Privacy Policy
How Stable Wave Consultants Pvt Ltd collects, uses, shares and protects personal data — written to be read, not to be skipped. It covers this website, our enquiry process and the engagements we enter into with clients, prospective clients and their businesses.
AT A GLANCE
4 October 2026
Privacy Policy, version 1.0. Supersedes all earlier privacy notices, website disclaimers or collection notices issued by the firm.
Stable Wave Consultants Pvt Ltd, CIN [CLIENT TO CONFIRM: CIN], registered office at [CLIENT TO CONFIRM: registered office address].
1. INTRODUCTION AND SCOPE
Stable Wave Consultants Pvt Ltd ("Stable Wave", "the firm", "we", "us") is an independent Indian financial consulting firm. We act as a facilitator and adviser: we arrange and progress loan and credit card applications on behalf of clients with third-party lenders and card issuers, and we provide investment and growth advisory services. We are not a bank, we do not lend, and we are not a guarantor of any facility or investment outcome.
This policy describes the personal data the firm handles as a data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 ("IT Act"), and it applies to:
• Visitors to this website, including readers of our published articles, rate bands and eligibility criteria.
• Enquiries submitted through our contact or application forms, by telephone, WhatsApp or email.
• Prospective clients with whom no engagement has yet been formalised.
• Existing clients, their proprietors, partners, directors, nominees and authorised representatives.
This policy does not govern the processing carried out by a bank, non-banking finance company or asset management company with which you deal directly. In those cases the lender or fund house is the data fiduciary for that processing, and it publishes its own privacy notice. Our role is limited to handing over the information you have authorised us to hand over, for the specific purpose you have authorised it for.
The firm is registered with the Securities and Exchange Board of India as a Mutual Fund Distributor under registration number [CLIENT TO CONFIRM: SEBI mutual fund distributor registration number], and the particulars of the registrar appointed by the firm are set out in clause 10 of this policy.
2. WHAT PERSONAL DATA WE COLLECT
We collect only what a legitimate business purpose requires. In practice that data arrives through two doors: you give it to us, or it reaches us through a lender, banker, fund house or technology partner who already holds it lawfully. We describe both below, because knowing which is which makes your rights easier to exercise.
2.1 Information you give us directly
You provide this when you call, email, message on WhatsApp, complete an enquiry or application form, attend a meeting, or send documents. It typically includes:
• Identity data — full name, father's or spouse's name, date of birth, photograph, signature, Aadhaar or passport number where you choose to share it, and proof of address.
• Contact data — mobile number, alternate number, email address, WhatsApp number, current and permanent address, and office location.
• Business data — entity name, business vintage, sector, GSTIN, Udyam or MSME registration, CIN/LLPIN of the business, and the role you hold in it.
• Financial data — bank statements, income-tax returns, audited or management accounts, GST returns, salary slips, existing loan statements, asset and liability schedule, and credit report summary.
• Purpose data — the facility or amount sought, intended use of funds, preferred tenure, and the business case for the request.
• Communication data — your messages, call notes recorded by an advisor, emails, the documents you forward, and any preference you express about how we may contact you.
2.2 Information we receive from lenders, bankers and partners
Once you have authorised us to approach a lender, or you have already applied with one, we may also receive data about you directly from that institution or from an intermediary. This can include an eligibility or pre-assessment outcome, a sanctioned or declined status, an application reference number, the credit score or credit report summary the lender obtained with your consent, KYC completed by the lender, existing exposure and repayment history, and the assigned relationship manager's contact details. We do not require any lender to disclose your credit report to us; where a bureau record is relevant, we obtain your consent before it is pulled.
2.3 Information generated in the course of our work
Some data has no external source. It is created by us: our advisory notes, cash-flow and repayment-capacity models, suitability and risk-profile assessments, fee quotations and invoices, mandate letters, the outcome of a recommendation, and the record of what we disclosed to you and when we disclosed it. This record is often the most important one for you in a dispute, and we keep it deliberately.
2.4 Information collected from your use of this website
Our hosting provider may record your IP address, device and browser type, operating system, referring page, pages viewed and time on page for security, troubleshooting and aggregate traffic measurement. See clause 6 for what is stored in your own browser.
