PRIVACY POLICY

1. INTRODUCTION

India Gold Metaverse Limited (“IGM”, “Company”, “we”, “our” or “us”) owns and operates Elanzia, an online jewellery marketplace accessible through the Elanzia mobile application, the website, IGM’s APIs and SDK integrations, and authorised partner channels, through which Customers may browse, purchase, return, exchange, and seek warranty or buyback services in respect of jewellery and related products offered by verified Brand Partners (the “Services”).

This Privacy Policy (“Policy”) explains how IGM collects, uses, discloses, retains and otherwise Processes Personal Data of individuals accessing or using the Elanzia website, mobile application, APIs, customer support channels and related digital interfaces (the “Platform”).

This Policy forms part of, and is to be read together with, IGM’s Terms of Use, Brand Partner Agreement framework, and any KYC or Anti-Money Laundering Policy applicable to specific transactions. By creating an Account, placing an Order, completing identity verification where required, or otherwise using the Platform, you confirm that you have read, understood and agreed to this Policy.

2. OBJECTIVES OF THIS POLICY

This Policy is intended to:

1. identify the categories of Personal Data IGM collects;
2. state the lawful purposes for which IGM Processes such Personal Data;
3. describe how Personal Data is protected;
4. identify the circumstances in which Personal Data is disclosed to Brand Partners and other third parties;
5. set out the rights available to Users under Applicable Law; and
6. record IGM’s compliance with Applicable Law relating to privacy and data protection.

3. APPLICABILITY

This Policy applies to the Personal Data IGM Processes in connection with the Platform, of:

1. registered Users;
2. prospective customers who initiate but do not complete registration;
3. visitors to the Platform;
4. individuals placing Orders for jewellery or related products;
5. Brand Partners and their authorised representatives, to the extent IGM Processes their Personal Data; and
6. any other individual who interacts with IGM in relation to the Services, including through customer support, marketing campaigns, surveys or events.

This Policy applies irrespective of the device or technology used to access the Platform.

4. APPLICABLE LAW

This Policy is prepared with reference to the following Indian laws, in each case as amended, substituted or re-enacted from time to time:

1. the Digital Personal Data Protection Act, 2023, and rules made thereunder;
2. the Information Technology Act, 2000 and rules made thereunder, including the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011;
3. the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, to the extent applicable to the Platform’s marketplace model;
4. the Income-tax Act, 1961 and rules made thereunder, including Rule 114B (quoting of PAN for specified high-value transactions);
5. the Prevention of Money Laundering Act, 2002 and rules made thereunder, where applicable to jewellery transactions on the Platform;
6. the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, as amended; and
7. directions, circulars and notifications issued by a competent governmental or regulatory authority that apply to the Services.

This Policy does not limit IGM’s obligation to comply with any additional legal or regulatory requirement applicable to the Services.

5. DEFINITIONS

In this Policy, unless the context otherwise requires:

“Account” means the account a User creates on the Platform to access the Services.

“Applicable Law” means the statutes, rules, regulations, notifications, circulars, directions, judicial decisions and governmental orders identified in Clause 4, and any other law that applies to IGM or the Services.

“Brand Partner” means a jewellery brand, manufacturer, retailer, designer, or authorised seller approved to offer products through the Elanzia marketplace.

“Consent” means a free, specific, informed, unconditional and unambiguous indication of agreement by a User to the Processing of the User’s Personal Data.

“Order” means a request placed by a User through the Platform to purchase, return, exchange, seek warranty service for, or sell back a product offered by a Brand Partner.

“Personal Data” has the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

“Platform” means the Elanzia website, mobile applications, and other official digital channels operated by India Gold Metaverse Limited.

“Processing” means collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, sharing, transfer, restriction, anonymisation, deletion or destruction of Personal Data, and “Process” shall be construed accordingly.

“Services” means the marketplace products and services IGM offers through Elanzia from time to time.

“User” means an individual accessing or using the Platform, and “you” or “your” shall be construed accordingly.

Words importing the singular include the plural and vice versa.

