Privacy Policy
PRIVACY POLICY
PropaTrade Education Private Limited
CIN: U85500AP2026PTC125374
Last Updated: July 23, 2026
Effective Date: July 23, 2026
PRIVACY POLICY UNDER THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
This Privacy Policy ("Policy") is published in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules"), and all amendments thereto.
This Policy describes how PropaTrade Education Private Limited, a company incorporated under the Companies Act, 2013, bearing CIN: U85500AP2026PTC125374, having its registered office at Flat No 501, Sai Krupa Residency, Tirupati, Andhra Pradesh 517501, India (hereinafter referred to as "PropaTrade," "Company," "we," "us," or "our"), acting as a Data Fiduciary under the DPDP Act, collects, uses, stores, processes, discloses, and protects the personal data of individuals ("Data Principal," "Contractor," "you," "your") who access or use the website at www.propatrade.com, the Udaan simulated trading platform, and related services (collectively, the "Platform").
PropaTrade engages individuals as independent contractors ("Research Contractors" or "Contractors") under the Indian Contract Act, 1872 for simulated trading research activities. This Privacy Policy governs the processing of personal data in the context of that contractor engagement.
BY SUBMITTING AN APPLICATION TO PROPATRADE, ACCESSING THE UDAAN PLATFORM, OR PARTICIPATING IN ANY PROPATRADE PROGRAM, YOU CONSENT TO THE COLLECTION, USE, PROCESSING, AND DISCLOSURE OF YOUR PERSONAL DATA AS DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH THIS POLICY, DO NOT ACCESS THE PLATFORM.
1. DATA FIDUCIARY INFORMATION
1.1 Identity of the Data Fiduciary
| Field | Details |
|---|---|
| Name | PropaTrade Education Private Limited |
| CIN | U85500AP2026PTC125374 |
| Registered Address | Flat No 501, Sai Krupa Residency, Tirupati, Andhra Pradesh 517501, India |
| GSTIN | 37AALCP3285R1ZI |
| [email protected] | |
| Website | www.propatrade.com |
1.2 Grievance Officer / Data Protection Officer
| Field | Details |
|---|---|
| Name | Sai Kalyan GP |
| Designation | Director |
| [email protected] | |
| Address | PropaTrade Education Private Limited, Flat No 501, Sai Krupa Residency, Tirupati, Andhra Pradesh 517501, India |
2. CATEGORIES OF PERSONAL DATA COLLECTED
2.1 Personal Data Collected Directly from You
We collect the following categories of personal data when you apply, register, engage with our programs, or interact with us:
| Category | Data Elements | Purpose |
|---|---|---|
| Identity Data | Full legal name (as per PAN card), date of birth, gender | Application processing, contractor onboarding, KYC verification, identity verification |
| Contact Data | Email address, mobile phone number, postal address, country of residence | Communication, account management, service delivery, eligibility verification |
| Government Identification Data | Permanent Account Number (PAN) — collected only at Consultant Account stage | KYC verification, tax compliance (TDS under Section 194J) |
| Financial Data | Bank account details (account number, IFSC code, account holder name), UPI ID | Processing Research Stipend disbursements |
| Transaction Data | Commitment Fee payment history, Research Stipend payout records, Easebuzz/Yes Bank UPI transaction IDs | Payment processing, financial reconciliation, GST compliance |
| Trading Activity Data | Simulated trade history, positions, orders, portfolio data, risk metrics, drawdown data, virtual profit/loss, Udaan Evaluation data, Stipend Share tier information | Evaluation assessment, contractor performance monitoring, Research Stipend calculation, platform functionality |
| Authentication Data | Username, password (encrypted/hashed), eSign data | Account authentication, security |
| Communication Data | Correspondence via email, support tickets | Contractor support, dispute resolution |
2.2 Personal Data Collected Automatically
When you access the Platform, we automatically collect:
| Category | Data Elements | Purpose |
|---|---|---|
| Device Data | IP address, device type, operating system, browser type, screen resolution | Platform optimisation, security, fraud prevention |
| Usage Data | Pages visited, features used, session duration, click patterns | Analytics, service improvement |
| Location Data | Approximate location based on IP address (city/region level only) | Compliance with geographical eligibility requirements (UN sanctions screening), service customisation |
| Cookie Data | Cookies and similar technologies as detailed in our Cookie Policy | Essential platform functionality, analytics (with consent) |
2.3 Personal Data from Third Parties
| Source | Data Elements | Purpose |
|---|---|---|
| Surepass | PAN verification status, eSign verification status, bank verification status | KYC compliance at Consultant Account stage |
| Easebuzz | Payment confirmation, transaction status | Commitment Fee processing |
| Third-Party Technology Provider | Account data synchronisation, platform activity logs | Platform operation under Data Processing Addendum |
2.4 Data We Do NOT Collect
2.4.1 We do NOT collect Aadhaar numbers or biometric data. While Aadhaar-based eSign may be used for electronic signature purposes under Section 3A of the IT Act, we do NOT perform Aadhaar Authentication or eKYC. The eSign process is facilitated through authorised Certifying Authorities, and PropaTrade does not access or store Aadhaar numbers.
