Privacy Policy

This Privacy Policy explains how Alice Blue Financial Services Pvt. Ltd. (“Alice Blue”, “we”, “us” or “our”) collects, receives, records, stores, organises, uses, analyses, shares, transfers, protects, retains and deletes Personal Data in connection with its securities-broking, depository, account-opening, trading, customer-support, website, mobile application, API and other digital or related services.

This Policy is intended to provide a clear and transparent account of our personal-data practices. It does not limit any statutory rights available to a Data Principal and does not override any mandatory securities-market, depository, KYC/AML, tax, judicial, law-enforcement, cyber-security or other legal obligations that apply to Alice Blue.

Additional notices or consents may be presented at the point where specific Personal Data is collected. Those notices supplement this Policy and may describe additional details relevant to a particular service, processing purpose or legal requirement.

This Policy applies to Personal Data relating to existing and prospective clients, investors, account holders, nominees, guardians, authorised persons, beneficial owners, directors or representatives of non-individual clients, website and mobile-app visitors, API users, customer-support users, event or campaign participants, business contacts, job applicants and other individuals who interact with Alice Blue.

Employee and contractor Personal Data may also be governed by internal workforce privacy notices, employment documentation and HR policies. Where such a notice is provided, it supplements this Policy for the relevant workforce processing.

For purposes of this Policy, terms such as “Data Fiduciary”, “Data Principal”, “Personal Data”, “Processing”, “Consent Manager”, “Data Processor”, “Personal Data Breach”,” Significant data fiduciary”, “Data Protection Board of India”, “Anonymized data” and “child” have the meanings assigned to them under applicable data-protection law, to the extent such provisions are in force. “Regulatory Data” refers to information that Alice Blue is required to create, receive, maintain, process, retain or make available under applicable SEBI, Exchange, Depository, Clearing Corporation or other securities-market requirements.

Key Terms Used in this Policy

Alice Blue applies privacy and data-protection requirements proportionately to the nature, context, purpose and risk of processing. Our programme is guided by the following principles:

• Lawfulness and transparency

  Personal Data is processed for lawful, defined and communicated purposes.

• Purpose limitation

  Personal Data is not used for materially incompatible purposes unless permitted by law and, where required, supported by fresh notice or consent.

• Data minimisation

  We seek to collect and use only Personal Data reasonably necessary for the relevant purpose and legal obligation.

• Accuracy

  Reasonable steps are taken to keep material client and regulatory records accurate, complete and up to date.

• Storage limitation

  Personal Data is retained only for as long as necessary for the stated purpose, legitimate operational needs, legal claims, fraud prevention or mandatory regulatory retention.

• Security and resilience

  Administrative, technical, physical and contractual safeguards are maintained to protect confidentiality, integrity and availability.

• Accountability

  Processing activities, vendors, incidents, rights requests, retention and security controls are governed through defined roles, records and oversight.

Depending on the relationship, product, channel and applicable legal requirements, Alice Blue may collect or generate the categories of Personal Data listed below. Not every category applies to every individual or service.

We may receive Personal Data directly from you and, where permitted or required, from regulated or authorised third parties. Sources may include:

• Information you provide through account opening, KYC, forms, applications, websites, mobile applications, support channels, email, telephone, APIs or other interactions.
• KYC Registration Agencies (KRAs), CKYCR/other authorised KYC utilities, depositories, stock exchanges, clearing corporations, banks, payment providers and other financial-market infrastructure entities.
• Authorised agents, business partners, referral partners, service providers, vendors and processors supporting onboarding, verification, communications, infrastructure, fraud prevention or support.
• Publicly available or legally accessible records, regulatory lists or databases used for compliance, due diligence, AML or fraud-prevention purposes.
• Your device, browser, application and network when you access Alice Blue digital services, subject to applicable permissions and controls.
• Another person acting lawfully on your behalf, including a guardian, nominee, authorised representative, director, partner or signatory.

