Computer Age Management Services Limited (ASKUREXPERT) is a SEBI Registered Category I Registrar to an Issue and Share Transfer Agent and is acting as RTA for many Mutual Funds. It is primarily responsible for investor database maintenance & its confidentiality. SEBI, recognising the criticality of the role of QRTA, has stipulated that QRTA shall lay down appropriate protocols, processes and controls for its activities and for entities who wish to connect with the database of the QRTAs electronically. ASKUREXPERT is a QRTA as per the criteria laid down by SEBI.
ASKUREXPERT has also been certified for Information Security under, ISO-27001 and since it handles and has access to Sensitive Personal Data or Information (SPDI), it has the greater role to ensure that access to sensitive data are given appropriately only to the authorized users and it implements suitable controls to restrict access to the data.
Accordingly, this policy has been framed to provide the guidelines for Data Access and also for Data Protection.
The purpose of this Policy is to specify the terms under which users are provided access to the Data and to define the steps for protection of the database, servers and the specified data from unauthorized access. In adherence to the above objective, this policy defines the following:
Applicable to all internal users/employees, third party vendors, AMC users, Distributors, Channels, digital / electronic platforms and Investors who have / propose to have access to the applications/data/database/servers.
a) ASKUREXPERT, on behalf of its clients, collects, records and uses personal data of the investors & distributors including past, present and prospective in order to carry on its business as per contractual obligation and meet its clients' requirements effectively. We recognise that integrity and protection from unauthorised access / usage of personal data is very important to successful operations and to maintaining investor's confidence in ASKUREXPERT and in our clients.
b) Any personal data that we collect, record or use in any way, whether it is held on paper, on computer or other electronic media, will have appropriate safeguards applied to it to ensure that we comply with our contractual obligations of confidentiality and privacy.
c) Any sensitive information as provided by the clients for provision of service or received from the investors or through their agents or through any other third party engaged by the clients for processing, stored or processed under lawful contract or otherwise, both historic and ongoing, are being used strictly for the purpose for which it has been collected (i.e., in order to carry on its business and meet clients' requirements and deliverables effectively).
d) The above information collected is stored in a secure manner which complies with ISO 27001 Standards. ASKUREXPERT aspires to adhere to certain generally accepted principles of data protection, to the extent these are within ASKUREXPERT’s control as intermediaries.
These general principles state that personal data must be:
To meet the requirements of the principles, the following process and controls are adhered to:
e) Personal / Institutional Data shall be classified in accordance with its sensitivity, level of confidentiality needs, legal requirements, and minimum standard protections required for the data before access is granted.
f) Electronic access to data shall be provided to the users on a need-to-know basis, depending upon the business, functions, process, legal, statutory, and audit requirements. All such access shall be controlled by reasonable measures to prevent access by unauthorized users.
g) Data Users must responsibly use the data for which they have been given access, including using the data only for its intended purpose and respecting the privacy of other clients. Data Users must maintain the confidentiality of data in accordance with all applicable laws and the ASKUREXPERT Privacy Policy. Authorized access to data does not imply authorization for copying, further dissemination of data, or any use other than the use for which the data user was authorized.
a) Access - Flow of information between a store of data and a user, system, or process. A user, system, or process is considered to have access to data if it has one or more of the following privileges: the ability to read or view the data, update the existing data, create new data, delete data or the ability to make a copy of the data. Access can be provided either on a continual basis or, alternatively, on a one-time or ad hoc basis. Transferring any data from one party to another in any medium is tantamount to permitting access to those data.
b) Data (including Personal Data) - Those data, regardless of format, maintained by ASKUREXPERT’s or a party acting on behalf of ASKUREXPERT’s for reference or use by ASKUREXPERT’s’s regulatory / contractual obligations in providing its Registrar & Transfer Agency services and such other services offered by ASKUREXPERT’s to its clients from time to time. Personal Data does not include data that is personal property of an employee of ASKUREXPERT’s, research data, or data created and/or kept for their own use.