2.4.2 We do NOT collect special category data such as caste, religious beliefs, political opinions, sexual orientation, or health data.
2.4.3 We do NOT collect financial data relating to real trading accounts, demat accounts, or real brokerage accounts.
3. PURPOSE OF DATA PROCESSING
3.1 We process your personal data for the following specific purposes:
| # | Purpose | Lawful Basis under DPDP Act |
|---|---|---|
| 1 | Contractor application processing, screening, and onboarding | Consent; Performance of contract (Indian Contract Act, 1872) |
| 2 | KYC verification at Consultant Account stage | Legal obligation (Section 7(b) DPDP Act); Contractual necessity |
| 3 | Processing Commitment Fee payments through Easebuzz / Yes Bank UPI | Performance of contract |
| 4 | Providing simulated trading services and Evaluation assessment | Performance of contract |
| 5 | Processing Research Stipend disbursements and payouts | Performance of contract |
| 6 | TDS deduction and tax compliance (Section 194J, Income Tax Act) | Legal obligation (Income Tax Act, 1961) |
| 7 | GST compliance and invoice generation | Legal obligation (CGST Act, 2017) |
| 8 | Contractor support and communication | Legitimate use; Performance of contract |
| 9 | Fraud prevention, security, and abuse detection | Legitimate use (Section 7(f) DPDP Act) |
| 10 | AML/KYC compliance and suspicious activity monitoring | Legal obligation; Internal compliance procedures |
| 11 | Platform improvement and analytics | Consent (for non-essential analytics) |
| 12 | Legal proceedings, regulatory compliance, dispute resolution | Legal obligation; Legitimate use |
| 13 | Record keeping and audit requirements | Legal obligation (Companies Act, 2013; IT Act, 2000) |
| 14 | Sharing data with third-party technology providers under Data Processing Addendum for platform operation | Performance of contract; Legitimate use |
3.2 We shall NOT process your personal data for any purpose beyond those specified above without obtaining your prior consent, unless permitted or required by applicable law.
3.3 We shall NOT sell your personal data to any third party.
4. LAWFUL BASIS FOR PROCESSING
4.1 Under the DPDP Act, 2023, we process personal data on the following lawful bases:
4.1.1 Consent (Section 6): We obtain your free, specific, informed, unconditional, and unambiguous consent before processing your personal data, presented in clear and plain language, with the option to withdraw consent at any time.
4.1.2 Certain Legitimate Uses (Section 7): We process personal data without consent where permitted under Section 7 of the DPDP Act, including:
(a) For the performance of any function under any law or to comply with any order of any court or tribunal;
(b) For compliance with any judgement or order issued under any law;
(c) For responding to a medical emergency involving a threat to life or health;
(d) For taking measures to provide safety during any disaster or breakdown of public order;
(e) For purposes related to the contractor engagement where permitted;
(f) For any fair and reasonable purpose as may be prescribed.
5. DATA PRINCIPAL RIGHTS
5.1 Under the DPDP Act, 2023, you have the following rights as a Data Principal:
5.1.1 Right to Access Information (Section 11): You have the right to obtain from PropaTrade:
(a) A summary of your personal data being processed and the processing activities;
(b) The identities of all Data Processors and third parties with whom your personal data has been shared, along with a description of the personal data shared.
5.1.2 Right to Correction and Erasure (Section 12): You have the right to:
(a) Request correction of inaccurate or misleading personal data;
(b) Request completion of incomplete personal data;
(c) Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
5.1.3 Right of Grievance Redressal (Section 13): You have the right to have readily available means of registering a grievance with PropaTrade regarding any act or omission relating to the processing of your personal data.
5.1.4 Right of Nomination (Section 14): You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.
5.2 Exercising Your Rights
5.2.1 To exercise any of the rights mentioned above, please contact our Grievance Officer at [email protected] with the subject line "Data Principal Rights Request."
5.2.2 We shall respond to your request within thirty (30) days of receipt.
5.2.3 We may request verification of your identity before processing your request.
5.3 Duties of Data Principal
5.3.1 In accordance with Section 15 of the DPDP Act, you as a Data Principal have the following duties:
(a) To comply with all applicable laws while exercising your rights;
(b) Not to register a false or frivolous complaint with PropaTrade or the Data Protection Board;
(c) Not to furnish false or misleading personal data;
(d) Not to suppress any material information while providing personal data for a specific purpose;
(e) Not to impersonate another person while providing personal data.
