Privacy Policy

The Information Technology Act 2000 (IT Act 2000)

India's primary legislation governing electronic commerce, digital data, and cybersecurity. Section 43A imposes strict liability on companies that fail to implement reasonable security practices to protect sensitive personal data and information. Section 72A provides criminal liability for disclosure of information in breach of a lawful contract. The IT Act forms the foundational legal framework for all digital data handling in India.

GlobeeOne applicability: GlobeeOne implements reasonable security practices and procedures as defined under Section 43A of the IT Act 2000 across all personal data collected through its digital platform, mobile interface, and service engagements. All data handling by GlobeeOne is in full compliance with the IT Act 2000.

Information Technology (SPDI) Rules 2011

Defines Sensitive Personal Data or Information (SPDI) — including financial information, health data, biometric data, passwords, PAN, and other categories — and mandates specific security practices for its collection, storage, transfer, and processing. Requires publication of a Privacy Policy, designation of a Grievance Officer, and obtaining prior written consent before collecting SPDI. Rule 5 sets out the mandatory requirements for collecting SPDI. Rule 6 governs disclosure. Rule 7 governs transfer.

GlobeeOne applicability: GlobeeOne identifies and treats all Sensitive Personal Data or Information under Rule 3 of the SPDI Rules 2011 with the highest level of protection. Financial profile data, loan information, investment details, health-related data, insurance information, and identity documents submitted across all four GlobeeOne verticals are all classified and protected as SPDI.

The Digital Personal Data Protection Act 2023 (DPDPA 2023)

India's landmark personal data protection legislation. Establishes the rights of Data Principals (individuals) and obligations of Data Fiduciaries (organisations processing personal data). Introduces consent-based processing, the right to erasure, the right to grievance redressal, and the Data Protection Board of India. Section 4 mandates lawful processing. Section 6 governs consent. Section 7 lists legitimate uses. Sections 8 and 9 set out obligations of Data Fiduciaries. Sections 11–14 establish the rights of Data Principals. Section 17 establishes the Data Protection Board of India.

GlobeeOne applicability: GlobeeOne is a Data Fiduciary under the DPDPA 2023. Every individual is a Data Principal. GlobeeOne processes personal data only with the informed, specific, and unambiguous consent of every Data Principal — for specific, lawful purposes — in accordance with every obligation imposed on Data Fiduciaries under the Act. GlobeeOne is committed to full compliance with every provision of the DPDPA 2023.

The Prevention of Money Laundering Act 2002 (PMLA 2002)

Mandates Know Your Customer (KYC) verification, customer due diligence (CDD), enhanced due diligence (EDD) for high-risk customers, and maintenance of all financial transaction records for a minimum of five years. Requires reporting of suspicious transactions to the Financial Intelligence Unit of India (FIU-IND). Applicable to all entities providing financial services — including lending, investment management, insurance, and forex services.

GlobeeOne applicability: GlobeeOne Finserv and GlobeeOne Wealth collect, verify, and maintain KYC documentation in full compliance with PMLA 2002. All financial transaction records across every Finserv and Wealth service are maintained as required. Suspicious transactions are reported to FIU-IND as mandated. Customer Due Diligence and Enhanced Due Diligence are conducted as required by the risk profile of every engagement.

Reserve Bank of India (RBI) Master Directions on KYC 2016 (as updated)

The RBI's comprehensive Know Your Customer framework governing all RBI-regulated entities, lending institutions, NBFCs, and their agents and partners. Mandates customer identification, address verification, PAN verification, Aadhaar-based verification (where applicable), Politically Exposed Person (PEP) screening, and ongoing due diligence for all financial services engagements. The KYC Master Direction is updated periodically and all updates are incorporated into GlobeeOne's compliance framework.

GlobeeOne applicability: GlobeeOne Finserv collects and processes KYC documentation across all its 30+ lending partners in full compliance with RBI Master Directions on KYC. All identity documents, address proof, PAN, and financial information collected for home loans, education loans, business loans, personal loans, LAS, and forex services are handled strictly within the RBI KYC framework and the requirements of each lending partner.

Securities and Exchange Board of India (SEBI) Regulations

SEBI regulates investment advisors, portfolio managers, mutual fund distributors, Alternative Investment Fund managers, and all entities operating in India's securities market. The SEBI (Investment Advisers) Regulations 2013 mandate client suitability assessment, KYC compliance, and maintenance of client records for a minimum of five years. The SEBI (Portfolio Managers) Regulations 2020 govern PMS operations. The SEBI Cybersecurity and Cyber Resilience Framework mandates data protection standards for all SEBI-regulated entities.