c) Sensitive Personal Data or Information (SPDI) - Those Data that contain information that can be classified as either "sensitive" or "restricted". SPDI includes Personal Data that are personally identifiable in nature and contain Personal Account Numbers, Unique identification nos, or other financial account numbers, mutual fund transaction information, or protected financial information records of investors, distributors, Investor Bank Account details provided either as part of the application submitted by the investor, the clients or based on written request such as change of bank account or registration of multiple bank accounts, Payment instrument details provided as part of application at the time of investment or as proof for carrying out change of bank account or any other details of debit card obtained, Generation and storing password (PIN) in encrypted form based on the request from the investor, Biometric information obtained where applicable, Physical, physiological and mental health condition, Sexual orientation, Medical records and history and any other information as deemed fit in terms of any Legislations / SEBI regulations or guidelines / ISO Standards.
d) The words - User, Data User, User Entity, Customer, refers to the person(s) that has been authorized to access data for the performance of his/her duties, a client or user consuming services / facilities provided through any of the ASKUREXPERT’s software applications / platforms to
1. Avail ASKUREXPERT’s’s services under a contractual agreement
2. Clients’ of ASKUREXPERT’s’s clients, Distributors, Banks, Depositories, Exchanges & other intermediaries (all includes their authorized signatories, officers, employees, so on) associated with ASKUREXPERT’s / ASKUREXPERT’s’s clients directly and indirectly and those who are given access to the services offered under various electronic and non-electronic forms and shall mean and include both singular and plural.
e) Terms and Conditions - shall mean the terms and conditions as contained in this policy for providing data access or in the terms and conditions subject to which data access has been provided to any of its software applications / platforms including third party applications and such terms and conditions can be modified from time to time by ASKUREXPERT’s.
f) Confidential Information - refers to information obtained by the user, through/from ASKUREXPERT’s, for the effective availment of Services or Online transaction services.
g) Internet - refers to the network of computers / mobile phones / other electronic devices which share and exchange information. The Internet is at once a worldwide broadcasting capability, mechanism for information dissemination, and a medium for collaboration and interaction between individuals and their computers / mobile phones / other electronic devices capable of accessing the Internet without regard for geographic location.
h) Online Services - ASKUREXPERT’s’s Service which provides access to account information, products and other services as advised by ASKUREXPERT’s from time to time to Customers through the Internet.
i) Customer - refers to any person who has a service contract with ASKUREXPERT’s or client of ASKUREXPERT’s’s client/s.
j) Account - refers to the Customer's Mutual Fund account / User login account for information services or any other type of account so designated by ASKUREXPERT’s to be eligible account(s) for operations through the use of ASKUREXPERT’s applications.
k) Browser Based Service(s) or generally Services - refers to all ASKUREXPERT’s offered services through one or more of its software applications/platforms, including third party applications, as ASKUREXPERT’s may decide from time to time. ASKUREXPERT’s reserves the right to decide the type of services which may be offered on each platform / account and what type of access / security protocols to be complied with for securing such services. The extent and / or type of services offered may differ from customer to customer. These facilities shall be offered in a phased manner at the discretion ASKUREXPERT’s. ASKUREXPERT’s may also make additions / deletions to the services offered through its software applications at its sole discretion.
l) RTA - means Registrar & Transfer Agent duly registered with SEBI under Securities Exchange Board of India (Registrars to an Issue and Share Transfer Agents) Regulations, 1993.
m) ASKUREXPERT’s - means M/s. Computer Age Management Services Private Limited, a company registered under the Companies Act, 1956, having its registered office at No.10 (Old No.178), M. G. R. Salai, Nungambakkam, Chennai – 600 034 (hereinafter referred to as “ASKUREXPERT’s”, which term shall, unless it be repugnant to the context or meaning thereof, be deemed to include their respective successors).
n) AMC - refers to an Asset Management Company registered with SEBI under SEBI (Portfolio Managers) Regulations, 1993.
o) Distributor - refers to an individual or a legal person appointed by AMC for the purposes of distributing the Mutual Fund products that are managed by AMC as a portfolio manager.
p) MF - refers to Mutual Funds registered with SEBI under Securities and Exchange Board of India (Mutual Funds) Regulations, 1996.