PRIVACY POLICY

This Privacy Policy explains how CandleSignals, the research services brand of B-CUBE Consulting Private Limited ("Company", "we", "our" or "us"), collects, uses, processes, stores, protects, shares and retains personal information obtained through its website, client onboarding platform, research services and other digital communication channels.This Policy applies to visitors to the CandleSignals website, prospective clients, clients, webinar participants and other users interacting with our digital platforms.Clients subscribing to research services should also read the DPDP Consent & Privacy Notice, which forms part of the contractual onboarding process and governs the collection and processing of personal data in accordance with the Digital Personal Data Protection Act, 2023.

Estimated reading time: 20–25 minutes

Document Information

Particular	Details
Document	Privacy Policy
Version	1.0
Effective Date	20th May 2026
Last Reviewed	21st July 2026
Applicable To	Website visitors, prospective clients, clients and users of CandleSignals digital platforms
Legal Framework	Digital Personal Data Protection Act, 2023; SEBI (Research Analysts) Regulations, 2014; and other applicable laws

Regulatory & Compliance Library

Access all regulatory disclosures, investor information, grievance mechanisms, statutory policies and accessibility documents published by CandleSignals.

Registration & Disclosures

Investor Grievance Redressal

Documents & Policies

Client Agreement
Fee Structure
Terms & Conditions & MITC
Risk Disclosure
Privacy Policy
Internal Governance Policy
Refund & Cancellation Policy
AML / KYC Policy

Accessibility

1. PURPOSE OF THIS PRIVACY POLICY

This Privacy Policy explains how CandleSignals collects, processes, uses, stores, protects, retains and shares personal information obtained through its digital platforms and research services.

The objectives of this Privacy Policy are to:

explain the categories of personal information collected by CandleSignals;
explain the purposes for which such information is collected and processed;
describe how personal information is protected and retained;
explain when personal information may be shared with authorised third parties;
inform individuals of their rights relating to personal information; and
promote transparency regarding CandleSignals’ privacy practices.

This Privacy Policy should be read together with the DPDP Consent & Privacy Notice, which is presented to clients during the CandleSignals eKYC and onboarding process and governs consent for processing personal data under the Digital Personal Data Protection Act, 2023.

Nothing contained in this Privacy Policy limits or overrides any statutory obligation imposed upon CandleSignals under applicable laws, regulations or directions issued by competent regulatory authorities.

2. SCOPE

This Privacy Policy applies to personal information collected through:

the CandleSignals website;
the CandleSignals eKYC and onboarding platform;
client registration and onboarding;
subscription requests;
enquiry forms;
contact forms;
webinar registrations;
email communications;
customer support interactions;
payment processing;
research service subscriptions;
official messaging platforms operated by CandleSignals;
official social media pages operated by CandleSignals;
mobile devices, desktop devices and browsers used to access our services; and
any other digital platform, application or online service operated by or on behalf of CandleSignals.

This Privacy Policy applies whether individuals interact with CandleSignals as:

website visitors;
prospective clients;
existing clients;
webinar participants;
subscribers;
business contacts; or
users of any CandleSignals digital platform.

This Privacy Policy does not apply to third-party websites or online services that may be linked from the CandleSignals website. Users are encouraged to review the privacy policies of such third-party websites independently.

3. INFORMATION WE COLLECT

Depending upon the nature of the interaction with CandleSignals, we may collect one or more categories of personal information.

3.1 Identity Information

Identity information may include:

Full name
Photograph
Date of Birth
PAN
Aadhaar information where permitted by applicable law
Signature
KYC identifiers
Government-issued identification details
Other information required for regulatory compliance.

3.2 Contact Information

Contact information may include:

Email address
Mobile number
Postal address
City
State
Country
Other communication details voluntarily provided by the individual.

3.3 Financial Information

Financial information may include:

Payment references
Subscription details
Invoice information
GST information where applicable
Bank account details where required for refunds or regulatory purposes.

CandleSignals does not store complete payment card details. Payments are processed through authorised payment service providers.

