Legal Document

Chit Fund Privacy Policy

How chit.fund collects, uses, stores, and protects your personal data — and your rights under the DPDP Act 2023.

✓ DPDP Act 2023 commitments
✓ No data sold to third parties
✓ Data deletion on request
📅 Last updated: 8 June 2026 | 📅 Effective date: 8 June 2026 | 🇮🇳 Governed by the laws of India | ✉ Questions? support@chit.fund
🙋

1. Introduction

This Privacy Policy describes how chit.fund (“we”, “our”, “us”), operated by chit.fund, collects, uses, stores, and protects your personal data when you visit our website or use our services. It addresses our obligations under the Digital Personal Data Protection (DPDP) Act, 2023 (India) and applicable provisions of the Information Technology Act, 2000.

chit.fund is an information portal only. We do not operate chit funds, accept deposits, or provide regulated financial advice. Our services include a chit fund calculator, Advisor tool, operator directory, state regulation guides, newsletter, and research articles.

By using this website, subscribing to our newsletter, using our calculator, registering as an operator, or engaging with any of our services, you acknowledge that you have read and understood this Privacy Policy.

Data Fiduciary (as defined under the Digital Personal Data Protection Act 2023): chit.fund (exact legal entity details to be updated by the site owner — see our Terms and Conditions). For DPDP Act 2023 requests including data access, correction, erasure, or to raise a grievance, contact: support@chit.fund with subject line “DPDP Request”.
📋

2. Data We Collect

2.1 Information You Provide Directly
✱
Name and email address — collected when you subscribe to our newsletter, save a calculator result, complete the Advisor quiz, or use the contact form.
✱
Phone number — optionally provided during operator registration.
✱
Location details (state, city) — provided via the Advisor quiz to match you with relevant operators in your state.
✱
Chit fund preferences (chit value, monthly budget, investment goals) — entered in our Chit Fund Calculator or Advisor form.
✱
Business details (company name, city, state, phone, registration certificate URL) — provided during operator directory listing registration.
✱
Payment information — chit.fund does not currently process payments. If paid services are introduced, this policy will be updated with details of the payment processor used.
✱
Message content — text entered in our contact form for enquiries, corrections, or support requests.
2.2 Information Collected Automatically
✱
IP address and approximate geolocation (country/city level only).
✱
Browser type, operating system, device type — for security logging and performance optimisation.
✱
Pages visited, time on page, referral URL, and clicks — collected via web analytics to improve content quality.
✱
Cookies and similar technologies — see Section 9 below for details.
✱
Server logs — maintained by our hosting provider (AWS EC2, Mumbai region) for security and uptime monitoring.
2.3 Information from Third Parties
✱
Email engagement data (opens, clicks, bounces, unsubscribes) from Brevo, our email service provider.
✱
Payment transaction data — not currently collected (no payment processing active).
⚖️

3. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data only on lawful grounds. The table below maps each purpose to its legal basis.
Purpose of ProcessingLegal Basis (DPDP Act 2023)
Sending newsletters and educational contentConsent — Section 6
Delivering calculator results and personalised recommendationsConsent / Legitimate Use
Processing payments for paid directory servicesContractual necessity
Managing operator directory listingsContractual necessity
Responding to contact form and support enquiriesConsent / Legitimate Use
Compliance, fraud prevention, and legal obligationsLegal obligation / Legitimate Use — Section 7
Security logging and audit trailsLegitimate Use — Section 7
Where we rely on consent as the legal basis, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal. See Section 7 for consent management details.
🔎

4. How We Use Your Data

✓
To send you the chit.fund newsletter, educational articles, and regulatory updates (with your explicit consent).
✓
To deliver your Chit Fund Calculator results and personalised Advisor match.
✓
To process payments for paid directory listing services and send transactional emails (payment confirmations, account alerts).
✓
To manage and verify operator directory listings and route enquiry leads to matched operators.
✓
To respond to support, editorial, and data rights enquiries submitted through our contact form.
✓
To improve our website, measure content performance, and diagnose technical issues.
✓
To comply with our legal obligations under Indian law, including the DPDP Act 2023, the IT Act 2000, and applicable tax legislation.
✓
To detect, investigate, and prevent fraudulent activity, spam submissions, and abuse of our services.
🚫 We do not sell, rent, trade, or otherwise disclose your personal data to third parties for their own marketing purposes.
📅

5. Data Retention

Data CategoryRetention PeriodReason
Newsletter subscriber dataUntil unsubscribe + 90 daysDPDP Act compliance buffer
Calculator and Advisor leads12 months from last interactionLead nurture cycle
Payment records7 yearsIncome Tax Act & GST Act obligations
Operator directory listingsDuration of subscription + 1 yearContractual
Email engagement logs24 monthsSpam and abuse prevention
Security and server audit logs12 monthsCybersecurity compliance
Contact form submissions12 monthsSupport reference
Hard-bounce / suppression listIndefinitePrevents re-adding invalid addresses
After the applicable retention period, personal data is permanently deleted or irreversibly anonymised. Anonymised aggregate data (e.g., traffic statistics) may be retained indefinitely as it cannot identify any individual.
🛡