6. MARKETPLACE MODEL: SPECIAL DISCLOSURES

6.1 Role of Brand Partners

Elanzia operates a marketplace model: IGM acts as an intermediary that enables independent, verified Brand Partners to list and sell jewellery and related products to Users. Unless expressly stated otherwise for a specific product, the contract of sale for a product is between the User and the relevant Brand Partner, and IGM is not the manufacturer or seller of record for that product.

6.2 Data Shared with Brand Partners

IGM shares such Personal Data with a Brand Partner as is reasonably necessary to process, fulfil, deliver, and provide after-sales service (including returns, exchanges, warranty and buyback) for an Order placed with that Brand Partner. A Brand Partner Processes such Personal Data as an independent data fiduciary in respect of its own after-sales obligations, subject to contractual data-protection obligations owed to IGM and to Applicable Law.

6.3 Cross-Brand-Partner Order History

IGM maintains a User’s Order history across Brand Partners within a single Account, to support order tracking, warranty and buyback administration, customer support, and marketplace-wide personalisation and loyalty features.

6.4 Data Handling on Brand Partner Exit

Where a Brand Partner ceases to operate on the Platform, IGM shall restrict that Brand Partner’s continuing access to Personal Data, while retaining Order-related Personal Data necessary for warranty administration, dispute resolution, audit, and compliance with Applicable Law.

7. PRIVACY PRINCIPLES

IGM Processes Personal Data in accordance with the following principles:

1. Personal Data is Processed only where a lawful basis exists under Applicable Law;
2. Personal Data is Processed fairly and without unjustifiably prejudicing the rights of Users;
3. IGM provides clear and accurate information about its privacy practices;
4. Personal Data is collected only for specified, explicit and lawful purposes and is not Processed in a manner incompatible with those purposes;
5. IGM collects only such Personal Data as is reasonably necessary to provide the Services, comply with Applicable Law, and fulfil the certain legitimate uses recognised under Section 7 of the Digital Personal Data Protection Act, 2023;
6. IGM takes reasonable steps to keep Personal Data accurate, complete and up to date;
7. Personal Data is not retained longer than necessary, except where retention is required under Applicable Law or for the establishment, exercise or defence of legal claims;
8. IGM implements technical and organisational safeguards against accidental loss, unauthorised access, disclosure, alteration or destruction of Personal Data; and
9. IGM maintains governance measures to demonstrate compliance with Applicable Law and this Policy.

8. USER ACKNOWLEDGEMENT

By using the Platform, you acknowledge and agree that:

1. you have read and understood this Policy;
2. the Personal Data you provide is true, accurate and complete to the best of your knowledge;
3. you shall promptly notify IGM of any change to your Personal Data;
4. IGM may Process your Personal Data in accordance with this Policy and Applicable Law; and
5. where you provide Personal Data relating to another individual (for example, a gift recipient’s delivery details), you are duly authorised to do so and have obtained all consents required under Applicable Law.

9. INFORMATION WE COLLECT

IGM collects the categories of Personal Data set out in this Clause 9 to establish and administer a User’s Account, facilitate Orders, comply with Applicable Law, safeguard the Platform, prevent fraud, and deliver the Services. The specific data collected from a User depends on the Services availed and the legal or regulatory requirements that apply.

9.1 Identity Information

Full name; date of birth; gender; photograph; PAN; Aadhaar details or Virtual ID (collected only on a voluntary basis, as described in Clause 14.3); passport, driving licence, Voter ID or other Officially Valid Document, where required for high-value or KYC-linked purchases.

9.2 Contact Information

Billing and shipping address; email address; mobile and telephone number; and preferred language of communication.

9.3 KYC Information

Where required under Applicable Law for a high-value jewellery Order: PAN verification records; identity and address-verification records; source-of-funds declarations where warranted; and AML/sanctions-screening records. IGM Processes this information only to the extent necessary for compliance with Applicable Law.

9.4 Financial Information

Payment-instrument identifiers (such as a masked card or UPI reference); transaction reference numbers; refund and buyback settlement details; and GST information, where applicable. IGM does not store complete debit card, credit card or internet-banking credentials; such information is Processed by IGM’s authorised, RBI-regulated payment aggregators and gateways.