3.4 Regulatory and KYC Information

Where required under applicable law, we may collect:

KYC records
Risk profile information
Regulatory declarations
Client agreements
Consent records
Investor declarations
Other information necessary for compliance with regulatory obligations.

3.5 Technical Information

Technical information may include:

IP address
Browser type
Browser version
Device type
Operating system
Screen resolution
Language settings
Date and time of website access
Referring pages
Session information
Log files
Cookie identifiers
Diagnostic information.

3.6 Communication Information

We may retain records of communications including:

Emails
Support requests
Webinar registrations
Customer feedback
Contact form submissions
Telephone call records where permitted by law
Chat or messaging interactions
Other correspondence exchanged with CandleSignals.

4. HOW WE COLLECT INFORMATION

Personal information may be collected through one or more lawful methods.

4.1 Information Provided Directly

Individuals may voluntarily provide personal information while:

registering for research services;
completing eKYC;
subscribing to newsletters or webinars;
submitting enquiry forms;
contacting customer support;
participating in surveys or feedback programmes;
communicating with CandleSignals.

4.2 Information Collected Automatically

Certain technical information may be collected automatically through:

cookies;
browser technologies;
server logs;
analytics tools;
website security tools;
fraud detection systems;
performance monitoring systems.

4.3 Information Obtained from Authorised Sources

Where permitted by applicable law, CandleSignals may obtain information from:

KYC Registration Agencies;
regulatory authorities;
payment service providers;
publicly available sources;
identity verification providers;
other lawful sources necessary for regulatory compliance or service delivery.

5. HOW WE USE PERSONAL INFORMATION

Personal information collected by CandleSignals is processed only for lawful purposes and only to the extent reasonably necessary for such purposes.

Depending upon the nature of the interaction, personal information may be used for one or more of the following purposes:

onboarding clients;
verifying identity and completing KYC;
complying with SEBI regulations and other applicable laws;
providing research services;
issuing research recommendations;
communicating research reports and updates;
processing subscription requests;
generating invoices and maintaining billing records;
responding to enquiries;
providing customer support;
conducting educational webinars and investor awareness programmes;
maintaining statutory records;
fraud detection and prevention;
cybersecurity monitoring;
business continuity planning;
disaster recovery;
internal audits;
regulatory inspections;
dispute resolution;
enforcing contractual rights;
improving website functionality and user experience; and
any other lawful purpose consistent with applicable legal and regulatory requirements.

Personal information is not processed for purposes incompatible with those for which it was originally collected unless otherwise permitted by applicable law or authorised by the individual.

6. COOKIES AND WEBSITE TECHNOLOGIES

The CandleSignals website may use cookies and similar technologies to improve website functionality, enhance user experience, strengthen website security and analyse website performance.

Cookies are small text files stored on a user’s device by a web browser when visiting a website.

Depending upon the services being accessed, CandleSignals may use:

Essential cookies;
Functional cookies;
Session cookies;
Security cookies;
Preference cookies;
Performance cookies; and
Analytics cookies.

These technologies may be used for purposes including:

maintaining website security;
remembering user preferences;
improving website performance;
analysing website usage;
detecting fraudulent or malicious activity;
diagnosing technical issues;
maintaining user sessions; and
improving the quality and usability of our digital services.

Users may configure their web browsers to reject or delete cookies.

However, disabling certain cookies may affect the availability or proper functioning of some features of the CandleSignals website.

CandleSignals does not knowingly use cookies for behavioural advertising or personalised advertising without providing appropriate notice where required by applicable law.

7. WEBSITE ANALYTICS

CandleSignals may use website analytics tools to understand how visitors interact with the website and to improve the quality, usability and performance of our digital platforms.

Analytics information may include:

pages visited;
navigation paths;
session duration;
browser information;
operating system;
approximate geographic region;
referring websites;
device type; and
other aggregated website usage information.