6. Your Rights Under the DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act 2023, we honour the following rights in line with the Act. To exercise any right, email support@chit.fund — we acknowledge and resolve all requests in compliance with the DPDP Act 2023.
🔍
Right to Access (Section 11)
Request a summary of the personal data we hold about you and the purposes for which it is processed. Subject line: “Data Access Request.”
✏️
Right to Correction (Section 12)
Request correction of inaccurate or incomplete personal data we hold. Please specify which data requires correction and provide the correct version.
🗑️
Right to Erasure (Section 12)
Request deletion of your personal data from our systems and from Brevo. We process deletion requests promptly and send a confirmation. Data subject to statutory retention obligations (e.g., payment records under the Income Tax Act) will be retained for the legally required period then deleted. Subject line: “Data Deletion Request.”
📢
Right to Grievance Redressal (Section 13)
If you believe your data rights have not been respected, raise a grievance with our Data Protection Officer. We acknowledge and resolve grievances in compliance with the DPDP Act 2023.
🚫
Right to Withdraw Consent
Withdraw consent for marketing emails at any time by clicking Unsubscribe in any email, or by emailing us. Withdrawal is processed promptly. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
👥
Right to Nominate
You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity. Contact us at support@chit.fund to register a nomination.
🔒

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

✓
HTTPS / TLS 1.2+ encryption on all web traffic between your browser and our servers.
✓
Encrypted database connections between our application server and MySQL database.
✓
Application password authentication for all REST API access; no plain-text passwords transmitted.
✓
Access controls — personal data is accessible only to authorised personnel on a strict need-to-know basis.
✓
Wordfence security firewall on our WordPress installation for malware scanning and brute-force protection.
✓
Regular security updates to the server operating system (Ubuntu 22.04 LTS), WordPress core, and all plugins.
✓
No payment processing active — chit.fund does not currently process payments. No card data is collected or stored.
⚠️ Personal Data Breach Notification (Section 8, DPDP Act 2023)

In the event of a personal data breach likely to affect you, we will: (1) notify the Data Protection Board of India as required under Section 8(6) of the DPDP Act 2023; (2) notify affected Data Principals without undue delay, describing the nature of the breach, data affected, and mitigation steps taken; and (3) take immediate steps to contain the breach and prevent further unauthorised access.

🍪

9. Cookies & Tracking Technologies

Cookie TypePurposeConsent Required?
Strictly necessarySession management, CSRF security tokens, WordPress login state, LiteSpeed Cache performance optimisationNo — essential for site operation
AnalyticsMeasuring page views, traffic sources, content engagement, and technical performanceYes
Marketing / TrackingEmail open and click tracking via Brevo (only for subscribers who have opted in)Yes — bundled with email consent
You can manage or delete cookies through your browser settings. Disabling analytics or marketing cookies will not affect your ability to use any feature of this website.
🤝

10. Third-Party Service Providers

We share your personal data with the following third-party processors only to the extent necessary to deliver our services. All processors are bound by data processing agreements.
ProviderPurposeData SharedLocation
Brevo (Sendinblue SAS)Email marketing & transactional emailName, email, engagement data (opens, clicks, bounces)EU (France)
Amazon Web Services (AWS)Website hosting — EC2 server, ap-south-1 (Mumbai)Server logs, IP addressesIndia (Mumbai)
n8n (self-hosted)Workflow automation — processes form submissions and routes data internallyForm field data (name, email, preferences)Our AWS EC2 server (India)
We do not permit third-party processors to use your personal data for their own marketing purposes. Each processor is subject to contractual data protection obligations consistent with the DPDP Act 2023.
🌎

11. International Data Transfers

Our primary web server is located in India (AWS Mumbai region). However, Brevo (our email service provider), headquartered in France, may process your email address and engagement data on servers located in the European Union.

Where such cross-border data transfers occur, we ensure appropriate safeguards are in place consistent with Section 16 of the DPDP Act 2023 and applicable cross-border transfer regulations notified by the Central Government of India. Brevo operates under the EU GDPR framework, which provides an equivalent or higher standard of data protection.

👤

12. Children’s Privacy

Our services are directed at adults and are not intended for children under the age of 18 years. We do not knowingly collect personal data from minors. Under the DPDP Act 2023, processing of personal data of children requires verifiable parental consent, which our current services do not support.

If you believe we have inadvertently collected personal data from a person under 18, please contact us immediately at support@chit.fund and we will delete it promptly.

🔄

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, services, or applicable law. When we make material changes, we will:

✓
Update the “Last updated” date at the top of this page.
✓
Send a notice to registered users and newsletter subscribers via email where required by law.
✓
Where a change materially reduces your privacy protections, seek fresh consent where required under the DPDP Act 2023.

Continued use of our website after an update constitutes acknowledgement of the revised policy. We recommend reviewing this page periodically.

✉

14. Data Protection Officer

For all data protection enquiries, access requests, correction requests, deletion requests, grievances, or breach notifications, please contact our designated Data Protection Officer. We handle all requests in compliance with the DPDP Act 2023.

Data Protection Officer
chit.fund
chit.fund — Information Portal
support@chit.fund chit.fund/contact
DPDP Act Compliance

All data rights requests — access, correction, erasure, and grievances — are handled in compliance with the Digital Personal Data Protection Act 2023 and applicable rules notified by the Central Government of India.

This Privacy Policy is governed by the laws of the Republic of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the competent courts in India. If any provision of this policy is found to be unenforceable, the remaining provisions shall continue in full force and effect.
Scroll to Top