9.5 Order & Marketplace Transaction Information

Products purchased and the Brand Partner concerned; order value, quantity and specifications; payment status; delivery information; and records of returns, exchanges, refunds, warranty claims and buyback requests. IGM maintains these records on a Customer-wise and Brand-Partner-wise basis for order fulfilment, reconciliation, warranty administration and regulatory reporting.

9.6 Device and Technical Information

IP address; device identifiers; device model and manufacturer; operating system and version; application version; browser type; language settings; time zone; network information; device tokens; error reports; and crash logs.

9.7 Usage Information

Login and logout history; pages and products viewed; search queries; navigation patterns; clickstream data; session duration; wishlist and preference data; and referral URLs. IGM uses this information to analyse usage trends, optimise the platform and improve customer experience.

9.8 Communications

Customer support requests; emails, chat messages and WhatsApp communications; telephone conversations, which may be recorded after notice where required by Applicable Law; complaints, grievances, feedback, survey responses and product reviews.

9.9 Regulatory and Compliance Information

Risk classification; AML and fraud-monitoring records; tax-relevant records (including PAN furnished under Rule 114B); and information required to respond to a lawful request from a competent authority.

9.10 Marketing Preferences

Communication and subscription preferences, Consent records, and campaign-interaction data, collected where a User elects to receive promotional communications.

9.11 Information Voluntarily Provided

Additional Personal Data a User voluntarily provides while using the Platform, Processed only to the extent consistent with the purposes described in this Policy.

10. SOURCES OF PERSONAL DATA

IGM collects Personal Data directly from the User, automatically through the Platform, and from authorised third parties, as set out below.

10.1 Collected Directly from the User

IGM collects Personal Data directly from a User when the User:

1. creates or registers an Account;
2. completes KYC verification or any identity-authentication process;
3. places, returns, exchanges or seeks warranty or buyback service for an Order;
4. links a bank account, UPI account, wallet or other payment instrument;
5. submits identity documents or supporting documentation;
6. communicates with IGM’s customer support team;
7. submits a query, complaint, grievance or item of feedback;
8. participates in a promotional campaign, survey or referral programme;
9. subscribes to a newsletter or updates their profile details; or
10. otherwise interacts with IGM in relation to the Services.

10.2 Collected Automatically

When a User accesses or uses the Platform, IGM automatically collects the technical and usage information described in Clauses 9.6 and 9.7, through cookies, device identifiers, server logs, SDKs and similar technologies, for maintaining security, improving functionality, preventing fraud, and personalising the User’s experience.

10.3 Received from Third Parties

Subject to Applicable Law, IGM may receive Personal Data from:

1. Brand Partners fulfilling an Order;
2. payment aggregators and gateways;
3. logistics and delivery partners;
4. identity-verification and fraud-prevention agencies;
5. government authorities acting under Applicable Law;
6. and a business partner the User has authorised to share the User’s Personal Data with IGM.

IGM Processes Personal Data received from a third party only for the purposes described in this Policy.

11. PURPOSES OF PROCESSING PERSONAL DATA

IGM Processes Personal Data only for lawful purposes connected with the provision, improvement, protection and operation of the Platform and in accordance with Applicable Law. Subject to Applicable Law and, where required, your Consent, IGM may Process your Personal Data for the following purposes:

11.1 Provision of Services

To establish and manage your Account, verify your identity where required, process and fulfil Orders in coordination with the relevant Brand Partner, facilitate payments, arrange shipping and delivery, process returns, exchanges, refunds, warranty claims and buyback requests, provide customer support, and otherwise provide, administer and improve the Services.

11.2 Regulatory Compliance, Risk Management and Security

To comply with Applicable Law, regulatory directions, court orders and contractual obligations; conduct KYC and AML checks for high-value jewellery Orders; perform sanctions screening; prevent fraud and cyber threats; investigate suspicious transactions; manage disputes; protect the security and integrity of the Platform; and enforce our legal rights.

11.3 Product Development, Analytics and Personalisation

To analyse Platform usage, Order behaviour and customer preferences; improve existing products and features; develop new marketplace features; conduct research, testing, experimentation and analytics; personalise user experience; optimise customer journeys; measure campaign effectiveness; perform customer segmentation, behavioural analytics and profiling; and generate insights to improve the Platform and customer experience.