Analytics information is primarily used to:

improve website design;
enhance user experience;
identify technical issues;
improve accessibility;
measure website performance;
monitor website security;
evaluate visitor engagement; and
improve the delivery of research services.

Where reasonably practicable, analytics information is used in aggregated or de-identified form.

Analytics information is not used by CandleSignals to make automated decisions regarding research recommendations, client suitability or investment decisions.

8. THIRD-PARTY SERVICE PROVIDERS

CandleSignals may engage carefully selected third-party service providers to support the delivery of research services and the operation of its digital platforms.

Such service providers may perform functions including:

website hosting;
cloud infrastructure;
website security;
cybersecurity monitoring;
payment processing;
KYC verification;
identity verification;
email delivery;
messaging services;
webinar hosting;
customer support;
document generation;
document storage;
website analytics;
workflow automation;
cloud storage;
regulatory compliance support;
disaster recovery; and
other technology services reasonably required for the operation of our business.

Where personal information is shared with authorised service providers:

access is restricted to information necessary for the performance of authorised services;
appropriate contractual confidentiality obligations are imposed wherever applicable;
service providers are expected to implement appropriate security safeguards; and
service providers are expected to process personal information only for authorised purposes consistent with applicable legal requirements.

Engagement of third-party service providers does not relieve CandleSignals of its responsibilities under applicable laws governing the protection of personal information.

9. SHARING OF PERSONAL INFORMATION

CandleSignals respects the confidentiality of personal information.

Personal information is shared only where reasonably necessary for legitimate business purposes, regulatory compliance or where otherwise authorised by applicable law.

Personal information may be shared with:

Securities and Exchange Board of India (SEBI);
Stock Exchanges;
KYC Registration Agencies (KRAs);
Central KYC Registry (CKYCR), where applicable;
regulatory authorities;
statutory authorities;
law enforcement agencies;
courts and judicial authorities;
payment gateways;
banking partners;
auditors;
legal advisers;
authorised technology service providers;
identity verification providers; and
other persons or entities where disclosure is required or permitted by law.

CandleSignals does not sell, rent, lease or trade personal information for commercial marketing purposes.

Personal information shall not be disclosed to unrelated third parties except:

with the consent of the individual;
where required by applicable law;
where required by a competent regulatory authority;
for the establishment, exercise or defence of legal rights;
for fraud prevention or cybersecurity purposes; or
for other lawful purposes consistent with applicable legal requirements.

10. DATA SECURITY

CandleSignals recognises the importance of protecting personal information and implements appropriate administrative, technical, organisational and physical safeguards designed to protect personal information against unauthorised access, misuse, alteration, disclosure, destruction or accidental loss.

Such safeguards may include, where appropriate:

role-based access controls;
authentication mechanisms;
encryption of sensitive information during transmission where technically feasible;
secure communication protocols;
firewall protection;
malware protection;
vulnerability management;
periodic security monitoring;
audit logging;
backup procedures;
disaster recovery measures;
business continuity planning;
access reviews;
staff awareness programmes; and
other security measures appropriate to the nature of the information being processed.

Access to personal information is restricted to authorised personnel who require such access for legitimate business, operational, regulatory or legal purposes.

CandleSignals periodically reviews and updates its security measures to address evolving cybersecurity risks and technological developments.

While CandleSignals endeavours to implement appropriate safeguards, no electronic storage system, communication network or method of transmission over the Internet can be guaranteed to be completely secure.

Accordingly, while reasonable efforts are made to protect personal information, CandleSignals cannot guarantee absolute security of information transmitted electronically.

11. DATA RETENTION

CandleSignals retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, to provide research services, to comply with applicable legal and regulatory requirements, to resolve disputes, to enforce contractual rights and to maintain appropriate business records.

The period for which personal information is retained may vary depending upon:

the nature of the information;
the purpose for which it was collected;
contractual obligations;
applicable statutory requirements;
regulatory record-retention requirements;
ongoing legal proceedings;
dispute resolution requirements;
audit requirements; and
other legitimate business or regulatory considerations.

