DISCLAIMER: BY USING AND ACCESSING THE PLATFORM AND BY AVAILING THE SERVICES OR BY OTHERWISE GIVING US YOUR INFORMATION, YOU WILL BE DEEMED TO HAVE READ, UNDERSTOOD AND AGREED TO THE PRACTICES AND POLICIES OUTLINED IN THIS PRIVACY POLICY AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. YOU HEREBY CONSENT TO OUR COLLECTION, USE AND SHARING, DISCLOSURE OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY. WE RESERVE THE RIGHT TO CHANGE, MODIFY, ADD OR DELETE PORTIONS OF THE TERMS OF THIS PRIVACY POLICY, AT OUR SOLE DISCRETION, AT ANY TIME.
1. Introduction
This Privacy Policy describes how Goldcart Private Limited ("Goldcart", "Company", "we", "our", "us") collects, stores, uses, shares and otherwise processes your personal information when you use:
- The Goldcart mobile application,
- The Goldcart website, and
- Any other tools, SDKs, chatbots, notifications or interfaces used by Goldcart to provide services (collectively, the "Platform").
Goldcart is a company incorporated under the Companies Act, 2013 with its registered office at: [Goldcart Registered Office Address – to be inserted].
By downloading, accessing, or using the Platform, visiting our website, or otherwise providing your information to us, you agree to this Privacy Policy and any applicable product/service terms and conditions.
This Privacy Policy is published and shall be construed in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable Indian data protection laws. This Privacy Policy is an electronic record in the form of an electronic contract and does not require any physical, electronic, or digital signature.
If you do not agree with this Privacy Policy, please do not use or access our Platform.
2. Information We Collect
We only collect information that is relevant and reasonably necessary for providing and improving our services and for complying with legal and regulatory obligations.
2.1 Personal and Sensitive Personal Information
Depending on your use of the Platform, we may collect the following categories of information:
Identification and contact details: Name, date of birth/age, gender, photograph, address, email ID, mobile number, nominee details, and, where enabled, your selected contacts (for nominee or referral features).
KYC and regulatory information: PAN, Aadhaar (where permitted by law), videos or other online/offline verification records, other KYC documents, income/occupation or business information as required by regulators or partners. The act of providing your Aadhaar is voluntary in nature and Goldcart agrees to collect, use and store such details in compliance with applicable laws.
Financial and transaction data: Bank account and IFSC details, UPI ID, partial card details (masked), wallet balance, investment details, order history, transaction amounts, and related communications.
One-time passwords (OTP): OTPs sent by your bank, by Goldcart, or via third-party payment gateways (read only to auto-fill where you explicitly grant permissions).
Device and technical information: Device identifiers (including IMEI number and serial number), operating system version, browser information, IP address, network information, time zone, app version, and other technical data.
Usage data: Pages/screens visited, time spent, clicks, scrolls, links accessed, chat interactions, survey responses, and feedback.
Location information: When you download or use the Platform through your mobile device, we may receive information about your location and IP address. You can withdraw your consent at any time by disabling location-tracking functions on your mobile. However, this may affect your enjoyment of certain functionalities on the Platform.
Where relevant, we and our service providers or business partners may also collect information from third-party sources, such as KYC vendors, credit reference and fraud prevention agencies, Know Your Customer (KYC) Registration Agencies (KRA), and other regulated intermediaries, solely for verification, risk, and compliance purposes.
2.2 SMS and Phone Permissions
We do not collect, read, store, or share with third parties your personal SMS, other than SMS pertaining to your financial transactions solely to assist our lending/service partners in assessing your credit risk or processing your transactions.
We may take one-time access of certain features of your mobile phone to facilitate on-boarding on the Platform and KYC verification, including Camera, Location, SMS, and IP Address. Biometric data will not be collected or stored by Goldcart unless permitted by applicable statutory guidelines.
2.3 Cookies and Similar Technologies
We may use cookies, pixels, and similar technologies on certain parts of the Platform to analyze usage and traffic patterns, remember your preferences and login details, help secure your account, and show content and offers that may be more relevant to you.
Our uses of cookies fall into the following categories:
- Operationally Necessary: Technologies required to allow you access to our Services, identify irregular site behaviour, prevent fraudulent activity, and improve security.
- Performance Related: Technologies to assess the performance of our Services, understand how visitors use our Services, and improve content and tools.
- Functionality Related: Technologies to offer enhanced functionality such as identifying you when you sign in or keeping track of your preferences and interests.
- Advertising or Targeting Related: First-party or third-party cookies to deliver content and ads relevant to your interests on our Services or on third-party sites.
Most cookies are session-based and deleted when you close your browser/app, while some may persist to remember your preferences. You can choose to block or delete cookies in your browser or device settings; however, some features of the Platform may not function properly if cookies are disabled.
2.4 Information Collection Stages
Information may be collected at various points, including when you:
- Visit or browse the Goldcart Platform,
- Register or create an account,
- Initiate or complete transactions (buy, sell, store or deliver gold/silver),
- Click on links, notifications, emails, or chat with our support,
- Participate in surveys, offers or referrals,
- Apply for jobs or career opportunities with Goldcart.
