Last Updated: September 16, 2026

CFA Institute India Private Limited (“CFAIIPL,” “we,” “our,” or “us”) is a private limited company incorporated in India and a subsidiary of CFA Institute, a Virginia (USA) 501(c)(6) not-for-profit professional membership association (“CFA Institute”). CFAIIPL owns and operates www.cfainstitute.in (the “Site”), through which we offer an associate membership program and a career accelerator program, each available only to residents of India, together with any other services we may offer through the Site from time to time (collectively, the “Services”).

Please read this Privacy Policy carefully. By using the Services, or by otherwise providing personal data to CFAIIPL, you acknowledge that you have read and understood this Policy.

This Privacy Policy explains how CFAIIPL processes personal data about you in connection with the Services, and how that personal data is shared with, and further processed by, CFA Institute. This Policy adopts the same categories of personal data, purposes of use, and disclosure practices described in CFA Institute’s global Privacy Policy, available at CFA Institute Privacy Policy | CFA Institute, tailored to reflect CFAIIPL’s role as a Data Fiduciary and the requirements of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, each as amended from time to time (together, the “DPDP Law”). This Policy should be read together with CFA Institute’s global Privacy Policy. Where a conflict arises between this Policy and the global Privacy Policy in respect of your personal data, this Policy will prevail to the extent required by the DPDP Law.

Who Is Responsible for Your Personal Data

For purposes of the DPDP Law, CFAIIPL is the Data Fiduciary in respect of the personal data we collect from you through the Site (references to “you” or “Data Principal” mean the individual to whom personal data relates). As described in the “How We Disclose Your Information” section below, CFAIIPL shares the personal data it collects through the Site with CFA Institute. CFA Institute also acts as a Data Fiduciary for its own subsequent use of that personal data, which it carries out in accordance with its global Privacy Policy.

Information We Collect

The information we collect about you depends on the Services you use and the information you choose to provide. We collect information in three main ways: (1) information you provide directly to us; (2) information we collect automatically through technology when you use the Services; and (3) information we collect from other sources.

Information you provide directly to us

When you use our Services, you may provide certain information directly to us, for example when you create an account, apply for or enroll in the associate membership or career accelerator program, make a payment, subscribe to communications, participate in surveys, or contact us for customer support. The categories of information we may collect directly from you include:

• Contact and account identifiers, such as name, address, telephone number, email address, and login credentials.
• Commercial and financial information, such as purchase and transaction history in connection with the Services. Note that your payment card information is collected by our third-party payment processor on our behalf; CFAIIPL does not store your full payment card details.
• Demographic information, such as your interests, preferences, age, and gender.
• Professional or employment-related information, such as your employer, job title, professional experience, and qualifications.
• Educational information, such as your educational background, institution name, and graduation dates.
• Inference information, which is information we derive about your potential interests, career goals, or program fit, based on other information we collect.

Information we collect automatically through technology

When you use the Site, we and our service providers may automatically collect certain information using cookies and similar technologies. See “Cookies and Online Analytics” below. This includes:

• Information about the device you use to access the Site, such as your IP address, browser type and language, unique device identifiers, operating system, and general location derived from your IP address.
• Information about how you use the Site, including referring and exit URLs, pages viewed, links clicked, the date and time you accessed the Site, and error logs.

Information we collect from other sources

We may receive information about you from service providers, business partners, program mentors or employer partners (for example, in connection with the career accelerator program), publicly available databases, and professional or social networking platforms. Where we combine information from third parties with information we already hold about you, we use the combined information in accordance with this Policy.