Alice Blue uses Personal Data only where it has a lawful and defined purpose. Depending on the service and applicable law, purposes may include:

• Opening, verifying, activating, maintaining, servicing, modifying, suspending and closing trading or demat accounts.
• Performing KYC, identity verification, AML/PMLA controls, sanctions screening, beneficial-owner verification and ongoing client due diligence.
• Providing trading, depository, account, funds, reporting, support, API and other products or services requested by the client.
• Processing orders, instructions, pay-ins/pay-outs, settlements, pledges, margins, corporate actions, statements, contract notes and related market operations.
• Complying with SEBI, Exchange, Depository, Clearing Corporation, KRA, tax, judicial, law-enforcement, CERT-In and other legal or regulatory requirements.
• Preventing, detecting, investigating and responding to fraud, account takeover, market abuse, suspicious activity, security incidents and unauthorised access.
• Managing financial, operational, credit, margin, exposure, technology, cybersecurity, business-continuity and vendor risks.
• Providing customer service, responding to grievances, resolving disputes, investigating complaints and maintaining evidence of communications and decisions.
• Operating, monitoring, securing, debugging, maintaining and improving websites, applications, APIs, infrastructure and user experience.
• Conducting internal audit, assurance, compliance testing, legal review, record management and governance.
• Communicating service notices, regulatory updates, transaction or security alerts, product information and other relationship communications.
• Providing marketing or promotional communications where permitted and subject to applicable consent/opt-out requirements.
• Analysing aggregated, de-identified or appropriately protected information to improve products, capacity, performance, risk controls and service design.
• Protecting legal rights, responding to legal claims and conducting corporate or business transactions subject to appropriate safeguards.

Where the Digital Personal Data Protection Act, 2023 applies, Alice Blue will process Personal Data on the basis of consent or legitimate use permitted under the Act, and in accordance with other applicable law. A significant portion of securities-market processing is also required to comply with legal and regulatory duties that apply to stock brokers and Depository Participants.

Where consent is required, Alice Blue will seek consent through a clear notice describing the Personal Data and specified purpose. Consent may be obtained electronically or through another legally valid mechanism. If the purpose changes materially, Alice Blue will provide additional notice and obtain fresh consent where required.

Withdrawal of consent will not affect processing already lawfully carried out before withdrawal and will not require Alice Blue to erase or stop processing records that must be retained or processed under securities-market, KYC/AML, tax, cyber-security, legal-claims or other mandatory requirements.

As a securities-market intermediary, Alice Blue is required to perform identity, KYC, client due-diligence and anti-money-laundering controls. This may involve collection, verification, updating, sharing and retention of identity, address, PAN, bank, financial, beneficial-owner and related records with authorised market infrastructure institutions and service providers.

Aadhaar-related information, where used, will be processed only through legally permitted mechanisms and subject to applicable Aadhaar/UIDAI, KYC and securities-market requirements. Alice Blue seeks to minimise unnecessary storage or display of identity numbers and may mask, redact, tokenise or otherwise protect such data where appropriate and legally permitted.

Financial information may be used to verify bank ownership, support funds transfers and settlement processes, assess eligibility for products or segments, comply with regulatory suitability or financial-disclosure requirements, and prevent fraud or unauthorised transactions.

Trading and depository services necessarily generate records of orders, trades, positions, holdings, margins, pledges, instructions, corporate actions, settlement, ledger activity and related identifiers. These records may constitute Personal Data and/or Regulatory Data.

Alice Blue may be legally required to maintain, reconcile, report, transmit or make such records available to stock exchanges, clearing corporations, depositories, SEBI, KRAs, banks, tax authorities, FIU-IND or other competent authorities and market infrastructure institutions. Regulatory reporting and record retention may continue after an account is closed or consent is withdrawn.

Where securities-market rules require original Regulatory Data to remain accessible within India, Alice Blue will apply the applicable data-localisation and accessibility requirements.