3. Purpose and Use of Personal Information
We may process your personal information for one or more of the purposes below:
- Account creation and authentication – To create and manage your Goldcart account, verify your identity, and provide secure access.
- Provision of services – To provide you with digital gold/silver and related services, including buying, selling, storage, and delivery through our Business Partners.
- KYC and compliance – To conduct KYC checks and comply with legal/regulatory obligations (including those of SEBI/RBI or other relevant regulators, where applicable).
- Transaction processing – To validate, process and authenticate your orders, payments, standing instructions, and redemption or delivery requests.
- Communication – To contact you regarding your account, transactions, security alerts, service updates, or regulatory communications.
- Customer support – To address your queries, troubleshoot issues, and provide technical support.
- Service improvement and analytics – To analyze usage trends (in aggregated or anonymized form), improve the Platform, and enhance user experience.
- Marketing and offers – To inform you (where permitted) about offers, products, services, and promotions from Goldcart or its partners that may be relevant to you. You may opt out of non-essential marketing communications at any time.
- Fraud detection and risk management – To detect, investigate, prevent, and respond to fraud, money laundering, abuse, security incidents, and other harmful or unlawful activities.
- Legal and regulatory purposes – To comply with applicable laws, respond to lawful requests from authorities, enforce our Terms of Use, and protect our rights, interests, and property.
You also specifically agree and consent to us for collecting, storing, processing, transferring and sharing information (including personal information) related to you with third parties solely for the purpose of processing your transaction requests for the Services. Unless you explicitly give your consent to us, we will not share your personal information with another user of the Platform.
4. Sharing and Disclosures
We do not sell your personal information. We may share your personal information only as allowed under applicable law and after ensuring that recipients are subject to appropriate confidentiality and data protection obligations.
We may share information with the following categories of recipients, on a strict need-to-know basis:
- Bullion providers, custodians and intermediaries – to execute your gold/silver transactions, store your bullion, and process deliveries.
- Payment service providers and banks – to process payments and refunds, verify instruments, and manage chargebacks or disputes.
- KYC/verification and risk partners – to perform identity verification, AML checks, and fraud risk assessments.
- Technology and infrastructure providers – including hosting, cloud, SMS/email, analytics, customer support, and security service providers.
- Group entities and affiliates – where necessary for centralized operations, compliance, analytics, or support, under similar privacy safeguards.
- Regulators, law enforcement, and judicial authorities – where required to comply with law, legal processes, or enforce our rights, or to protect users or the public.
We do not disclose your personal information to third parties for their marketing and advertising purposes without your explicit consent.
The Company may disclose your information to the extent necessary to comply with laws and to respond to lawful requests and legal process, to protect the rights and property of the Company and its users, and in an emergency to protect the personal safety and assets of the Company, the users, or any person.
We may also share aggregated or anonymized data (which cannot reasonably identify you) for research, analytics, or business purposes.
5. Links to Third-Party Sites
The Platform may link you to other third-party platforms and websites that may collect your personal information including your IP address, browser specification, or operating system. Goldcart is not responsible for the security of such information, the privacy practices, or the content of those third-party sites.
These third-party service providers and sites shall have their own privacy policies governing the storage and retention of your information. We recommend that when you enter a third-party site, you review that site's privacy policy as it relates to safeguarding of your information.
We use third-party advertising companies to serve ads when you visit the Platform. These companies may use information (not including your name, address, email address, or telephone number) about your visits to the Platform and third-party sites in order to provide advertisements about goods and services of interest to you. You agree and acknowledge that we are not liable for the information published in search results or by any third-party sites.
6. Storage and Retention
We collect and store your data and personal information in AWS cloud as you use our services and will retain the data for as long as necessary to fulfil the purposes for which it was obtained.
To the extent applicable, we store personal information within India and retain it only for as long as necessary for the purposes described in this Privacy Policy or as required by law or regulatory obligations. We may retain certain records for longer periods, including where:
- There is an ongoing legal or regulatory obligation,
- Data is needed to prevent fraud, abuse, or future misuse, or
- Statutory record-keeping requirements apply (for example, for KYC or transaction records).
Processed and non-identifiable data may be stored perpetually. Once personal information is no longer required or the lawful retention period expires, we will delete or anonymize it in accordance with our data retention and deletion policies.
6.1 KYC Data Retention
To comply with applicable laws and regulatory requirements, we may be required to retain copies of certain KYC documents (such as PAN or Aadhaar images, where lawfully collected) and verification records for prescribed periods. Such data is used strictly for verification, compliance, and audit purposes and is not used for marketing. Deletion or modification of such mandatory KYC data may not be possible until legal retention requirements are satisfied.
7. Information Security – Our Commitment
Goldcart is committed to ensuring the confidentiality, integrity, and availability of all information systems, assets, and processing facilities involved in providing our services. Our Information Security Management approach includes:
- Identifying, evaluating, and managing risks that can affect our customers, our operations, and our critical infrastructure in alignment with our risk management process, and implementing applicable information security controls.
- Providing information security awareness training and establishing a company-wide information security culture through learning and development programs.
