1. Purpose

This Policy defines how VR Financial Services (“VRFS”) stores, retains, archives, and securely destroys personal, financial, and operational data in compliance with:

• DPDP Act

• Information Technology Act

• CERT-In advisories

• SEBI, AMFI, IRDAI, PFRDA, and RBI regulatory frameworks

• Applicable record-keeping and audit requirements

​

2. Scope

This Policy applies to all data processed by VRFS and/or RedVision, including:

• Client onboarding information

• KYC and demographic data

• Portfolio and transaction data

• Insurance servicing data

• Pension servicing data

• Communication logs

• Website submissions

• Operational, audit, and compliance data

• Employee and internal records

​

3. Data Retention Standards
A. Website & Communication Data

Data collected via www.vrfinserv.com  is retained for limited durations:

• Website form submissions are stored for up to 24 months.

• Email, WhatsApp, and communication logs are retained for up to 3 years, or longer if required for service continuity.

• Website analytics logs, cookies, and telemetry data (from Wix/Sentry) are retained for 1 to 26 months, depending on the tool’s internal policy.

This data is used only for service and administrative purposes.

B. Portfolio & Transaction Data on RedVision Platform

Data within portfolio.vrfinserv.com (powered by RedVision) is retained according to regulatory mandates:

• Portfolio records and investment history are retained for a minimum of 8 years.

• Transaction records, including MF, NPS, and insurance execution logs, are retained for a minimum of 10 years, or longer if required.

• KYC-related data is retained as per KRA & issuer-specific requirements.

• Insurance-related data is retained for the policy tenure plus an additional 5 years.

• Pension data is retained as per PFRDA’s statutory timelines.

VRFS does not independently store full portfolio datasets; all retention responsibilities lie within RedVision’s secure AWS-Mumbai environment.

C. Internal Operational Data

Operational data stored by VRFS directly is retained as follows:

• Commission statements, payout records, invoices, and financial documents are retained for 8 years.

• Audit reports, compliance logs, and regulatory communication may be retained for 8 years or more depending on legal requirements.

• System access logs and device activity logs are retained for 6 to 12 months.

• Internal staffing and HR documents are retained as per internal governance rules or statutory requirements.

• ​

4. Secure Destruction Protocols

Upon completion of the applicable retention period, VRFS ensures secure data destruction using the following methods:

Digital Data Destruction

• Permanent delete using secure overwriting or wiping methods (NIST 800-88 or equivalent).

• Removal from RedVision databases via secure API instructions.

• Deletion of backup copies where appropriate.

• Removal of endpoint-stored files by authorised personnel.

Physical Document Destruction

• Shredding using cross-cut or micro-cut shredders.

• Disposal through certified secure document destruction vendors.

• Ensuring no unauthorized copying or storage before destruction.

VRFS maintains strict oversight throughout the destruction process.

​

5. Exceptions to Retention Periods

Data may be retained longer than the timelines stated above if:

• Required for regulatory investigation

• Required for SEBI/AMFI/PFRDA/IRDAI/RBI audit

• Required for litigation, fraud investigation, or legal hold

• Required to defend VRFS against disputes or claims

• Explicitly mandated by a regulator or government authority

​

6. Client Requests & Rights

Clients may request:

• Access to personal data

• Correction or updates

• Deletion of website-level personal data (non-transactional)

Portfolio and transaction data stored on RedVision cannot be deleted prematurely if regulatory retention rules apply.

​

7. Policy Governance

This Policy will be:

• Reviewed annually

• Updated to reflect new regulations or operational changes

• Published on the VRFS website (summary or full version as applicable)

• Made available to regulators upon request