Alice Blue websites and applications may use cookies, software development kits (SDKs), pixels, local storage and similar technologies to provide essential functionality, maintain secure sessions, remember preferences, measure performance, diagnose issues, understand usage and, where permitted, support marketing or campaign attribution.

Where required, non-essential cookies or similar technologies will be subject to notice and choice. Disabling certain cookies may reduce functionality or prevent secure features from operating. Additional details are set out in Annexure C.

Alice Blue may collect device and network information such as IP address, device type, operating system, browser/application version, session identifiers, authentication events and related security telemetry. This information is used to secure accounts, investigate suspicious activity, prevent fraud, manage sessions, support troubleshooting and comply with cyber-security requirements.

Location information is processed only where enabled, necessary for a feature, required for security/fraud controls, or otherwise permitted by law. Where device-level permission is required, you may control location access through the operating system or application settings, subject to any feature or legal limitations.

When you contact Alice Blue, we may retain emails, tickets, chats, complaint correspondence, forms, feedback and other communications. Telephone or dealing/support calls may be recorded where permitted or required for quality, dispute resolution, fraud prevention, training, compliance or regulatory purposes.

Communications may be monitored or reviewed by authorised personnel, auditors, service providers or regulators where necessary and lawful. Records are retained in accordance with applicable regulatory, legal, operational and dispute-management requirements.

Alice Blue may send service, security, regulatory and transactional communications that are necessary for an account or service. These are not treated as optional marketing where they are required to provide the service, protect the account or comply with law.

Promotional or marketing communications are sent in accordance with applicable consent, telecom and preference requirements. Where applicable, you may unsubscribe or opt out using the mechanism included in the communication or by contacting Alice Blue. An opt-out from marketing does not prevent essential service, security, regulatory or transaction communications.

Alice Blue does not sell or rent Personal Data or customer lists to third parties for their independent unrelated marketing. Personal Data is not shared for unrelated advertising purposes without an appropriate lawful basis and, where required, consent.

Alice Blue may use analytics, rules engines, automation or artificial-intelligence-enabled tools to support fraud detection, cyber-security, customer service, document processing, operational efficiency, risk monitoring, quality assurance or service improvement. Such tools are subject to applicable governance, confidentiality, access-control and data protection requirements.

Alice Blue will not intentionally use client Personal Data to train a public or unrelated third-party generative-AI model for the provider’s independent purposes unless there is an appropriate legal basis, contractual protection and, where required, specific notice or consent.

Where a decision that produces a material legal or similarly significant effect is made solely through automated processing and applicable law requires additional safeguards, Alice Blue will implement the required transparency, review or challenge mechanisms.

Alice Blue does not disclose Personal Data indiscriminately. Personal Data may be disclosed where necessary for the service, required by law, authorised by the Data Principal, or supported by another lawful basis. Typical recipient categories include:

• SEBI, stock exchanges, clearing corporations, depositories, KRAs, CKYCR or other authorised KYC utilities and market infrastructure institutions.
• Banks, payment systems, settlement banks, payment service providers and financial institutions involved in funds or account verification.
• Government, tax, judicial, law-enforcement, FIU-IND, CERT-In and other competent authorities where disclosure is legally required or authorised.
• Cloud, hosting, communications, customer-support, KYC, verification, analytics, security, audit, legal, compliance, document-management and other service providers acting under contractual safeguards.
• Auditors, professional advisers, insurers and consultants where reasonably necessary and subject to confidentiality obligations.
• Corporate affiliates or group entities where a lawful purpose exists and appropriate access, confidentiality and purpose limitations apply.
• A potential or actual acquirer, investor or transaction adviser in a merger, reorganisation, investment, business transfer or similar corporate event, subject to appropriate confidentiality and legal safeguards.

Alice Blue engages third-party service providers and Data Processors for functions such as cloud infrastructure, communications, KYC/verification, cyber-security, customer support, analytics, document management, payment or banking connectivity, audit, business continuity and other operational services.