GlobeeOne applicability: GlobeeOne Wealth is registered with SEBI as an Investment Adviser. All client data collected for wealth creation, investment management, PMS, AIF, goal-based planning, retirement planning, and HNI wealth management is processed in full compliance with SEBI regulations — including KYC requirements, client suitability records, investment advisory records, and the SEBI Cybersecurity Framework. Client records are maintained for a minimum of five years as mandated.

Insurance Regulatory and Development Authority of India (IRDAI) Regulations

IRDAI regulates the insurance sector in India. The IRDAI (Protection of Policyholders' Interests) Regulations mandate disclosure, consent, and data protection for all insurance-related engagements. Policyholder data — including health information, nominee details, and policy terms — is classified as sensitive and must be protected against unauthorised access and disclosure. Insurance agents and advisors are subject to IRDAI licensing and compliance requirements.

GlobeeOne applicability: GlobeeOne Wealth collects and processes insurance-related personal data — including life insurance, health insurance, and general insurance information — in full compliance with IRDAI regulations. All health data, medical information, policyholder details, nominee information, and insurance policy data are treated as Sensitive Personal Data or Information under the SPDI Rules 2011 and IRDAI regulations. GlobeeOne operates in compliance with all IRDAI licensing requirements applicable to insurance advisory and distribution services.

Foreign Exchange Management Act 1999 (FEMA) and RBI LRS Directions

FEMA governs all foreign exchange transactions in India — including international remittances, overseas bank account establishment, GIC arrangements, block account opening, forex card loading, and tuition fee remittance. The RBI's Liberalised Remittance Scheme (LRS) governs the remittance of funds abroad for education expenses, living costs, and overseas investments. All overseas financial transactions must comply with FEMA reporting requirements, and authorised dealer banks must file reports with the RBI.

GlobeeOne applicability: GlobeeOne Finserv and GlobeeOne Study Abroad collect and process personal and financial information for forex management, overseas remittance, GIC facilitation, block account establishment, forex card issuance, and overseas banking setup in full compliance with FEMA 1999 and applicable RBI Directions under the LRS. All LRS transactions are reported to authorised dealer banks as required. Financial data shared for overseas transactions is transmitted in compliance with RBI cross-border data requirements.

SEBI (KYC Registration Agency) Regulations 2011

Establishes KYC Registration Agencies (KRAs) for centralised KYC verification for all securities market participants. KYC records registered with a KRA are valid across all SEBI-regulated entities. Reduces duplication of KYC verification for investment and securities market clients.

GlobeeOne applicability: GlobeeOne Wealth registers KYC records through SEBI-authorised KYC Registration Agencies for all investment management, PMS, AIF, and wealth management clients — ensuring seamless KYC verification across all SEBI-regulated entities and eliminating duplication of documentation requirements.

Central KYC Registry (CKYC) — CERSAI

The Central KYC Registry operated by the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI) provides a centralised KYC repository for all financial sector regulators — RBI, SEBI, IRDAI, and PFRDA. CKYC records are valid across all financial institutions and regulators.

GlobeeOne applicability: Where applicable, GlobeeOne registers KYC records with the Central KYC Registry through CERSAI — ensuring that every individual's KYC verification is recognised across all financial institutions and regulators, simplifying the engagement process across GlobeeOne Finserv and GlobeeOne Wealth services.

Pension Fund Regulatory and Development Authority (PFRDA) Regulations

PFRDA regulates pension and retirement products in India — including the National Pension System (NPS). Where retirement planning services under GlobeeOne Wealth involve NPS or pension fund products, PFRDA regulations apply to the collection and processing of retirement-related personal data.

GlobeeOne applicability: GlobeeOne Wealth processes retirement-related personal data in compliance with PFRDA regulations where retirement planning services involve NPS or pension fund products. All retirement planning data is treated as SPDI and handled with the highest standard of data protection.

The Consumer Protection Act 2019 and E-Commerce Rules 2020

Establishes the rights of consumers in India and the obligations of service providers and digital platforms. The Consumer Protection (E-Commerce) Rules 2020 impose specific obligations on digital platforms including transparent disclosure of data use, grievance officer appointment, and prohibition on unfair trade practices. The Consumer Protection Act provides every individual the right to seek compensation for deficiency in service and unfair trade practices.

GlobeeOne applicability: GlobeeOne complies with the Consumer Protection Act 2019 and the E-Commerce Rules 2020 across all four verticals. Every individual engaging with GlobeeOne is entitled to the full consumer protections afforded by the Act — including the right to transparent information, the right to grievance redressal, and the right to seek compensation for any deficiency in service.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021

Governs digital platforms and intermediaries operating in India. Mandates publication of a Privacy Policy and Terms of Service, appointment of a Grievance Officer, resolution of user complaints within 15 days (for significant social media intermediaries) or 30 days (for other intermediaries), and periodic compliance reporting. Rule 3(1)(a) requires a Privacy Policy to be published. Rule 3(2)(a) requires a Grievance Officer to be designated.