How We Use Your Information

We may use your information to:

• Provide and manage the Services you have requested, including administering the associate membership and career accelerator programs, processing applications, enrollments, and payments.
• Communicate with you about your membership, program participation, and changes to our terms and policies, and, in accordance with applicable law, send you marketing communications.
• Improve and personalize the Services, including bug detection, understanding how users interact with the Site, and performing research and analytics.
• Secure the Services and prevent fraud, and comply with legal obligations, including detecting and responding to security incidents and misuse.
• Conduct due diligence and eligibility or misconduct screening in connection with the associate membership and career accelerator program; these processes are subject to human review, and we do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
• Share your information with CFA Institute, which uses it for the purposes described in CFA Institute’s global Privacy Policy, including worldwide membership administration, program delivery, and communications.
• Carry out other purposes for which we separately seek your consent.

How We Disclose Your Information

We may disclose your information to:

• CFA Institute. CFAIIPL shares all personal data it collects through the Site with CFA Institute. CFA Institute further processes that personal data in accordance with its global Privacy Policy, including for purposes such as worldwide membership administration, program delivery, communications, research, and legal and regulatory compliance.
• Service providers and vendors. We engage third parties who provide hosting, payment processing, marketing, IT, and program administration services to support the Services. These parties act on our instructions and are contractually restricted to using your information only to perform services on our behalf.
• The public. CFA Institute members, including Associate Members in India, are included in the Member Directory available to the general public on the CFA Institute website. The Member Directory includes members’ name, location and charter/membership status
• Program partners, participants and mentors. If you authorise us to do so by opting in, we may share your information with select third parties in connection with the career accelerator program, such as mentors, employer partners, and program collaborators who may offer opportunities that may be of interest to you. Your information will also be visible to your cohort participants in the career accelerator program.
• Employers. Under certain circumstances, we may share information with your employer to validate your membership or program status.
• Regulators, law enforcement, courts, and others. We may share information as required by law or in response to lawful requests from government, regulatory, or law enforcement authorities, or where we have a good-faith belief that disclosure is reasonably necessary to comply with legal process, enforce our terms or this Policy, or protect the rights, property, or safety of CFAIIPL, CFA Institute, or others.
• Other organizations in connection with a merger or acquisition. If CFAIIPL’s business or assets are transferred to a third party, we may disclose your information as part of that transaction.
• Other situations. We may disclose your information in other situations where legally permitted, including to perform tasks or services you have requested.

Legal Bases for Processing

Where required by law we rely on one or more of the following legal bases for processing your information:

• Consent: Where you have consented to our processing of your information for a particular purpose.

• Voluntary provision of data: Where you have voluntarily provided your personal data to us for a specified purpose and have given no indication that you do not consent to the use of your personal data.

• Fulfilling our obligations under the laws or complying with any judgment.

You may withdraw your consent for our marketing communications by clicking “Unsubscribe” at the bottom of our emails, or if you have a CFA Institute account, but adjusting your communication preferences in your account profile. You may unsubscribe from our WhatsApp messages using the in-app settings.

You may withdraw your consent to our other processing at any time by contacting us as described in “Contact Us” below. Withdrawal will not affect the legality of processing carried out before withdrawal, and we will cease processing your personal data within a reasonable time after withdrawal, unless we are permitted or required to continue processing under applicable law.

Cookies and Online Analytics

We use cookies and similar technologies (such as web beacons, device identifiers, log files, and local storage) to operate our Services, improve performance, analyze usage, enhance security, personalize content, and deliver advertising. We also work with third-party analytics and advertising companies who place their own cookies or similar technologies on your browser or device when you visit our Services and other third-party websites, in order to provide analytics to us or serve customized advertisements to you. 

These technologies can be grouped into categories related to their purpose:

• Essential: enable core functionality of our Services and cannot be turned off

• Targeted advertising: deliver and measure advertising related to our offerings

• Personalization: allow the Services to remember functionality choices you make (e.g., remembering your username) and provide enhanced personalization 

• Analytics: measure website performance, user interactions, and identify technical issues

When you visit our site, you may use our cookie banner (in applicable jurisdictions) and/or cookie preferences management tool to determine and select which categories of these technologies are active on our Services during your visit. At any time, you may change your preferences by clicking on the Cookie Preferences link in the website footer. 