Processors are expected to act only on documented instructions, maintain confidentiality, implement reasonable security safeguards, assist with incident response and rights requests, observe approved data-location and sub-processing conditions, retain data only as authorised, and return or securely delete data when no longer required, subject to mandatory legal retention.

Alice Blue applies risk-based vendor due diligence, contractual security/privacy requirements and ongoing oversight appropriate to the nature and criticality of the service.

Alice Blue may process or disclose Personal Data without separate consent where such processing is required or permitted under applicable law, including for compliance with regulatory reporting, inspections, audits, surveillance, KYC/AML, court or tribunal orders, law-enforcement requests, cyber-incident reporting, tax obligations, investor protection or the establishment, exercise or defence of legal claims.

Where legally permitted and appropriate, Alice Blue seeks to ensure that disclosures are limited to the information reasonably necessary for the lawful request and that records of material disclosures are maintained.

Alice Blue is subject to sectoral data-residency and data-localisation requirements. Core securities-market Regulatory Data will be processed, stored and maintained in accordance with applicable SEBI and market-infrastructure requirements, including requirements concerning availability and accessibility within India.

Personal Data may be accessed or processed outside India only where permitted by applicable data-protection and sectoral requirements, and subject to appropriate approvals, contractual protections, access controls and risk assessment. Certain global cyber-security or technology services may process limited security or telemetry information where specifically permitted under applicable regulatory frameworks.

Where the Central Government restricts transfer of Personal Data to specified countries or territories, Alice Blue will comply with those restrictions to the extent applicable.

Alice Blue retains Personal Data for the period necessary to provide services, satisfy securities-market and depository record-keeping requirements, comply with KYC/AML/PMLA, tax, Companies Act, cyber-security, audit and legal obligations, resolve disputes, investigate fraud, enforce rights and maintain evidence of compliance.

Retention periods vary by data category, service and legal requirement. Account closure, inactivity or withdrawal of consent does not automatically require immediate deletion where another law requires continued retention. When retention is no longer necessary, Alice Blue will securely delete, destroy, anonymise or otherwise render the data inaccessible in accordance with applicable retention and disposal procedures.

Backups and archives may retain copies for defined technical retention cycles. Such copies remain protected, are not used for ordinary processing, and are deleted or overwritten in accordance with the applicable backup lifecycle unless preservation is required for legal or regulatory reasons. Annexure B provides the high-level retention framework.

Alice Blue maintains an information-security and cyber-resilience programme proportionate to its regulated financial-services environment. Safeguards are designed to protect Personal Data and Regulatory Data against unauthorised access, disclosure, alteration, loss, destruction, misuse and disruption.

Controls may include, as appropriate, encryption, secure communications, identity and access management, role-based access, multi-factor authentication, privileged-access controls, network and endpoint protection, application security, logging and monitoring, security operations, vulnerability management, penetration testing, data-loss prevention, backup and recovery, business continuity, disaster recovery, secure development, change management, incident response, vendor risk management, employee confidentiality and security awareness.

Alice Blue’s public website identifies the organisation as maintaining ISO/IEC 27001:2022 information-security and ISO 22301:2019 business-continuity certifications. Certification status may change over time and current certificate information should be read from the latest official publication.

No security method can guarantee absolute security. Alice Blue therefore applies layered controls, continuous monitoring, risk assessment and incident-response processes intended to reduce both the likelihood and impact of security events.

Clients are expected to provide accurate and complete information and to promptly update material changes to their contact, address, bank, KYC, nominee or other account information using authorised channels. Alice Blue may request re-verification or updated KYC information where required.

You are responsible for keeping your credentials, passwords, PINs, OTPs, authentication devices and recovery channels confidential. Do not share credentials or OTPs with any person claiming to represent Alice Blue. If you suspect unauthorised activity or credential compromise, contact Alice Blue promptly using an official channel.

