Privacy notice

Last updated: 08-11-2026

GoRemit (goremit.in) is operated by Aabhushan Forex & Jewels Private Limited, RBI FFMC Licence No. MUM-FFMC-1041-2023. We are the Data Fiduciary for the personal data you give us on this website and at our branches. This notice explains, in plain words, what we collect, why, and the rights you have under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Notice version 2026-10.

What we collect, and why

When you upload a document, your own browser reads its printed text (for example the passport number, name, dates, address, parents' names and file number) to check it against what you typed and to fill in the form. The document image itself is uploaded with your order, encrypted, because the law requires us to keep a copy of the identity documents we verify; the extracted text is sent so our staff can complete the KYC record and the declaration. For Aadhaar, the number is masked to its last 4 digits on every working copy.

Your KYC profile. We keep one original copy of your identity documents against your PAN, as the law requires us to keep KYC records anyway. Every copy attached to an order is stamped "GoRemit.in", with that order's reference number and purpose, so it cannot be reused for anything else. On a later order you can choose to reuse your saved PAN, passport, Aadhaar and relationship proof instead of uploading them again — only after you confirm an earlier order ID with the same PAN and mobile number. If you never complete an order, these copies are erased with the order's documents.

We do not use your data for any other purpose, and we never sell it. Marketing messages are sent only if you tick the separate box for them.

Children

Individual orders are accepted only from people aged 18 or above. Forex for a minor must be booked by a parent or lawful guardian in their own name, with the minor's documents. The parent or guardian gives verifiable consent for the minor's data when placing that order, as section 9 of the DPDP Act requires, and we use the minor's data only for that order and the records the law requires — never for tracking, profiling or marketing.

Who we share it with

Cashfree Payments and Razorpay (payment gateways), the forex card issuer, the authorised dealer bank for transfers you ask us to refer, our delivery staff for your order, Cloudflare (hosting), our KYC partner Meon (PAN check, Aadhaar from DigiLocker if you choose it — the Aadhaar number is masked on our working KYC copies, and the original DigiLocker file is kept sealed and encrypted, opened only by an authorised officer with a recorded reason, and deleted after the period the law requires — and Aadhaar eSign), Brevo / Resend (e-mails), sanctions and PEP screening services — dilisense GmbH (Switzerland) and the US Government's Consolidated Screening List — which receive only your name and date of birth, as RBI's anti-money-laundering rules require us to screen every customer, Microsoft Clarity (only if you allow it), and regulators, FIU-IND, tax authorities or law enforcement when the law requires. Each of them may use the data only for that purpose.

How we protect it

All traffic is encrypted (HTTPS). KYC documents are encrypted before storage and can be opened only by our authorised staff and, for business accounts, by that account's signed-in users. Every time a staff member opens a document it is logged, and access logs are kept for at least one year. PAN and passport numbers are masked wherever full numbers are not needed. Card numbers are handled only by the payment gateway; we never see or store them.

How long we keep it

KYC and transaction records of completed transactions: seven years after the transaction or the end of the business relationship (PMLA and RBI directions require at least five). Documents uploaded for orders that are never paid or completed: erased after 90 days. Closed enquiries: 2 years. Rate alerts: 1 year.

Your rights

You can (a) get a summary of your personal data we hold and who we shared it with, (b) have it corrected, completed or updated, (c) have it erased once the purpose is over and no law requires us to keep it, (d) withdraw your consent — as easily as you gave it, (e) nominate another person to exercise your rights if you die or become unable to, and (f) raise a grievance. Use our data request form or write to the Grievance Officer below. We respond within 90 days, and usually much sooner. Withdrawing consent does not affect what was done before, and we may still have to keep records the law requires.

Grievance Officer (DPDP and customer complaints)

Mr. Punit M. Jain
Email: punit@goremit.in
Phone: +91 79776 70546
Office No. 1, 1st Floor, Kahan Bhuvan, Next to Diamond Talkies, L. T. Road, Borivali West, Mumbai 400092

The Grievance Officer is also the person to contact for any question about how we process your data. We acknowledge requests within 48 hours. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.

Where your data is kept

Our website runs on Cloudflare's network and data may be processed in data centres outside India, with encryption, as the DPDP Act allows (except to any country the Government of India restricts). KYC records may also be uploaded to the Central KYC Records Registry where the law requires.

If something goes wrong

If there is a breach of personal data, we will tell the people affected without delay, in plain words, with what happened and what they can do, and report it to the Data Protection Board of India without delay and in full within 72 hours, and to CERT-In within 6 hours of noticing it, as the DPDP Rules and CERT-In directions require.

Cookies and analytics

We use only the cookies needed to run the site (sign-in, referral code, security) unless you agree to more. When you first visit, you choose:

• No thanks — only the necessary cookies.
• Analytics only — Google Analytics 4 (with IP anonymisation) and Microsoft Clarity, which show us which pages are used and where visitors get stuck. Clarity masks everything typed into forms, and order pages are fully masked.
• Allow all — also Google Ads and Meta (Facebook/Instagram) conversion tags, so we can tell which ads bring visitors. Only the order value and type are sent — never your name, PAN, phone, email or documents.

You can change or withdraw your choice at any time from Cookie settings at the bottom of every page. Google and Microsoft may process this data outside India under their own privacy terms.

Changes to this notice

When we change this notice we update the version number above, and if the change affects how we use data you have already given, we will tell you and ask again where consent is needed. You may ask for this notice, and for any consent request, in English or in any language listed in the Eighth Schedule to the Constitution; write to the Grievance Officer and we will provide it.