2.5 What you must never send us
Please do not email or message us internet-banking credentials, card PINs, CVVs, OTPs, one-time passcodes, or full card numbers. No legitimate reason for the firm to hold any of these exists, and any message containing one will be deleted unread. The only credentials we ever need are credentials you type yourself into a lender's own secure portal, on the lender's domain.
3. HOW WE USE PERSONAL DATA
We process personal data for the purposes set out below. We do not process it for any purpose that is incompatible with these without first telling you and, where the law requires it, obtaining your fresh consent.
Responding to you
Answering enquiries, scheduling meetings, preparing for a first discussion and telling you, in writing, whether the firm can help.
Assessing and arranging facilities
Building your eligibility profile, shortlisting lenders, preparing and submitting the loan file, and tracking the application to sanction or decline.
Investment and growth advisory
Where you ask us to, preparing goal-linked investment proposals, portfolio reviews, unit-economics models and board-ready reporting.
Identity verification and compliance
Know-your-customer and anti-money-laundering checks, sanctions screening, and maintaining the audit trail our regulators and lenders expect to see.
Record keeping and statutory compliance
Retaining records required of us by company law, tax law, the IT Act and SEBI regulations, and producing them when lawfully called upon.
Improving the site and our service
Understanding which pages are useful, where the application process breaks, and how our response times can be improved.
4. LAWFUL BASIS AND CONSENT
Under the DPDP Act, 2023 we may process personal data only where a recognised lawful basis applies, and where a notice has been given to you. The principal bases the firm relies on are set out below. We keep an internal register of the basis relied on for each processing purpose, and the register is reviewed whenever this policy is revised.
Lawful Basis
Where The Firm Relies On It
Consent
Reading and answering an unsolicited enquiry; sending an investor education communication; forwarding your file to a lender you have named; instructing a registered distributor to open a folio in your name; any optional analytics.
Performance of a contract
Everything needed to perform a signed engagement letter — collection of documents, modelling, lender liaison, advisory reports, invoicing and the post-service review.
Compliance with a legal obligation
KYC and AML obligations, income-tax and Companies Act record keeping, SEBI and RBI-facing inspections, and responding to lawful orders of a competent authority.
Legitimate uses as permitted by law
Security logging, fraud prevention, defence of legal claims, and internal audit, in each case where the applicable rules so permit. The permitted categories under the DPDP framework are to be read as notified by the Government: [CLIENT TO CONFIRM: date on which the DPDP Rules, 2025 were notified in the Gazette and the corresponding provisions came into force].
Voluntary provision
Anything you choose to give us that is not required — for instance an extra document in an email. We use it only for the purpose you gave it for.
4.1 How consent is obtained
Consent is taken through an express, affirmative action that is recorded: ticking the consent box on an enquiry or application form, replying to an SMS or email asking whether we may approach a named lender, or giving oral consent to an advisor who then records it in the file note on the same working day. Pre-ticked boxes, bundled consents and consent buried in terms we ask you to accept without reading are not used, because they are not consent in law. Silence is never treated as consent.
Where consent is not the basis — for example while servicing an engagement under contract — you cannot withdraw it in a way that unwinds the contract, but you can still ask us to stop any processing that is not necessary to perform it.
4.2 Withdrawal of consent
You may withdraw any consent at any time, in writing or by an unambiguous message to the advisor you deal with. Withdrawal is prospective: it does not retrospectively invalidate processing that was lawful when it was carried out. We record the date and scope of your withdrawal, confirm it to you in writing, and act on it within [CLIENT TO CONFIRM: working days allowed for the firm to confirm a consent withdrawal]. Where we cannot comply because a record must be retained by law or by a regulator, we say so plainly and explain the retention period instead of quietly ignoring the request.
5. HOW WE SHARE PERSONAL DATA
We share personal data only with the categories of recipient below, only to the extent each recipient needs it for its own lawful purpose, and never in bulk. Every recipient is bound by a written confidentiality undertaking and, where it processes on our behalf, by a data processing addendum.
