Privacy Policy
How Aureva Capital Private Limited ("Aureva", "Surplo", "we", "us") collects, safeguards, and processes corporate treasury, entity, and investor data.
01Overview & Scope
This Privacy Policy explains how Aureva Capital Private Limited ("Aureva," "we," "us," or "our") collects, uses, processes, and protects your corporate, personal, and confidential information when you access the Surplo website, upload corporate bank statements, or engage with our treasury and wealth advisory services.
Aureva Capital Private Limited is an AMFI-registered Mutual Fund Distributor (ARN-346247). We are committed to maintaining the highest standards of data confidentiality, privacy, and infrastructure security for corporate treasuries, promoters, finance directors, and signatories.
02Information We Collect
2.1 Corporate & Identity Data
- Entity Information: Certificate of Incorporation (COI), Memorandum and Articles of Association (MOA/AOA), LLP Agreements, Board Resolutions, GSTIN, and registered address proof.
- Signatory Details: PAN, Aadhaar (masked), Passport/Voter ID, Designated Partner / Director DIN, specimen signatures, and Contact Information (Corporate Email, Phone number).
- Banking & Demat: Bank account numbers, IFSC codes, cancelled cheques, and Client Master List (CML) for corporate demat accounts.
2.2 Treasury & Statement Data
- Bank statements uploaded for surplus discovery and liquidity pattern detection.
- Historical transaction logs, current account operational float averages, and short-term liquidity requirements.
2.3 Automated Technical Data
Session tokens, IP address, browser technical parameters, and audit telemetry collected strictly for session security, dual-control validation, and cyber fraud prevention.
03How We Use Your Information
We process personal, entity, and treasury information strictly for legitimate business and regulatory purposes:
04Data Confidentiality & Zero Selling Policy
Information is only shared with authorized market infrastructure entities (such as NSE MF Platform, AMCs, Registrars & Transfer Agents like CAMS / KFintech, and SEBI-registered KYC Registration Agencies) solely to process your transactions and comply with legal mandates.
05Data Security Standards
We employ defense-in-depth security architecture to ensure institutional-grade data integrity:
- AES-256 encryption at rest for all stored corporate documents and statements.
- TLS 1.3 protocol encryption for all data in transit.
- Role-based access control (RBAC) and dual-control Maker-Checker authorization.
- SOC 2 aligned infrastructure hosted in enterprise-grade Indian cloud data centers.
06Your Rights Under DPDP Act, 2023
In alignment with India's Digital Personal Data Protection Act, 2023 (DPDPA), authorized representatives and signatories retain the right to:
- Request a summary of personal and entity data processed by the platform.
- Request rectification, completion, or correction of inaccurate records.
- Request erasure of data, subject to SEBI-mandated retention periods for audit trails.
- Specify grievance escalation to the designated Data Protection Officer.
Data Protection & Compliance Inquiries
For questions regarding this policy or to exercise statutory data rights: