Privacy Policy

1. Introduction

WeTraders Institute (“we”, “us”, “our”), respects your privacy. This Privacy Policy explains what personal data we collect when you visit https://ciyindia.com or enrol in our programmes, why we collect it, who we share it with, how long we keep it and what rights you have over it.

We are an educational institute. We deliberately collect as little personal data as possible — essentially only what we need to answer your enquiry, enrol you, take payment and teach you. We do not collect your trading account credentials, demat details, portfolio holdings or PAN-linked financial information, and we never ask you to share them.

This policy is written to meet the requirements of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, together with the Information Technology Act, 2000 and the rules made under it. A companion Data Protection Statement sets out our operational compliance measures in more detail.

2. Who is responsible for your data

For the purposes of the DPDP Act, WeTraders Institute is the Data Fiduciary that determines the purpose and means of processing your personal data. You are the Data Principal.

3. Personal data we collect

4. How we collect it

• Directly from you — through the enquiry or download form on the Website, WhatsApp or phone conversations, email, and the enrolment process.
• Automatically — through cookies and similar technologies when you browse the Website, and through server logs kept by our hosting provider for security and reliability.
• From third parties — limited information from our payment channel (for example, the remitter name shown on a UPI or bank transfer), and from social or messaging platforms if you contact us through them, in which case that platform's own privacy policy also applies.

5. Why we use it, and our lawful basis

Under the DPDP Act we may process personal data only with your consent, or for a “certain legitimate use” specified in Section 7 of the Act. We do not rely on a general “legitimate interests” basis, because Indian law does not provide one.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not carry out behavioural profiling for advertising.

6. Consent and withdrawal

Where we rely on consent, that consent is sought through a clear, standalone notice presented at or before the point of collection. It is free, specific, informed, unconditional and unambiguous, given by an affirmative action — we do not use pre-ticked boxes, and we do not bundle unrelated purposes into a single consent.

Withdrawing consent is as easy as giving it. You may withdraw at any time by:

• emailing support@ciyindia.com with the subject line “Withdraw consent”;
• replying STOP to any marketing message on WhatsApp; or
• using the unsubscribe link in any marketing email.

Withdrawal takes effect prospectively. It does not affect the lawfulness of processing carried out before withdrawal, and it does not require us to delete records we must retain by law (for example, invoices). If you withdraw consent that is necessary to deliver a programme you have enrolled in, we may no longer be able to provide that programme, and the Refund & Cancellation Policy will apply.

7. Cookies and analytics

The Website uses a small number of cookies and similar technologies:

You can accept or decline non-essential cookies through the banner on the Website, and you can clear or block cookies in your browser settings at any time. Blocking strictly necessary cookies may stop parts of the site from working.

8. Who we share data with

We do not sell, rent or trade your personal data. We share it only as set out below, and only to the extent necessary:

Where a third party processes personal data on our behalf, we do so under a written contract that requires them to process it only on our instructions, to apply reasonable security safeguards, and to delete or return the data when the engagement ends.

9. Storage and international transfer

Your data is stored on cloud infrastructure operated by our hosting and communications providers. Some of these providers operate servers outside India, which means your personal data may be transferred to and stored in another country.

Under the DPDP Act and the DPDP Rules, 2025, transfers outside India are permitted except to countries or territories that the Central Government may restrict by notification. We monitor any such notification and will change providers or storage regions if a restriction affects us. Wherever your data is stored, the protections described in this policy continue to apply.

10. How long we keep data

When a retention period ends, we delete the data or irreversibly anonymise it so that it can no longer be linked to you. Aggregated, anonymised statistics may be kept indefinitely.

11. How we protect data

We apply reasonable security safeguards appropriate to the limited and low-sensitivity data we hold, including: encryption in transit (HTTPS/TLS across the whole Website), access control on a need-to-know basis, strong and unique credentials with multi-factor authentication on administrative accounts, use of reputable managed service providers rather than self-hosted infrastructure, retention of security logs, prompt patching, and staff instruction on confidentiality.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please help us by keeping your access links and one-time passwords confidential and by contacting us at once if you suspect misuse.

12. Your rights

As a Data Principal under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we hold about you, how we process it and with whom we have shared it;
• Correction and completion — have inaccurate or misleading data corrected, and incomplete data completed or updated;
• Erasure — have your personal data deleted where it is no longer needed for the purpose it was collected for and we are not required to keep it by law;
• Withdraw consent — at any time, as easily as it was given;
• Grievance redressal — a readily available means of raising a complaint with us; and
• Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any right, email support@ciyindia.com from the address registered with us, stating the right you wish to exercise. We may ask a question to verify your identity — we will not ask for a copy of any government ID unless it is strictly necessary. We will acknowledge within 48 hours and respond substantively within 30 days. There is no fee. You are required to provide only authentic information and not to impersonate another person when making a request.

13. Children's data

Our Services are intended for adults aged 18 and over, and we do not knowingly collect personal data from children. The DPDP Act requires verifiable consent from a parent or lawful guardian before processing a child's personal data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children.

We do not carry out behavioural advertising at all. If you believe a person under 18 has provided us with personal data, contact support@ciyindia.com and we will delete it and cancel any associated enrolment. The same protections apply to a person with a disability who has a lawful guardian.

14. Data breaches

If a personal data breach occurs, we will notify each affected Data Principal without delay, in clear language, describing the nature and extent of the breach, the likely consequences, the measures we have taken and what you can do to protect yourself. We will also report the breach to the Data Protection Board of India within 72 hours of becoming aware of it, and to CERT-In within the timelines applicable under its directions.

15. Third-party websites

The Website links to third-party platforms including Facebook, Instagram, YouTube, Telegram and WhatsApp. We do not control those platforms and are not responsible for their privacy practices. Read their privacy policies before sharing personal data with them.

16. Changes to this policy

We may update this Privacy Policy as our Services or the law change. The current version is always published at https://ciyindia.com/privacy.html with a “Last updated” date. Where a change materially affects how we use your personal data, we will notify you by email or an on-site notice and, where the law requires it, seek fresh consent.

17. Grievance Officer and contact

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India established under the DPDP Act, 2023, through the mechanism it publishes. You also retain your rights under the Consumer Protection Act, 2019.