- Developing and implementing objectives, policies, procedures, and processes to support information security and clearly defining roles and responsibilities.
- Partnering with our ecosystem across customers, partners, and suppliers to build trust and ensure our employees, vendors, or third-party contractors adhere to our information security policies, procedures, standards, and guidelines.
- Complying with applicable laws, policies, standards, and regulations on information security management systems.
- Continually improving the objectives and processes related to information security management.
7.1 Security Practices
We use reasonable security practices and procedures designed to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption and hashing of sensitive data in transit and at rest,
- Firewalls, access controls, and role-based permissions,
- Secure data centers and cloud infrastructure,
- Periodic security reviews, audits, and vulnerability assessments, and
- Internal policies and training for employees and service providers.
However, no system is completely impenetrable. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us of any suspected unauthorized use of your account. When payment information is being transmitted on or through the Platform, it will be protected by encryption technology.
The Company assumes no liability or responsibility for disclosure of your information due to errors in transmission, unauthorized third-party access, or other causes beyond its control.
8. Your Consent
By visiting the Platform or setting up/creating an account on the Platform, you signify your acceptance to the provisions of this Privacy Policy. You also specifically agree and consent to us for transferring and sharing your sensitive personal information (including biometric data, financial information, passwords) related to you with our partners, collaborators, affiliates, third parties, and other service providers solely for the legitimate purpose of providing you the Services.
You may choose to withdraw your consent provided hereunder at any point in time. Such withdrawal of consent must be sent in writing to info@goldcart.app. In case you withdraw your consent, we request you not to access the Platform and/or use the Services and we reserve the right to not provide you any Services through the Platform. In such a scenario, we may delete your information (personal or otherwise) or de-identify it so that it is anonymous and not attributable to you.
However, please note that Goldcart reserves the right to refuse any request to exercise such rights to the extent permitted by applicable law.
9. Children's Privacy
Our Platform is intended only for persons who can form a legally binding contract under the Indian Contract Act, 1872 (typically individuals 18 years of age or older). The Company does not knowingly collect or solicit personal information from children under the age of 18 (eighteen) years and the Service or any services on the Platform are not directed at children under the age of 18 years.
In the event that we learn that we have collected personal information from a child under the age of 18 without verification of parental consent, we will delete such information as soon as reasonably practicable. If you believe that we might have any information from or about a child under 18, please contact us at grievance@goldcart.app.
10. Your Choices and Rights
Subject to applicable law, you may have the right to:
- Access certain personal information that we hold about you,
- Request correction or update of inaccurate or incomplete information,
- Opt out of non-essential marketing communications at any time,
- Withdraw consent for specific processing (where processing is based on consent), subject to legal and contractual limitations,
- Request deletion of your account and personal information (subject to legal and regulatory retention requirements).
You can review and update some of your information through your account settings on the Platform, or submit a request for account deletion through the Goldcart mobile app via the profile section. On submitting a request to delete your account, you confirm that you have no outstanding transactions, no pending or potential grievances, and your account will be permanently deleted.
We will not retain your personal information (including sensitive personal data) for longer than is required for the purpose for which the information may lawfully be used, except as required by applicable law or regulation.
11. Analytics
We may use third-party service providers to monitor and analyze your use of our Services. Browser-based, network-based, ad-tracking, and user UX behaviour tracking information may be collected from third parties. We collect such information to understand and track behaviour as a means for security and connection integrity. We will keep such information for our reference and will never share it with any third party for advertising purposes without your consent.
12. Changes to this Privacy Policy
Our business and applicable laws may change over time, and we may update this Privacy Policy accordingly. We reserve the unconditional right to change, modify, add, or remove portions of this Privacy Policy at any time, without specifically notifying you of such changes. Any changes or updates will be effective immediately upon posting.
We will post the updated Privacy Policy on the Platform with an updated "Last Updated" date. Your continued use of the Platform after any such changes will constitute your acceptance of the revised Privacy Policy. If you do not agree to the changes, you should stop using the Platform.
13. Grievance Officer and Contact Details
In accordance with the Information Technology Act, 2000 and the rules made thereunder, the details of the Grievance Officer are as follows:
Grievance Officer Name: [Name to be inserted]
Email: grievance@goldcart.app
Working Hours: Monday to Friday, 10:00 a.m. – 6:00 p.m. IST, excluding public holidays
The Grievance Officer shall try to acknowledge the complaint within 24 (twenty-four) hours and dispose of such complaint within a period of 15 (fifteen) days from the date of receipt of the complaint.
For general questions or feedback, you may contact us at:
Goldcart Private Limited | Address: [Registered office address] | Email: info@goldcart.app
14. Disclaimer
Goldcart is merely providing a technology platform that facilitates transactions of sale and investment for users and will not be liable in any manner with respect to the products/services offered by Business Partners. You hereby agree and acknowledge that the data and information provided on the Platform does not constitute advice of any nature whatsoever and shall not be relied upon by you while making any savings or investment decisions. You shall be solely responsible for any such decisions and for the purchase of any precious metal on the Platform.
This Privacy Policy is incorporated by reference into Goldcart's Terms of Use. This Privacy Policy is last updated as of [Date to be inserted].