Where retention of personal information is no longer necessary, CandleSignals may securely delete, anonymise or otherwise dispose of such information in accordance with applicable legal and regulatory requirements and its internal record management procedures.

Nothing contained in this Privacy Policy shall require CandleSignals to delete or destroy records that are required to be retained under applicable law, SEBI regulations or directions issued by competent regulatory authorities.

12. CROSS-BORDER PROCESSING

CandleSignals primarily seeks to process and store personal information in accordance with applicable Indian laws.

However, certain authorised technology service providers engaged by CandleSignals may utilise cloud infrastructure, data centres or technology platforms that involve processing or storage of information in jurisdictions outside India.

Where such cross-border processing occurs, CandleSignals takes reasonable steps to ensure that:

such processing is undertaken only for authorised business purposes;
appropriate contractual safeguards are implemented where applicable;
service providers are expected to maintain appropriate confidentiality and security standards;
personal information continues to receive protection consistent with applicable legal requirements; and
such processing is undertaken in accordance with applicable laws governing cross-border transfer of personal information.

Cross-border processing does not affect the obligations of CandleSignals to protect personal information in accordance with applicable Indian laws.

13. ARTIFICIAL INTELLIGENCE AND AUTOMATED TOOLS

CandleSignals may utilise Artificial Intelligence (“AI”) and other automated technologies to improve operational efficiency, enhance service quality and support internal business processes.

AI and automated technologies may be used for purposes including:

document preparation;
document review;
workflow automation;
quality assurance;
customer support;
language assistance;
knowledge management;
research support;
operational efficiency;
website improvement; and
other internal administrative functions.

AI systems are used solely as assistive technologies and operate under appropriate human oversight.

AI tools are not authorised to independently generate, approve or disseminate research recommendations issued under the SEBI registration of B-CUBE Consulting Private Limited.

All research recommendations issued by CandleSignals continue to be prepared, reviewed, validated and approved by authorised Research Analysts in accordance with applicable regulatory requirements.

Where AI tools process personal information, such processing is undertaken only for authorised purposes consistent with this Privacy Policy, the DPDP Consent & Privacy Notice and applicable legal requirements.

14. BUSINESS TRANSFERS

In the event of:

merger;
acquisition;
amalgamation;
corporate restructuring;
reorganisation;
sale of business;
transfer of assets;
succession;
insolvency proceedings; or
any other corporate transaction,

personal information may be transferred to the successor entity or authorised transferee to the extent reasonably necessary for the continuation of business operations or compliance with applicable legal and regulatory obligations.

Any such transfer shall remain subject to applicable laws governing the protection of personal information.

The successor entity shall be expected to continue processing personal information in a manner consistent with this Privacy Policy or any updated Privacy Policy applicable after such corporate transaction.

15. YOUR PRIVACY RIGHTS

Subject to applicable law and regulatory requirements, individuals may have one or more of the following rights in relation to their personal information.

15.1 Right to Access

Individuals may request access to personal information held by CandleSignals, subject to applicable legal limitations.

15.2 Right to Correction

Individuals may request correction of inaccurate, incomplete or outdated personal information maintained by CandleSignals.

Where appropriate, supporting documentation may be required before corrections are made.

15.3 Right to Update Information

Individuals are encouraged to promptly notify CandleSignals of changes to their personal information to help ensure that records remain accurate and up to date.

15.4 Right to Withdraw Consent

Where processing of personal information is based upon consent, individuals may withdraw such consent in accordance with applicable legal requirements.

Withdrawal of consent shall not affect:

processing undertaken prior to such withdrawal;
processing required under applicable law;
processing necessary for compliance with statutory or regulatory obligations; or
processing otherwise permitted under applicable law.

15.5 Right to Grievance Redressal

Individuals may raise privacy-related concerns or grievances using the contact details published by CandleSignals.

Privacy-related grievances shall be addressed in accordance with applicable legal and regulatory requirements.

