DATA PROTECTION, PRIVACY & RETENTION POLICY

This Policy establishes principles and controls for the collection, use, disclosure, protection, retention and secure disposal of personal and business information handled by CYBERVED AI PRIVATE LIMITED in connection with its services.

• Process personal information fairly, lawfully and transparently.
• Collect information only for legitimate and defined purposes.
• Protect information against unauthorised access, loss, misuse or disclosure.
• Provide appropriate customer privacy information and rights mechanisms.
• Retain information only for applicable requirements.
• Support privacy-aware operations and third-party governance.

This Policy applies to personal information and relevant business information processed through websites, applications, APIs, customer support, payment/voucher operations, employees, contractors, cloud systems and third-party service providers.

• Customer identification and contact information
• Account and authentication information
• Transaction, payment and order information
• Gift-card/voucher information
• Customer support and grievance records
• Device/technical information where collected
• Employee/vendor information
• Security and audit logs

Information shall be collected and used for defined business, service, security, legal, contractual and compliance purposes. Secondary uses shall be subject to applicable requirements and appropriate safeguards.

Only information reasonably necessary for the relevant purpose shall be collected or retained, subject to legal, regulatory, contractual and operational requirements.

Appropriate privacy notices shall explain relevant categories of information, purposes, disclosures, rights and contact/escalation mechanisms, as applicable.

Where consent is required, it shall be obtained through an appropriate mechanism. Where processing is based on another lawful basis, the Company shall document and apply the relevant basis consistent with applicable law.

Reasonable measures shall be taken to maintain accurate and up-to-date information where accuracy is relevant to the purpose of processing.

Requests concerning applicable privacy rights shall be handled through designated channels and within timelines required by applicable law. Verification may be required before action on a request.

Access to personal information shall be limited to authorised personnel with a legitimate business need. Privileged access shall be controlled and reviewed.

• Access controls and authentication
• Encryption or equivalent safeguards where appropriate
• Secure transmission
• Logging and monitoring
• Backup and recovery controls
• Vulnerability and patch management

Personal information may be shared with authorised PPI, banking, payment, merchant, technology, service or professional partners where necessary for service delivery, security, legal/compliance or other permitted purposes, subject to appropriate safeguards.

Third parties processing personal information shall be subject to appropriate due diligence, contractual obligations, confidentiality, security requirements and monitoring based on risk.

Where information is processed or stored outside the primary operating jurisdiction, applicable legal, contractual and security requirements shall be assessed and addressed.

Information shall be retained only for the period necessary for its purpose and applicable legal, regulatory, contractual, accounting, dispute, fraud, audit or security requirements.

Information subject to litigation, regulatory inquiry, fraud investigation, audit or other preservation requirements shall not be deleted until the applicable hold is released.

When retention ends and no preservation requirement applies, information shall be securely deleted, anonymised or otherwise disposed of using methods appropriate to its sensitivity and medium.

Suspected personal-data breaches or security incidents shall be handled under the Cyber Incident Response & Cyber Fraud Policy and escalated according to applicable requirements.

Privacy-related complaints shall be handled through the Customer Grievance Redressal Policy and applicable privacy procedures.

1. Receive and register the request.
2. Verify identity where appropriate.
3. Assess scope and applicable requirements.
4. Retrieve relevant information.
5. Apply lawful exceptions or restrictions where applicable.
6. Respond through the approved channel.
7. Record the outcome.

Where services involve information relating to children or other protected categories, additional safeguards shall be applied as required by applicable law and product design.

Marketing or promotional communications shall follow applicable consent, preference, opt-out and legal requirements.

Employees and contractors shall protect personal information and shall access or disclose it only for authorised purposes.

Relevant personnel shall receive training appropriate to their role on privacy, data handling, security, incident reporting and confidentiality.

Privacy and retention controls may be periodically reviewed through access reviews, data-flow assessments, vendor reviews, sample checks and internal or external audits.

Exceptions shall be documented, risk-assessed and approved by authorised management, while preserving mandatory legal and regulatory requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in applicable law, products, data flows, technology, partners or processing activities.