In addition to using cookies and other tracking technologies to serve digital advertising, we also may share limited information (such as your email address) in a hashed or otherwise pseudonymous format with social and professional networking platforms. These platforms use the information to identify users who also have accounts with them (audience-matching) and to deliver CFA Institute advertising to those users.

You may opt out of the targeted advertising and audience-matching advertising described above. If you wish to opt out of our processing or sharing of your information for online targeted advertising purposes, opt out of the targeted advertising cookies using the Cookie Preferences tool. 

If you do not want your information shared for audience matching, you may withdraw consent to CFA Institute marketing communications as described below, or you may adjust your settings in the relevant platforms so those networks may not use your information in this manner.

Cross-Border Transfers

CFAIIPL shares the personal data it collects through the Site with CFA Institute, which is headquartered in the United States. This means your personal data will be transferred outside India and stored and processed in the United States, and potentially other countries in which CFA Institute or its service providers operate.

We and CFA Institute take steps designed to ensure your personal data continues to be protected after it is transferred, including through contractual and organizational measures with our service providers.

De-identified Information

We may de-identify information we collect so that it can no longer reasonably identify you, or we may collect information that is already de-identified. Our use and disclosure of de-identified information is not subject to any restriction under this Policy.

Your Rights as a Data Principal

Subject to the exceptions and conditions set out in the DPDP Law, you have the right to: (i) obtain a summary of the personal data we process about you and of related processing activities, together with the identities of other data fiduciaries and data processors with whom your personal data has been shared and a description of the personal data shared; (ii) request correction, completion, updating, and erasure of your personal data; (iii) register a grievance with us regarding our processing of your personal data or our observance of your rights; and (iv) nominate another individual to exercise your rights under the DPDP Law in the event of your death or incapacity.

To exercise your right to request erasure of your data, please send an email to [email protected], requesting erasure.

To exercise any other rights, or register a grievance, please contact the Grievance Officer at [email protected].

We will respond in accordance with the timelines and requirements prescribed under the DPDP Law. You should attempt to resolve your grievance with us before approaching the Data Protection Board of India.

Data Retention

We retain your information for as long as necessary to provide services, comply with legal and regulatory obligations, resolve disputes, and maintain business records. When no longer needed, data will be securely deleted or anonymized.

Retention periods are determined based on:

• Legal and regulatory requirements (e.g., financial, employment, and data protection laws).

• Contractual obligations (e.g., agreements with members and test-takers).

• Business needs (e.g., maintaining certification records for professional verification).

• Fraud prevention and security (e.g., investigating unauthorized access).

• User requests (e.g., data deletion under applicable laws).

Children's Privacy

The Services are not directed at, and are not intended for use by, individuals under 18 years of age. We do not knowingly collect personal data from individuals under 18 without verifiable consent from a parent or lawful guardian. If we become aware that we have collected personal data from an individual under 18 without such consent, we will take reasonable steps to delete it.

Persons with Disability

If we are made aware that a Data Principal is a person with disability who has a lawful guardian, we will observe due diligence to verify that consent given on their behalf is provided by a validly appointed guardian, as required under the DPDP Law.

Security of Your Information

We maintain appropriate technical, physical, and administrative safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. While we strive to protect your information, we cannot guarantee the security of information transmitted over the internet, and we recommend you take appropriate precautions when using the Site.

Social Media Interactions and Links to Third-Party Sites

The Site may link to, or allow interaction with, third-party websites and social media platforms. Any information you post or submit through such third-party sites will be governed by their own terms and privacy practices, not this Policy. We encourage you to exercise caution before sharing information on or through third-party sites.

Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes in law, our data practices, or the Services. The “Last Updated” date at the top of this Policy indicates when it was last revised. If material changes affect previously collected personal data, we will notify you and obtain consent where required under the DPDP Law.