6. DATA RETENTION
6.1 Retention Periods
6.1.1 We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods are as follows:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account and identity data | Duration of engagement + 8 years after termination | Companies Act 2013, IT Act 2000 |
| KYC documentation (PAN, bank verification) | Minimum 5 years after termination of contractor relationship | Contractual records; applicable compliance requirements |
| Transaction and payment data | 8 years from date of transaction | GST Act (Section 36), IT Act 1961 |
| Trading activity data (simulation) | Duration of engagement + 3 years | Contractual obligation, dispute resolution |
| Communication records | 3 years from date of communication | IT Rules 2021 |
| Log and usage data | 90 days (rolling) | IT Rules 2021, cybersecurity |
| Tax records (TDS, GST) | 8 years from end of relevant assessment year | Income Tax Act 1961, CGST Act 2017 |
6.1.2 Upon expiry of the retention period, personal data shall be securely deleted or anonymised such that it can no longer be associated with a Data Principal.
7. CROSS-BORDER DATA TRANSFER
7.1 Transfer Outside India
7.1.1 Your personal data may be transferred to and processed outside India in the following circumstances:
(a) Third-Party Technology Provider: PropaTrade operates the Udaan platform under license from a third-party technology provider. Certain personal data, including trading activity data and account data, may be processed by this technology provider in the course of providing platform services. Such processing is governed by a Data Processing Addendum between PropaTrade and the technology provider, which includes obligations to maintain standards of data protection equivalent to those under applicable Indian law.
(b) Cloud Infrastructure: Platform hosting and data storage are primarily on AWS (Amazon Web Services) Mumbai, India servers. Certain backup, disaster recovery, or ancillary services may involve data processing outside India.
7.1.2 In accordance with Section 16 of the DPDP Act, personal data may be transferred outside India to any country or territory, except those countries or territories notified by the Central Government as restricted under Section 16(1) of the DPDP Act.
7.1.3 We shall ensure that adequate safeguards are in place for all cross-border transfers, including contractual obligations requiring the recipient to maintain standards of data protection equivalent to those under the DPDP Act.
8. DATA SECURITY
8.1 Security Measures
8.1.1 In compliance with Section 8 of the DPDP Act and Section 43A of the IT Act, PropaTrade implements reasonable security practices and procedures to protect personal data against unauthorised access, use, disclosure, alteration, or destruction. These measures include:
(a) Encryption: SSL/TLS encryption for all data in transit; AES-256 encryption for sensitive data at rest;
(b) Access Controls: Role-based access control (RBAC) limiting access to personal data to authorised personnel on a need-to-know basis;
(c) Authentication: Multi-factor authentication for administrative access; secure password hashing;
(d) Network Security: Firewalls, intrusion detection/prevention systems, DDoS protection;
(e) Monitoring: Continuous security monitoring, log analysis, and anomaly detection;
(f) Audit: Regular security audits and vulnerability assessments;
(g) Physical Security: Data hosted on secured cloud infrastructure (AWS Mumbai) with SOC 2 Type II and ISO 27001 certifications;
(h) Personnel Training: Regular data protection and security awareness training for all personnel;
(i) Incident Response: Documented incident response procedures for data breaches.
8.2 Limitations
8.2.1 While we take reasonable measures to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your personal data.
9. DATA BREACH NOTIFICATION
9.1 In the event of a personal data breach, PropaTrade shall:
9.1.1 Notify the Data Protection Board of India as required under Section 8(6) of the DPDP Act, in the prescribed form and manner;
9.1.2 Notify the affected Data Principals as required under Section 8(6) of the DPDP Act, in the prescribed form and manner;
9.1.3 Take immediate steps to contain the breach, mitigate its effects, and prevent recurrence;
9.1.4 Maintain records of all data breaches, including the facts relating to the breach, its effects, and the remedial actions taken.
10. CHILDREN'S DATA
10.1 The Platform is intended only for individuals aged 18 years and above.
10.2 In accordance with Section 9 of the DPDP Act, PropaTrade does NOT knowingly collect, process, or store personal data of children (persons below the age of 18 years).
10.3 If we become aware that personal data of a child has been collected, we shall promptly delete such data and terminate the associated account.
10.4 We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children.
11. THIRD-PARTY DATA PROCESSORS
11.1 We engage the following categories of third-party Data Processors to process personal data on our behalf:
| Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Easebuzz | Payment processing (Commitment Fees) | Payment data, transaction data | India |
| Yes Bank | UPI payment processing | UPI transaction data | India |
| Surepass Technologies Pvt Ltd | KYC verification (PAN, eSign, bank verification) | PAN, name, bank details | India |
| Amazon Web Services (AWS) | Cloud hosting, data storage | All platform data | India (Mumbai region, primary) |
| Third-Party Technology Provider | Platform technology, Udaan infrastructure | Account data, trading activity data | Under Data Processing Addendum |
| Google LLC (Google Analytics) | Website analytics (with consent) | Anonymised usage data, IP address | Global |
| Brevo (Sendinblue) | Contractor communications, email services | Name, email address | Global |
11.2 All Data Processors are contractually bound to process personal data only in accordance with our instructions, maintain appropriate security measures, and comply with applicable data protection laws.