Lending partners
Banks, non-banking finance companies and other lenders to whom you have expressly authorised us to submit your case. We pass only what the lender needs to appraise the facility, and we keep a record of which lender received what and when. We do not circulate your details across our lender network as a marketing list.
Asset management companies and distributors
Where you ask us to arrange an investment, your identity and contact details are shared with the relevant asset management company and its registrar and custodian, and with the SEBI-registered distributor through whom the transaction is executed. The firm is registered as a Mutual Fund Distributor with SEBI under number [CLIENT TO CONFIRM: SEBI mutual fund distributor registration number]; where a transaction is executed through a separate empanelled distributor, that entity's registration particulars are given to you on request.
Service providers
Our cloud hosting and document-storage provider, email delivery provider, customer relationship management system, statutory auditors, practising chartered accountants and company secretary, and the e-signature vendor used for engagement letters. Each receives only the access needed to perform its function. Provider details, including the location of any server holding your data, are available on request: [CLIENT TO CONFIRM: name of hosting and document-storage provider, and the country or region in which the servers and backups are located].
Statutory and regulatory authorities
The Securities and Exchange Board of India, the Reserve Bank of India where a lender or reporting entity requires it, the Registrar of Companies and the Income Tax Department, the Financial Intelligence Unit, and — where there is a lawful basis — law-enforcement agencies, including the National Cyber Crime Reporting Portal in the event of a fraud complaint involving your records. We respond to a lawful order or notice; we do not volunteer information to any authority on a speculative basis.
Cross-border processing. Our servicing of non-resident Indian clients necessarily involves lenders, registrars and custodians located outside India. Any such transfer is made to a recipient bound by confidentiality obligations no less strict than ours and is limited to what the transaction requires: [CLIENT TO CONFIRM: list of countries in which client data is processed or stored outside India, and the contractual safeguards relied upon].
6. COOKIES AND ANALYTICS
This site is deliberately light. It sets no advertising cookies, no third-party behavioural or cross-site tracking cookies, and no social-network pixels. Nothing on the site is designed to build a profile of you across other websites.
What is stored in your browser
Only what is needed for the site to function, such as the current year in the footer and interface state such as whether the mobile drawer is open. These are handled in the page itself and are not tracking identifiers.
How visits are counted
Aggregate traffic measurement is used to find out which pages are read and whether the site works on a given device. It is configured to avoid building an individual profile: [CLIENT TO CONFIRM: name of the analytics provider, the exact properties in use, and whether the firm has determined that a consent gate is required for them].
6.1 Fonts and external requests
Typefaces are served from the Google Fonts content delivery network, which means your browser makes a request to Google when the page loads. If you prefer to avoid that entirely, the site renders correctly in system fonts; nothing breaks.
6.2 How to control cookies
Every current browser lets you view, delete and block cookies and local storage from its settings, and the site works normally with storage disabled. We do not use cookies to identify you across other websites, so clearing them removes nothing of consequence and no account of yours is affected.
7. DATA SECURITY
Client files contain income records, bank statements and identity documents. We treat them accordingly. The controls below are in place today; they are the standard against which any new system or vendor is assessed before it is allowed to hold client data.
• Access on a need-to-know basis. Only the advisor handling your matter, and the compliance function where a file requires it, can open your documents. Access is individually attributable and logged.
• Encryption. Data is encrypted in transit over the internet and at rest in storage. Your identity document and PAN card are stored in a segregated folder with stricter access than your application file.
• Secure sharing, not attachments. Where documents must move, we use an access-controlled link with an expiry rather than attaching a document to an email that can be forwarded, cached or left in a draft.
• Device and endpoint discipline. Firm devices are full-disk encrypted, screen-locked, and patched. Advisors are trained not to work on client files from shared or public computers.
• File naming discipline. Client names are not used in document titles or folder paths that could be exposed in a shared drive listing. Lender and scheme references are used instead.
• People. Every advisor signs a confidentiality undertaking on joining and an acceptable-use undertaking annually. Exit removes access the same day.