11.4 Recommendations, Marketing and Business Development

Subject to Applicable Law and, where required, your Consent, to communicate with you regarding products, services, promotions, educational content, surveys, events and loyalty programmes and other offerings; provide personalised recommendations; assess eligibility for current and future products and services; recommend products offered by IGM, its affiliates or authorised business partners; deliver targeted offers; and undertake marketing, customer engagement and business-development activities.

11.5 Business Operations and Service Delivery

To manage our relationships with Brand Partners, logistics and delivery partners, payment partners, marketplace-technology providers, and other service providers; perform internal administration; maintain business records; undertake audits and reconciliations; and support the efficient operation of the Platform.

11.6 Corporate Governance and Legal Purposes

To exercise or defend legal claims; respond to regulatory or law-enforcement requests; support investigations, audits and corporate transactions; and protect the rights, property and legitimate interests of IGM, its Brand Partners and Users.

12. LEGAL BASIS FOR PROCESSING

IGM Processes Personal Data only where one or more of the following lawful bases applies.

12.1 Consent

Where required by Applicable Law, IGM obtains the User’s Consent before Processing Personal Data.

12.2 Performance of a Contract

Processing necessary to create and administer a User’s Account, provide the Services the User requests, fulfil an Order, and perform IGM’s contractual obligations to the User.

12.3 Compliance with Legal Obligations

Processing necessary to comply with a statutory obligation, a judicial or quasi-judicial order, a regulatory direction, tax and accounting requirements, or anti-money-laundering and fraud-prevention obligations, including under Rule 114B of the Income-tax Rules, 1962 and the Prevention of Money Laundering Act, 2002.

12.4 Certain Legitimate Uses

Processing that falls within the certain legitimate uses recognised under Section 7 of the Digital Personal Data Protection Act, 2023, without requiring separate Consent — including where a User has voluntarily provided Personal Data for a specified purpose and has not indicated an objection to its use for that purpose, compliance with a judgment or order of a court or tribunal, and responding to a medical emergency involving a threat to life or health.

13. CONSENT

Where Processing is based on a User’s Consent:

1. Consent is obtained through an affirmative action or another mechanism recognised under Applicable Law;
2. the User may withdraw Consent at any time, through the mechanism available on the Platform or by contacting IGM;
3. withdrawal does not affect the lawfulness of Processing carried out before the withdrawal; and
4. withdrawal may result in suspension or discontinuation of a Service where the underlying Processing is necessary to provide that Service or to comply with Applicable Law.

IGM maintains records evidencing a User’s Consent where required under Applicable Law.

14. KYC, PAN, AML AND REGULATORY COMPLIANCE FOR JEWELLERY TRANSACTIONS

14.1 PAN under Rule 114B

Quoting of PAN is mandatory for the sale or purchase of jewellery exceeding the monetary threshold prescribed from time to time under Rule 114B of the Income-tax Rules, 1962. Where an Order meets or exceeds this threshold, IGM or the relevant Brand Partner will require the User to furnish PAN (or Form 60, where permitted) before completing the transaction.

14.2 PMLA / KYC Obligations

A dealer in precious metals and jewellery meeting the prescribed cash-transaction threshold under the Prevention of Money Laundering Act, 2002 is treated as a “reporting entity” and must undertake client due diligence, maintain records for the period prescribed by law (currently a minimum of 5 years), and report specified and suspicious transactions to the Financial Intelligence Unit-India (“FIU-IND”). Where this applies to an Order, IGM or the relevant Brand Partner will collect the identity and address proof necessary to comply with these obligations, and Process such information solely for that purpose and for as long as legally required.

14.3 Aadhaar

IGM does not require a User to furnish an Aadhaar number as a condition for accessing the Platform or completing an Order. Aadhaar may only be collected on a purely voluntary basis, where the User chooses to use it as an accepted proof of identity, in accordance with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, as amended, and only through the offline/consent-based verification modes permitted for private entities under that law.

14.4 Additional Information

IGM may request additional information or documentation from a User where required for compliance with Applicable Law or IGM’s risk-management policies. Failure to provide such information may result in refusal or delay of the relevant Order, subject to Applicable Law.