GlobeeOne applicability: GlobeeOne publishes this Privacy Policy and its Terms of Service in compliance with the IT Intermediary Guidelines 2021. A designated Grievance Officer is available at grievances@globeeone.com to address all privacy and service-related complaints within 30 days of receipt.

The Indian Contract Act 1872

Governs all contractual relationships in India. Every GlobeeOne engagement — including the acceptance of this Privacy Policy and the Terms of Service — constitutes a binding contract between GlobeeOne and the individual. Consent to this Privacy Policy constitutes valid contractual consent under Section 10 of the Indian Contract Act.

GlobeeOne applicability: Every individual's acceptance of this Privacy Policy constitutes a binding agreement under the Indian Contract Act 1872. GlobeeOne's obligations under this Privacy Policy are fully enforceable as contractual obligations — and every individual's rights under this Policy are legally protected contractual rights.

Information collected across all four verticals

• Full name, email address, phone number, and city of residence
• Communication preferences and enquiry details submitted through forms, consultations, and calls
• Service interests and engagement history with GlobeeOne across any vertical

GlobeeOne Academy

Information collected

• Career goals, academic background, current education level, and life stage
• E-Counselling session information shared in strict confidence with GlobeeOne counsellors
• Academic performance data, test scores, and study habits for academic coaching
• Financial literacy assessment data for personalised financial education

GlobeeOne Study Abroad

Information collected

• Academic qualifications, grades, and test score history (IELTS, TOEFL, PTE, GRE, GMAT, SAT)
• Preferred study destinations, courses, and university shortlists
• Statement of Purpose, Personal Statement, CV, and Letter of Recommendation drafts
• Passport details, visa history, immigration status, and travel records for visa processing
• Financial information for education loan applications and visa financial documentation
• GIC, block account, and overseas banking requirements for destination-specific financial arrangements
• Accommodation preferences, flight details, and pre-departure logistics information

GlobeeOne Finserv

Information collected

• Complete financial profile — income, employment status, business turnover, credit score, and existing liabilities
• Identity and address documents for KYC compliance — PAN, Aadhaar, passport, utility bills, and bank statements
• Property documents, valuation reports, and legal title documents for home and mortgage loan processing
• Business documents — GST registration, MSME registration, MOA, AOA, and audited financials for business loan processing
• Investment portfolio details and securities statements for Loan Against Securities processing
• Forex requirements, remittance details, and overseas banking preferences
• Loan amount requirements, tenure preferences, and repayment capacity information

GlobeeOne Wealth

Information collected

• Complete financial profile — income, assets, liabilities, existing investments, and net worth
• Investment goals, risk appetite, investment horizon, and retirement objectives
• KYC documentation — PAN, Aadhaar, passport, bank account details, and photograph
• Insurance requirements — health status, pre-existing conditions, nominee details, and coverage needs
• Tax information — ITR, capital gains statements, and tax bracket for tax planning
• Retirement and succession planning objectives — including estate details and nominee preferences
• For HNI and ultra-HNI clients — cross-border financial information and multi-jurisdictional asset details

Information collected automatically from the GlobeeOne platform

• Device type, browser, operating system, and IP address
• Pages visited, time spent, search queries, and interactions with GlobeeOne content
• Cookies and similar tracking technologies — for platform functionality and user experience improvement
• Geographic location data — only where explicitly permitted by the individual

Consent standards under DPDPA 2023

• Consent is obtained through a clear and plain language notice — presented before or at the time of data collection
• The notice specifies: the personal data to be collected, the purpose of processing, the names of all Data Processors, and the rights of the Data Principal
• Consent is freely given — it is never bundled as an unconditional requirement for service access where the data is not genuinely necessary
• Every individual has the right to withdraw consent at any time by writing to privacy@globeeone.com
• Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal
• Separate consent is obtained for each distinct purpose — general consent does not extend to additional uses

7.1

Consent for E-Counselling sessions (GlobeeOne Academy)

All information shared in E-Counselling sessions is treated as confidential. Separate, explicit consent is obtained before any E-Counselling session commences — covering the purpose of the session, the confidentiality framework, and the individual's rights. E-Counselling content is never shared, disclosed, or used for any purpose beyond the session without fresh, explicit consent.