7.1 What happens if something goes wrong
If we discover a personal data breach that is likely to harm an individual, the firm will contain it, assess it, and take the steps the law requires. Affected individuals are told directly, the relevant regulator is notified, and the incident is recorded in the firm's incident register whether or not notification is ultimately required.
Reporting runs to [CLIENT TO CONFIRM: name and contact details of the internal incident owner who receives a security report within the firm] and escalates to [CLIENT TO CONFIRM: name and contact details of the external security contact point, for example a CERT-In or managed security provider]. Clients may report a suspected incident to [CLIENT TO CONFIRM: security incident email address] and will receive an acknowledgement.
8. RETENTION
We keep personal data only as long as a stated purpose requires it, and then delete or anonymise it. Retention is driven by two things at once: the limitation period on a claim against us, and the record-keeping obligations of a company that arranges financial transactions. Deletion means removal from active systems and backup rotation within the cycle set out below.
Category Of Record
Retention Period
Why
Unconverted enquiries
24 months from last contact
Enough to serve the enquiry and recognise a returning visitor; beyond that the record has no purpose.
Loan application files
8 years from the date the application is closed, whether sanctioned or declined
The limitation period for a professional negligence claim, and the record of what was disclosed before signature.
KYC and client records
8 years from the date of the last transaction with the client
KYC and AML obligations run for the period after the relationship ends.
Investment and advisory records
8 years from the date of the last advice or transaction
SEBI and income-tax record keeping, and the evidence supporting suitability at the time of recommendation.
Invoices, fee statements and accounting records
8 years from the end of the financial year of the invoice
Prescribed under the Income-tax Act, 1961.
Consent and disclosure records
For the life of the engagement plus the retention period above
So that a disputed disclosure can be evidenced years later.
Website and server logs
12 months
Security investigation and capacity planning.
Office CCTV and visitor log
[CLIENT TO CONFIRM: number of days CCTV footage is retained, and whether visitor details are recorded at the reception desk]
Premises security. Visitors who do not wish to be recorded are asked to state so.
Where the period for a category has not yet been fixed by the firm's compliance policy, it is set out in the table above as the operative period and will be confirmed on adoption of this policy: [CLIENT TO CONFIRM: confirmation of the firm's approved retention schedule and the date it takes effect]. On expiry, records are deleted or irreversibly anonymised, including from backups as those rotate.
9. YOUR RIGHTS
The DPDP Act, 2023 gives an individual a set of enforceable rights over personal data held about them. Read alongside the IT Act, 2000 and the rules made under it, they amount to the following. The firm honours all of them, and does not charge for a first request.
Right to access and review
Ask what personal data the firm holds about you, to see a copy of it, to know the purposes for which it is used and the categories of recipients it has been or will be shared with, and to be told how long it will be retained. We respond with the extract in a readable form.
Right to correction and updation
Have inaccurate or incomplete personal data corrected, or have it completed, updated or erased. A stale address on a loan file is not a small problem, and this is one of the requests the firm acts on quickly.
Right to erasure
Ask for personal data to be deleted once the purpose for which it was collected is achieved, and where it is no longer needed. We may decline where the law requires retention — for example KYC, tax or regulatory records — and where we do, we tell you which obligation applies and for how much longer the record will remain.
Right to withdraw consent
Withdraw a consent at any time, prospectively, as described in clause 4.2. We do not penalise a client for withdrawing consent on marketing, and a withdrawal does not by itself terminate a live engagement.
Right to nomination
Ask the firm to nominate a person to whom your data should be disclosed in the event of your death or incapacity, and to record that nomination against your record. Requests are recorded in the form the client confirms: [CLIENT TO CONFIRM: whether the firm maintains a nomination register and, if so, the officer responsible for it].
Right to lodge a grievance
Raise a complaint with the firm and receive a reasoned response. The route is set out in clause 10, and you may use it whether or not you are a client — the same channel handles a website enquiry about your data as an account-holder complaint.