15. AUTOMATED PROCESSING, PROFILING AND FRAUD PREVENTION

IGM uses automated tools and algorithms to support:

1. identity verification;
2. fraud detection and prevention;
3. transaction monitoring;
4. cybersecurity monitoring;
5. account security;
6. risk scoring; and
7. suspicious-activity detection.

Where automated Processing is likely to materially affect a User, IGM shall provide for human oversight of the relevant decision, to the extent required under Applicable Law.

16. PRIVACY BY DESIGN, PRIVACY BY DEFAULT AND DATA MINIMISATION

IGM integrates privacy and data-protection considerations into the design of the Platform’s products, systems, processes and technologies from the outset of development, and reviews its privacy governance framework periodically.

Accordingly, IGM shall:

1. Process only the minimum Personal Data necessary for a specified purpose;
2. enable privacy-protective settings by default;
3. assess privacy risk before introducing a new Processing activity; and
4. protect Personal Data throughout its lifecycle.

17. ACCURACY OF PERSONAL DATA

A User is responsible for ensuring that the Personal Data provided to IGM is accurate, complete and up to date, and shall update such data promptly upon any change. IGM is not responsible for any loss, delay or inability to fulfil an Order caused by inaccurate, incomplete or outdated information the User has supplied.

18. ANONYMISED AND AGGREGATED DATA

IGM may anonymise, de-identify or aggregate Personal Data so that it no longer identifies an individual. Information that has been irreversibly anonymised is not treated as Personal Data under this Policy and may be used for statistical analysis, research, service improvement, product development, risk management and security monitoring.

19. USER RESPONSIBILITIES

Each User shall:

1. provide accurate, complete and up-to-date Personal Data;
2. promptly notify IGM of a change to such information;
3. keep account credentials confidential;
4. immediately report suspected unauthorised access to the Platform; and
5. provide Personal Data relating to another individual only with the authorisation and consent that Applicable Law requires.

IGM is not responsible for loss or prejudice arising from inaccurate, misleading or incomplete information a User has provided.

20. DISCLOSURE AND SHARING OF PERSONAL DATA

IGM does not sell, rent, trade or license Personal Data to a third party for that party’s independent commercial or marketing purposes without the User’s prior Consent, except as this Policy expressly permits or Applicable Law requires. IGM discloses Personal Data only on a need-to-know basis, limited to what is reasonably necessary for the purposes described in this Policy, and requires every recipient to maintain technical, organisational and contractual safeguards over the Personal Data it receives.

21. CATEGORIES OF RECIPIENTS

IGM may disclose or share Personal Data only where necessary for the purposes described in this Privacy Policy, to provide the Services, comply with Applicable Law, protect legitimate interests, or with your Consent where required.

21.1 Service Providers

IGM may share Personal Data with third-party service providers engaged to support the operation of the Platform, including providers of cloud infrastructure, hosting, cybersecurity, identity verification, KYC and AML services, payment processing, fraud prevention, analytics, customer support, logistics, and other operational services. Such service providers may Process Personal Data only for authorised purposes and are subject to appropriate contractual confidentiality, privacy and security obligations.

21.2 Brand Partners and Marketplace Ecosystem Partners

IGM may share Personal Data with Brand Partners, jewellery manufacturers, logistics and delivery partners, marketplace-technology partners, and other authorised business partners where reasonably necessary to facilitate an Order, fulfil customer requests, prevent fraud, comply with Applicable Law, or improve customer experience.

21.3 Regulatory Authorities and Professional Advisors

IGM may disclose Personal Data to government authorities, regulators (including FIU-IND and the Income Tax Department), law enforcement agencies, courts, tribunals, statutory bodies, auditors, insurers, legal advisors, consultants and other professional advisers where required or permitted under Applicable Law, to comply with legal obligations, respond to lawful requests, exercise or defend legal rights, investigate fraud or unlawful activity, or protect the rights, property or safety of IGM, its Users or third parties.

21.4 Corporate Group and Business Transfers

IGM may share Personal Data with its affiliates and group companies for internal administration, risk management, compliance and service delivery. In the event of a merger, acquisition, investment, restructuring, financing, sale of assets or business transfer, Personal Data may be transferred to the relevant successor entity, subject to appropriate confidentiality obligations and Applicable Law.