Subject to applicability, commencement, legal exceptions and mandatory regulatory retention, a Data Principal may have rights under the Digital Personal Data Protection Act, 2023, including:

• The right to obtain information about the processing of Personal Data and a summary of Personal Data being processed, as applicable.
• The right to seek correction of inaccurate or misleading Personal Data and completion or updating of incomplete Personal Data.
• The right to seek erasure of Personal Data where the purpose has been served and retention is not otherwise required by law.
• The right to withdraw consent where processing is based on consent, with comparable ease to the means by which consent was given, subject to legal and service consequences.
• The right to use the grievance-redressal mechanism provided by Alice Blue.
• The right to nominate another individual to exercise rights in circumstances permitted by applicable law.
• The right to use a registered Consent Manager where such mechanism is available and applicable.

Important: A request for erasure, withdrawal or restriction may not result in deletion of trading, KYC, AML, tax, surveillance, audit, security or other records that Alice Blue is legally required to retain or process.

Rights or privacy requests may be submitted through Alice Blue’s official support, compliance or grievance channels. Alice Blue may require reasonable verification of identity and account relationship before acting on a request in order to prevent unauthorised disclosure, account takeover or fraudulent requests.

Alice Blue will provide a clear mechanism for submitting rights requests and will respond within the period prescribed under applicable law.

Requests should identify the individual, relevant account/client identifier where applicable, the right being exercised, the Personal Data or processing concerned and sufficient information to allow Alice Blue to locate and evaluate the request. Alice Blue may request clarification where a request is ambiguous or cannot be safely fulfilled.

Where consent is withdrawn, Alice Blue will stop the relevant consent-based processing within a reasonable period, subject to technical implementation and any independent legal basis requiring continued processing. Withdrawal may make certain optional services unavailable where the Personal Data is necessary to provide them.

Privacy questions, corrections and rights requests may be directed to the Alice Blue Compliance function at [email protected]. Investor or service grievances may be submitted to [email protected].

Alice Blue will acknowledge, investigate and respond to privacy grievances through its applicable grievance process. If a matter concerns an investor service or securities-market grievance, the individual may also use applicable Exchange, Depository, SEBI SCORES or SMART ODR mechanisms in accordance with their eligibility and procedures.

Where Alice Blue is required to appoint a Data Protection Officer under applicable data-protection law, the DPO’s contact details will be made available through the website/application and this Policy will be updated. Data Principals may approach the Data Protection Board of India after exhausting the applicable grievance mechanism where such right and procedure are in force. Grievances received through the applicable grievance mechanism will be addressed and resolved within 90 days from the date of receipt, in accordance with applicable data protection law.

Alice Blue services are primarily intended for persons legally eligible to open and operate the relevant securities-market accounts. Certain depository, nomination, inheritance, guardian or minor-related arrangements may nevertheless involve Personal Data of a child or a lawful guardian.

For the purposes of the Digital Personal Data Protection Act, 2023, a child means an individual who has not completed eighteen years of age.

Where Alice Blue processes Personal Data relating to a child, it will do so only as permitted by applicable securities-market, depository and data-protection law. Verifiable parental or guardian consent will be obtained where required. Alice Blue does not knowingly undertake tracking, behavioural monitoring or targeted advertising directed at children where prohibited by applicable law.

Alice Blue websites or applications may contain links, integrations or redirects to stock exchanges, depositories, payment systems, banks, government portals, partners or other third-party services. Those entities may independently determine how they process Personal Data and may have their own privacy notices and terms.

Alice Blue is not responsible for the independent privacy practices of a third-party service that is not acting as Alice Blue’s Data Processor. Users should review the applicable third-party privacy notice before providing Personal Data to such service.

Alice Blue maintains procedures to identify, contain, investigate, remediate and document cyber-security and Personal Data Breach incidents. Incident handling may involve internal security teams, service providers, forensic specialists, insurers, regulators, law-enforcement agencies and other authorised parties.