9.1 Exercising a right
Send the request to the Grievance Officer named in clause 10, from the email address registered with the firm or from a verified business domain. We may ask you to confirm your identity before we release an extract, because an extract is itself personal data and we will not hand it to an impostor. The firm aims to respond within the period the applicable rules require and in any event within [CLIENT TO CONFIRM: number of working days within which the firm responds to a data protection request]. There is no charge for a first request; a manifestly unfounded or excessive repeat request may attract a reasonable administrative charge, which we will explain before applying it.
Data Protection Officer. Under the DPDP Act a Data Protection Officer may be required to be appointed. The designated contact for the firm is [CLIENT TO CONFIRM: DPO name, designation and contact email address], or, where no DPO is required to be appointed, the officer discharging those functions is [CLIENT TO CONFIRM: name of the officer designated to receive data protection requests].
10. GRIEVANCE AND CONTACT DETAILS
Send data protection requests, consent withdrawals and complaints to the Grievance Officer. The Officer is independent of the advisor who handles your file and reports directly to the firm's management.
[CLIENT TO CONFIRM: Grievance Officer name and designation], Stable Wave Consultants Pvt Ltd
[CLIENT TO CONFIRM: dedicated grievance officer email address]
General enquiries to hello@stablewave.in are also accepted and are routed to the Officer, but a rights request is better served by the dedicated address so that it is not read as a sales enquiry.
[CLIENT TO CONFIRM: postal address designated for service of data protection requests and grievances]
+91 90000 00000 · Mon – Sat, 10:00 AM – 6:30 PM IST
SEBI registration number [CLIENT TO CONFIRM: SEBI mutual fund distributor registration number]. Registrar: [CLIENT TO CONFIRM: name of the registrar appointed by the SEBI-registered entity], address [CLIENT TO CONFIRM: address of the registrar for investor grievance purposes].
10.1 Escalation if you are not satisfied
If the Grievance Officer's response does not resolve the matter, ask for it to be escalated to the firm's Managing Director, who will review the file and respond in writing. Beyond the firm, the appropriate forum depends on the nature of the complaint:
• Mutual fund investments: the Grievance Redressal Officer of the relevant asset management company or Key Information Document, then SEBI's online complaints portal at sebi.gov.in, and thereafter the Stock Exchange Interconnect or the relevant stock exchange.
• Loan servicing: the lender's own grievance redressal officer first. If the lender is a bank, the Banking Ombudsman; if it is a non-banking finance company, the NBFC-APA ombudsman scheme; if it is a fintech lender, the Credit Information Company or the relevant ombudsman under the 2023 scheme, as applicable. We will give you the specific pathway on request.
• Our own conduct or fees: where the complaint concerns the firm's facilitation charge, disclosure or service, and not the decision of a lender, the first escalation is to the firm's Managing Director as above.
• Personal data: the Data Protection Board of India once the applicable provisions are in force, together with the adjudicatory and appellate forums available under the DPDP Act, 2023.
The firm is a participant in SEBI's [CLIENT TO CONFIRM: applicable SEBI redressal scheme reference, for example the SCORES or Smart ODR route applicable to the firm's registration category] and in the applicable customer grievance-redressal framework for the sectors in which it facilitates transactions.
11. CHANGES TO THIS POLICY
We review this policy at least annually and whenever there is a material change in what we collect, who we share it with, the law that applies, or the vendors we use. A revision that materially affects how your data is processed is notified to affected clients by email and, where the change is significant, by a notice on this page at least [CLIENT TO CONFIRM: number of days' notice given of a material change to this policy] before it takes effect.
Every version carries its own date and version number in the document control block at the top of this page, and superseded versions are retained internally so that the disclosure you received at the time of a transaction can still be produced. Continuing to use this website after a change has been published constitutes acceptance of the revised policy, save where the change requires your fresh consent — in which case we will ask for it rather than assume it.
QUESTIONS ABOUT YOUR DATA
The six things people ask us most often before they agree to send a single document. If yours is not here, clause 10 gives you the address to ask.
Ask for anything, in writing, without embarrassment
A copy of your data, a correction, a deletion, a consent withdrawal or a complaint about how we handled it — all of it is a legitimate request, it costs you nothing, and it does not affect how the firm treats you afterwards.