21.5 Aggregated and De-identified Information

IGM may use and disclose aggregated, anonymised or de-identified information that does not identify an individual User for analytics, research, product development, business planning and other lawful business purposes.

22. MARKETPLACE ORDER RECORDS

IGM maintains accurate records of Orders through its internal systems, on a Customer-wise and Brand-Partner-wise basis, so that a User’s order history, fulfilment status, and warranty and buyback records remain separately identifiable and traceable at all times.

23. INTERNATIONAL TRANSFER OF PERSONAL DATA

IGM primarily stores and Processes Personal Data within India. Under Section 16 of the Digital Personal Data Protection Act, 2023, IGM may transfer Personal Data outside India except to a country or territory restricted by the Central Government by notification. Where a technology, cloud or software provider IGM engages Processes Personal Data outside India, IGM shall ensure appropriate contractual safeguards are in place, that the recipient maintains reasonable security measures and confidentiality obligations, and that the transfer is necessary for providing the Services or complying with Applicable Law.

24. THIRD-PARTY PROCESSORS AND VENDOR DUE DILIGENCE

Before engaging a third-party processor to Process Personal Data on its behalf, IGM shall conduct due diligence on the processor’s ability to maintain adequate privacy and information-security standards, and shall periodically review the processor’s performance and compliance. IGM requires each such processor to:

1. Process Personal Data only under IGM’s documented instructions;
2. implement appropriate technical and organisational security measures;
3. maintain confidentiality obligations;
4. promptly notify IGM of an actual or suspected Personal Data breach;
5. permit an audit or provide a compliance certification where the contract requires it; and
6. return or securely delete Personal Data on termination of the engagement, unless Applicable Law requires retention.

25. DATA LOCALISATION

Where Applicable Law or a regulatory direction requires a category of Personal Data or records to be stored or maintained within India, IGM shall comply with that requirement. This Clause does not prevent IGM from maintaining mirrored backups or disaster-recovery environments outside India where Applicable Law permits and appropriate safeguards apply.

26. DISCLOSURES REQUIRED TO PROTECT RIGHTS

IGM may disclose Personal Data where it reasonably believes disclosure is necessary to:

1. protect the rights, property or safety of IGM, its Users or the public;
2. prevent fraud, cybercrime or financial crime;
3. investigate a security incident or unlawful activity;
4. enforce IGM’s Terms of Use or another contractual arrangement;
5. establish, exercise or defend a legal claim; or
6. comply with a lawful request from a competent authority.

27. DATA RETENTION

IGM retains Personal Data only for so long as is necessary to fulfil the purpose for which it was collected, comply with Applicable Law, and satisfy contractual and regulatory obligations. IGM shall periodically review the necessity of retaining Personal Data and shall securely delete, anonymise or destroy it once retention is no longer required, unless Applicable Law mandates continued retention.

27.1 Retention Criteria

The retention period applicable to a category of Personal Data is determined by reference to:

1. the nature and sensitivity of the Personal Data;
2. the purpose for which it was collected;
3. the duration of the User’s relationship with IGM;
4. statutory and regulatory record-keeping requirements;
5. taxation and accounting obligations;
6. pending or reasonably anticipated litigation, investigation or enforcement proceedings;
7. fraud-prevention and risk-management requirements; and
8. IGM’s contractual obligations to Users or third parties.

27.2 Regulatory Records

Without limiting Clause 27, IGM retains: KYC and customer-due-diligence records; Order and transaction records; payment and settlement records; audit logs; communication records; complaint and grievance records; and records required under anti-money-laundering law, each for the period Schedule B specifies.

27.3 Backup and Archival Copies

Personal Data may continue to exist within an encrypted backup or disaster-recovery environment for a limited period after deletion from active systems, subject to the confidentiality and security obligations in this Policy.

28. INFORMATION SECURITY

IGM maintains the confidentiality, integrity, availability and resilience of Personal Data through the administrative, technical, organisational and physical safeguards described in Clause 29, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful Processing.

29. TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

IGM implements the following safeguards, each to the extent appropriate to the risk presented.

29.1 Access Controls

IGM implements role-based access controls so that Personal Data is accessible only to personnel who require access for a legitimate business purpose, and reviews access rights periodically, revoking access promptly when no longer required.