7.2

KYC consent (GlobeeOne Finserv and GlobeeOne Wealth)

For all financial services engagements, separate KYC consent is obtained covering the specific collection, verification, and processing of identity, address, and financial documents. KYC consent is distinct from general platform consent and complies with RBI Master Directions, SEBI regulations, and IRDAI requirements.

9.1

Encryption

All data transmitted between individuals and GlobeeOne is encrypted using TLS 1.2 or higher. All Sensitive Personal Data or Information stored by GlobeeOne is encrypted at rest using AES-256 encryption. Financial data and KYC documents are stored in encrypted, access-controlled repositories meeting RBI and SEBI security standards.

9.2

Access Control and Segregation

Access to personal data and SPDI is strictly limited to authorised GlobeeOne professionals who require it to deliver the specific service requested. Role-based access controls ensure data segregation across all four verticals. All access is logged, monitored, and subject to periodic audit. No cross-vertical data sharing without explicit consent.

9.3

Data Minimisation

GlobeeOne collects only the minimum information genuinely necessary for each specific service. No information is collected beyond what is required for its stated purpose. SPDI is collected only where mandated by the nature of the service — financial data for Finserv and Wealth services, visa and academic data for Study Abroad, and counselling data for Academy services.

9.4

E-Counselling Confidentiality (GlobeeOne Academy)

All information shared during GlobeeOne E-Counselling sessions is treated with the highest level of professional confidentiality — equivalent to clinical confidentiality standards. E-Counselling content is never shared, disclosed, or used for any purpose beyond the session itself without the explicit, fresh consent of the individual. E-Counselling records are deleted immediately following each session unless the individual explicitly requests retention.

9.5

Incident Response and Breach Notification

In the event of a personal data breach, GlobeeOne will notify the Data Protection Board of India and all affected Data Principals in accordance with the timelines and procedures mandated under the DPDPA 2023. Every individual will be informed of the nature of the breach, the data affected, and the steps GlobeeOne is taking to address it.

With lending and financial partners (GlobeeOne Finserv)

Financial and KYC information is shared with the specific lending institution, NBFC, or financial partner selected for each loan or financial service engagement — solely for the purpose of processing the application. All financial partners are RBI-regulated or SEBI-registered entities operating under applicable Indian regulatory frameworks. Data is shared only to the extent required for the specific transaction.

With wealth management and investment partners (GlobeeOne Wealth)

KYC and investment profile information is shared with SEBI-registered Portfolio Management Service providers, AIF managers, mutual fund companies, insurance companies, and other regulated entities — solely for the purpose of delivering the specific wealth management service requested. All partners are regulated by SEBI or IRDAI as applicable.

With universities, visa authorities, and overseas partners (GlobeeOne Study Abroad)

Academic records, personal information, and financial documentation are shared with universities, visa authorities, overseas banking institutions, GIC providers, and block account institutions — solely for the purpose of processing applications and delivering the specific international education service requested.

With regulatory and government authorities

GlobeeOne shares personal data and transaction records with SEBI, RBI, IRDAI, FIU-IND, and other applicable regulatory bodies — where required by law or regulation. All such disclosures are made in strict compliance with applicable legal requirements and are limited to the specific data required.

With KYC Registration Agencies and CKYC Registry

KYC records are registered with SEBI-authorised KYC Registration Agencies and the Central KYC Registry (CERSAI) as required by SEBI and RBI regulations — to enable centralised KYC verification across financial institutions and reduce documentation duplication for every individual.

With technology and service providers

GlobeeOne engages trusted technology providers, cloud service providers, and platform service providers who support GlobeeOne operations. All such providers are contractually bound through Data Processing Agreements to maintain the same data protection standards that GlobeeOne applies — and are prohibited from processing personal data for any purpose other than providing the contracted service.

With the individual's explicit consent

Personal data is shared beyond the above circumstances only with the explicit, informed, and specific consent of the individual concerned. Such consent is obtained separately — and is never bundled into general platform consent.

How to raise a grievance

• Write to grievances@globeeone.com with the subject line: Privacy Grievance — [nature of concern]
• Include full name, contact details, the specific GlobeeOne service concerned, the nature of the grievance, and any supporting documentation
• GlobeeOne will acknowledge every grievance within 5 working days and resolve it within 30 days
• Where a grievance cannot be resolved within 30 days, GlobeeOne will inform the individual of the reason for the delay and the expected resolution timeline

Escalation to the Data Protection Board of India

Where a grievance is not resolved to the satisfaction of the Data Principal within 30 days, every individual has the right to escalate their complaint to the Data Protection Board of India established under Section 17 of the DPDPA 2023. The Data Protection Board has the authority to investigate complaints, impose penalties on Data Fiduciaries, and award compensation to affected Data Principals.