Where applicable law requires notification of a Personal Data Breach to affected Data Principals, the Data Protection Board, SEBI, stock exchanges, depositories, CERT-In or another authority, Alice Blue will provide notifications within the applicable legal or regulatory timelines and include the information required by the relevant framework.

If a notification recommends specific protective steps, affected individuals should follow those steps promptly and use only verified Alice Blue communication channels.

When an individual applies for a role with Alice Blue, the company may process recruitment Personal Data to evaluate suitability, conduct interviews, communicate with the applicant, perform lawful background verification, meet legal obligations and create employment records if an offer is accepted.

Employee and contractor Personal Data is processed for workforce administration, payroll, benefits, access control, performance, training, security, compliance, investigations, legal obligations, business continuity and other legitimate employment purposes. More detailed internal workforce notices or policies may apply.

If Alice Blue participates in a merger, acquisition, restructuring, investment, financing, sale of assets, transfer of business or similar transaction, relevant Personal Data may be disclosed to prospective or actual counterparties, advisers, auditors, regulators or service providers where necessary for due diligence or implementation.

Such disclosure will be subject to applicable law, confidentiality, purpose limitation and security safeguards. If a transaction materially changes the identity of the Data Fiduciary or the purposes of processing, affected individuals will be informed where required.

Alice Blue may update this Policy to reflect changes in law, regulation, technology, products, services, processing activities, security practices or organisational structure. The current version and effective date will be published through an official Alice Blue channel.

Where a change materially affects the purposes for which Personal Data is processed or otherwise requires renewed consent or additional notice, Alice Blue will take the steps required under applicable law. Individuals are encouraged to review the current Policy periodically.

For privacy questions, Personal Data rights requests, corrections or concerns, contact:

For investor or service grievances: [email protected]

Website: https://aliceblueonline.com

This annexure provides a high-level transparency matrix. The exact Personal Data, purpose and recipient may differ by product, client type, transaction and applicable legal requirement.

Alice Blue maintains detailed internal retention schedules. This public framework explains the principal factors used to determine retention without limiting longer periods required by law, regulation, litigation hold, investigation or supervisory direction.

Alice Blue may use first-party and authorised third-party cookies or similar technologies. The actual technologies in use may change as products and websites evolve. Where required, available categories and preferences will be presented through the applicable consent or settings interface.

Browser and Device Controls

Most browsers and mobile operating systems allow users to block or delete cookies, reset advertising identifiers, limit tracking, or control permissions such as location, camera and notifications. These settings operate independently of Alice Blue and may affect functionality. Where Alice Blue provides an in-product privacy or cookie preference control, that control should be used for choices specific to the service.

The following process is intended to protect Data Principals while preventing unauthorised account disclosure or manipulation.

This list is informative and non-exhaustive. Alice Blue will apply the current version of applicable law, regulation, circular, direction or market-infrastructure requirement, including amendments, replacements and clarifications.

• Digital Personal Data Protection Act, 2023, to the extent in force.
• Digital Personal Data Protection Rules, 2025, including phased commencement and subsequent corrigenda/amendments, to the extent in force.
• Information Technology Act, 2000 and applicable rules/directions, including CERT-In directions on cyber-incident reporting, logs and information-security practices.
• SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities and related clarifications/amendments.
• SEBI (Stock Brokers) Regulations and applicable SEBI circulars/master circulars governing stock brokers, client records, outsourcing, risk, investor protection and market conduct.
• SEBI / Depository / Exchange / Clearing Corporation requirements relating to KYC, client registration, record retention, investor grievances, surveillance and reporting.
• Prevention of Money Laundering Act, 2002 and applicable rules/AML-CFT obligations, including legally required client due diligence and record retention.
• Aadhaar Act, UIDAI regulations/directions and authorised KYC/e-KYC requirements where Aadhaar-related processing is undertaken.
• Income-tax, Companies Act and other applicable financial, accounting, legal-hold and statutory record requirements.