, the time of the request and your browser's user-agent string. This is handled by Google as part of delivering the site.
- Google Fonts. The site loads the Poppins typeface from Google's font servers. Doing so discloses your IP address and user-agent to Google. No font request carries your name, email or any form data.
- Local browser storage. The Firebase software library creates two small technical databases in your browser. One records that the library is running; the other exists to hold an administrator sign-in token. Neither contains personal data for ordinary visitors, and no sign-in token is stored unless a site administrator logs in on that device.
Services Not Yet Launched
Services under development — including a portfolio health check and loan planning assistance — would by their nature need more sensitive information, such as income, existing liabilities and investment holdings. None of that is collected today. This policy will be updated, and your consent sought afresh, before any such service accepts data.
Why It Is Collected, and On What Basis
Consent
The lawful basis for processing is your consent, given at the moment you submit a form. Consent is sought for a specific, stated purpose, and it is free, informed and unconditional. You are never required to provide personal data to read this website.
Purpose Limitation
Each category of data is used only for the purpose it was given for, and for nothing else:
- Contact enquiries are used to reply to your enquiry and to discuss the service you asked about.
- Course enquiries are used to send you the material you requested and to answer questions about the course.
- Waitlist entries are used to notify you when the course opens.
What Is Never Done With Your Data
Your personal data is not sold. It is not rented, traded or otherwise transferred to anyone for their own commercial use. It is not shared with third parties for marketing or advertising. Submitting an enquiry about one service does not sign you up to receive unrelated promotional messages.
How Your Data Is Stored and For How Long
Where It Is Held
Form submissions are stored in Google Cloud Firestore, part of Google Firebase. Google acts as a Data Processor, holding and processing the data on my instructions and on my behalf. I remain the Data Fiduciary and remain accountable to you for it.
Retention
Your data is kept only for as long as it is needed for the purpose you gave it for, or for as long as a legal or regulatory obligation requires it to be kept — whichever is longer. Once neither applies, it is deleted. You may ask for erasure at any time, and doing so does not require you to give a reason.
Security Measures
Stated plainly, and limited to what is actually in place:
- All traffic between your browser and this website is encrypted in transit using HTTPS.
- Firestore security rules govern access to the stored data. Enquiry records can be submitted by the public but cannot be read back by site visitors; read and administrative access is restricted to the authenticated site owner.
- Administrative access requires an authenticated sign-in and is limited to a single account.
No claim is made to any security certification, formal audit or encryption standard beyond what is described above. No method of transmission or storage over the internet is completely secure, and absolute security cannot be guaranteed.
Your Rights as a Data Principal
The DPDP Act gives you the following rights over your personal data. To exercise any of them, email amol@investfirst.co.in from the address you used, or tell us how to identify your record. There is no charge.
Right to Access Information
You may ask for a summary of the personal data being processed about you, what it is being processed for, and the identities of anyone it has been shared with.
Right to Correction and Completion
You may ask for inaccurate or misleading data to be corrected, for incomplete data to be completed, and for out-of-date data to be updated.
Right to Erasure
You may ask for your personal data to be erased. It will be deleted unless it must be kept to comply with a legal obligation, in which case you will be told why.
Right to Withdraw Consent
You may withdraw your consent at any time. Withdrawing consent is as easy as giving it — a single email to the address above is enough, with no form to complete and no reason required. Processing stops on withdrawal. Withdrawal does not make earlier processing unlawful, and it may mean an enquiry already in progress can no longer be answered.
Right of Grievance Redressal
You have the right to a readily available means of raising a grievance about how your data is handled. See the section below. If a grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India.
Right to Nominate
You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. To register a nomination, email the address above with the nominee's name and contact details.
Grievance Officer
If you have a complaint about how your personal data has been handled, you may raise it with the Grievance Officer.
Grievance Officer: Amol Deshmukh
Contact: amol@investfirst.co.in
Address: Kolhapur, Maharashtra, India
How Quickly You Will Hear Back
Every grievance is acknowledged within 48 hours of being received, so you know it has reached a person. It is then resolved within 30 days of receipt. If a matter is complex enough that it needs longer, you will be told before that deadline passes, along with the reason and a revised date.
If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India. Raising it with me first is not a precondition to doing so — it is simply usually faster.
Other Important Disclosures
Personal Data Breach
In the event of a personal data breach, I undertake to notify each affected Data Principal and the Data Protection Board of India, in the manner and within the timelines required by the DPDP Act and the rules made under it. Notification to you will describe what happened, what data was involved, and what you can do about it.
Children's Data
This website and its services are intended for adults. Personal data is not knowingly collected from anyone under the age of 18 without verifiable consent from a parent or lawful guardian, as required by the DPDP Act. No tracking, behavioural monitoring or targeted advertising is directed at children — none is carried out at all. If you believe a child has submitted personal data here, email amol@investfirst.co.in and it will be deleted.
Third Parties
Personal data is shared only where it is necessary to deliver the service you asked for, and only with:
- Asset Management Companies (AMCs) and BSE StAR MF, where you choose to proceed with a mutual fund transaction. These platforms are required to process your details to execute and record the transaction and to meet their own regulatory obligations.
- Insurance companies, where you choose to proceed with an insurance proposal, for underwriting and policy issuance.
- Google Firebase, as the hosting and database processor described above.
- WhatsApp, where you choose to start a conversation using a WhatsApp link on this site. That conversation happens on WhatsApp's platform and is subject to WhatsApp's own privacy terms. No WhatsApp message is initiated by this website — the first message is always yours.
Personal data may also be disclosed where disclosure is required by law, by a regulator, or by an order of a court or other competent authority.
Changes to This Policy
This policy may be updated as services change or as the law and the rules under the DPDP Act develop. The "Last updated" date at the top of this page always reflects the current version. Where a change materially affects how your personal data is used, your consent will be sought again rather than assumed. Please review this page from time to time.
Questions About Your Data?
If anything here is unclear, or you want to access, correct or delete the information held about you, just ask. Every request is answered.