11.3 PropaTrade remains responsible for the processing of personal data by its Data Processors and shall ensure compliance through appropriate contractual and technical safeguards, including Data Processing Addenda where applicable.
12. COOKIES AND TRACKING TECHNOLOGIES
12.1 The Platform uses cookies and similar tracking technologies. Our use of cookies is detailed in our separate Cookie Policy, available at www.propatrade.com/cookie-policy.
12.2 Essential cookies are used without consent as they are necessary for Platform functionality. Non-essential cookies (analytical, functional, and advertising cookies) are used only with your prior consent.
13. DO NOT TRACK
13.1 The Platform does not currently respond to "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for DNT. If a standard is adopted that we must follow, we shall update this Policy accordingly.
14. THIRD-PARTY LINKS
14.1 The Platform may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to such third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service before providing personal data.
15. DATA PROCESSING FOR MARKETING
15.1 We may use your contact data to send you marketing communications about our programs and services, subject to your consent.
15.2 You may opt out of marketing communications at any time by:
(a) Clicking the "unsubscribe" link in any marketing email;
(b) Contacting us at [email protected];
(c) Adjusting preferences in your account settings.
15.3 Opting out of marketing communications shall not affect transactional or service-related communications.
16. AUTOMATED DECISION-MAKING
16.1 The Platform may use automated systems for:
(a) Evaluation of simulated trading performance against predefined parameters;
(b) Enforcement of risk management limits (daily loss limit, maximum loss limit);
(c) Detection of Prohibited Trading Practices.
16.2 Automated decisions that significantly affect your engagement (such as account termination) are subject to human review upon request. You may contact the Grievance Officer to request a review.
17. CONTRACTOR RELATIONSHIP AND DATA PROCESSING
17.1 PropaTrade processes your personal data in the context of an independent contractor relationship governed by the Indian Contract Act, 1872. The data processing activities described in this Policy are carried out for the purposes of managing this contractor engagement, including onboarding, Evaluation, performance monitoring, Research Stipend calculation, and compliance.
17.2 The Consumer Protection Act, 2019 does not apply to the relationship between PropaTrade and its Contractors, as the engagement is a professional services arrangement and not a consumer transaction.
17.3 PropaTrade may share Contractor data with its third-party technology provider under a Data Processing Addendum for the purposes of operating the Udaan platform. The third-party technology provider is bound by contractual obligations to process such data solely for platform operation and to maintain appropriate security standards.
18. CHANGES TO THIS PRIVACY POLICY
18.1 PropaTrade reserves the right to update or modify this Privacy Policy at any time. The revised Policy shall be published on the Platform with the updated "Last Updated" date.
18.2 Material changes shall be notified to registered Contractors via email.
18.3 Continued use of the Platform after publication of the revised Privacy Policy shall constitute your consent to the revised Policy.
19. COMPLAINTS TO THE DATA PROTECTION BOARD
19.1 If you are not satisfied with our response to your grievance, you have the right to file a complaint with the Data Protection Board of India established under the DPDP Act, 2023.
20. CONSENT WITHDRAWAL
20.1 You have the right to withdraw your consent at any time by contacting us at [email protected] with the subject line "Consent Withdrawal."
20.2 Upon withdrawal of consent:
(a) We shall cease processing your personal data for purposes that require consent;
(b) We may need to restrict or terminate your access to certain services or suspend your contractor engagement;
(c) Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal;
(d) We shall continue to process personal data where we have a lawful basis other than consent (e.g., legal obligation, performance of contract).
20.3 Consequences of withdrawing consent shall be communicated to you at the time of withdrawal.
21. CONTACT US
For any queries, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:
Grievance Officer
Name: Sai Kalyan GP, Director
Email: [email protected]
Address: PropaTrade Education Private Limited, Flat No 501, Sai Krupa Residency, Tirupati, Andhra Pradesh 517501, India
PropaTrade Education Private Limited
CIN: U85500AP2026PTC125374 | GSTIN: 37AALCP3285R1ZI
Registered Office: Flat No 501, Sai Krupa Residency, Tirupati, Andhra Pradesh 517501, India
Trading involves risk. Results shown are from a simulated environment and do not guarantee similar outcomes. Individual results may vary significantly.
© 2026 PropaTrade Education Private Limited. All rights reserved.