15.6 Regulatory Limitations

Certain rights described in this Privacy Policy may be subject to limitations where:

applicable law requires continued processing;
SEBI regulations require continued record retention;
legal proceedings are pending;
regulatory investigations are ongoing;
contractual obligations remain outstanding; or
other lawful grounds exist for continued retention or processing of personal information.

Accordingly, the exercise of privacy rights may be limited to the extent permitted or required under applicable law.

16. CHILDREN'S PRIVACY

CandleSignals research services are intended for individuals who are competent to enter into legally binding contracts under applicable law.

The Company’s research services are not directed towards children or other persons who are not legally competent to enter into contractual relationships.

CandleSignals does not knowingly collect personal information directly from children except where such collection is expressly permitted or required under applicable law.

If CandleSignals becomes aware that personal information has been inadvertently collected in a manner inconsistent with applicable legal requirements, appropriate steps may be taken to investigate the matter and, where appropriate, delete or otherwise handle such information in accordance with applicable law.

Parents or lawful guardians who believe that personal information relating to a child has been provided to CandleSignals may contact the Company using the contact details provided in this Privacy Policy.

17. THIRD-PARTY WEBSITES

The CandleSignals website may contain links to third-party websites, applications or online services that are provided solely for the convenience of users.

Such third-party websites operate independently of CandleSignals and are governed by their own privacy policies, terms of use and security practices.

CandleSignals does not control and is not responsible for:

the privacy practices of third-party websites;
the content published on third-party websites;
the availability of third-party websites;
the security measures implemented by third-party websites; or
any products or services offered by third-party websites.

The inclusion of any third-party link does not constitute an endorsement, recommendation or approval of such website or its contents unless expressly stated.

Users are encouraged to review the privacy policies and terms of use of every third-party website before providing any personal information.

18. CHANGES TO THIS PRIVACY POLICY

CandleSignals may revise this Privacy Policy from time to time to reflect:

changes in applicable laws;
changes in regulatory requirements;
changes in technology;
changes in business operations;
changes in information security practices;
improvements to privacy governance; or
other operational or legal requirements.

The most recent version of this Privacy Policy shall always be published on the CandleSignals website.

Unless otherwise stated, any revised version shall become effective from the Effective Date specified in the updated document.

Where CandleSignals considers a change to be material, appropriate notice may also be provided through one or more communication channels, including:

the CandleSignals website;
email communications;
client portal notifications;
onboarding platform notifications; or
other appropriate electronic communication channels.

Continued use of the CandleSignals website or services after the publication of an updated Privacy Policy shall constitute acknowledgement of the revised Privacy Policy, subject to any consent requirements imposed by applicable law.

19. CONTACT US

Questions, requests or concerns relating to this Privacy Policy or the processing of personal information may be addressed to CandleSignals using the contact details below.

B-CUBE Consulting Private Limited

Research Services Brand: CandleSignals

SEBI Registration No.: INH000027016

Registered Office

8-3-167/K43/507
Flat No. 507
Leeladhar Enclave
Kalyan Nagar Venture III
Mothi Nagar
Hyderabad – 500018
Telangana, India

Website

https://candlesignals.com

Email

support@candlesignals.com

20. Privacy Grievances

Individuals who have concerns relating to the processing of personal information or who wish to exercise rights available under applicable law may contact the designated Grievance Officer using the contact details published in the DPDP Consent & Privacy Notice.

Privacy-related grievances shall be addressed in accordance with the Digital Personal Data Protection Act, 2023, applicable rules, the SEBI (Research Analysts) Regulations, 2014 and other applicable legal requirements.

21. Regulatory Compliance

Nothing contained in this Privacy Policy shall limit, restrict or otherwise affect any obligation imposed upon CandleSignals under:

the Digital Personal Data Protection Act, 2023;
the SEBI (Research Analysts) Regulations, 2014;
applicable SEBI circulars;
applicable stock exchange requirements; or
any other applicable law or direction issued by a competent authority.

Where any provision of this Privacy Policy is inconsistent with applicable law, the applicable law shall prevail to the extent of such inconsistency.