29.2 Authentication and Identity Management

IGM implements multi-factor authentication, strong password policies, privileged-access management, and secure authentication protocols.

29.3 Encryption

IGM protects Personal Data in transit and at rest using industry-accepted encryption, and manages encryption keys under a documented key-management practice.

29.4 Network Security

IGM implements firewalls, intrusion detection and prevention systems, endpoint and malware protection, and continuous security monitoring.

29.5 Logging and Monitoring

IGM maintains security logs of authentication, access to sensitive systems, administrative activity and transaction monitoring, retained for security investigation and regulatory compliance.

29.6 Secure Development Practices

IGM incorporates secure coding practices, code review, vulnerability assessment, penetration testing and change-management procedures into its software development lifecycle.

30. DATA CLASSIFICATION

IGM classifies information Processed through the Platform as Public, Internal, Confidential or Restricted Information. Personal Data is classified as Confidential or Restricted Information and is subject to enhanced protection measures accordingly.

31. BUSINESS CONTINUITY AND DISASTER RECOVERY

IGM maintains business-continuity and disaster-recovery procedures to minimise disruption to the Services and protect the availability of Personal Data, including redundant infrastructure, encrypted backups, and periodic restoration testing. IGM does not warrant uninterrupted availability of the Platform but shall use commercially reasonable efforts to restore operations following a disruption.

32. SECURITY TESTING AND AUDITS

IGM conducts periodic assessments of its information-security controls, including vulnerability assessments, penetration testing, internal audits and third-party security assessments, at a frequency and scope determined by IGM’s internal governance framework and risk profile.

33. DATA BREACH MANAGEMENT

IGM maintains documented procedures for identifying, investigating, containing and responding to an actual or suspected Personal Data breach. On becoming aware of a security incident involving Personal Data, IGM shall:

1. contain and mitigate the incident;
2. preserve relevant evidence and assess its nature, scope and impact;
3. identify the affected systems and individuals;
4. implement corrective and preventive measures;
5. notify the Data Protection Board of India in accordance with Section 8(6) of the Digital Personal Data Protection Act, 2023, and report the incident to CERT-In within the 6-hour timeline prescribed under applicable CERT-In directions, where the incident falls within a reportable category; and
6. notify affected Users where Applicable Law requires notification, or where IGM otherwise considers notification appropriate.

This Clause does not constitute an admission of liability by IGM in respect of any cybersecurity incident.

34. EMPLOYEE CONFIDENTIALITY AND TRAINING

IGM ensures that an employee, officer, consultant, contractor or other authorised representative with access to Personal Data:

1. is bound by a contractual or statutory confidentiality obligation;
2. receives periodic training on privacy, cybersecurity and information security;
3. accesses Personal Data only to the extent necessary to perform their duties; and
4. complies with IGM’s internal privacy and information-security policies.

Non-compliance may result in disciplinary action, contractual remedies or other legal actions, as appropriate.

35. SECURITY OF USER ACCOUNTS

A User is responsible for the confidentiality of their account credentials, passwords, OTPs and authentication codes and security devices.

A User shall:

1. not disclose their credentials to a third party;
2. use a strong, unique password;
3. promptly notify IGM of suspected unauthorised access to their Account; and
4. log out of the Platform after each session on a shared or public device.

IGM is not liable for unauthorised activity resulting from a User’s failure to safeguard their credentials, except where the loss is directly attributable to IGM’s negligence or wilful misconduct.

36. LIMITATION OF SECURITY OBLIGATIONS

While IGM implements the safeguards described in this Policy, no method of electronic transmission or storage is completely secure, and IGM does not warrant that the Platform will be entirely free from cyberattack, malware, unauthorised access or other security threat. Nothing in this Clause limits a non-excludable right or obligation under Applicable Law.

37. SECURITY GOVERNANCE

IGM maintains an internal privacy and information-security governance framework appropriate to the nature, scale and complexity of its business, comprising designated personnel responsible for privacy and security oversight, documented policies and procedures, periodic risk assessments, and regular review of security controls.

38. YOUR RIGHTS IN RELATION TO PERSONAL DATA

IGM shall facilitate the exercise of a User’s rights under the Digital Personal Data Protection Act, 2023 and other Applicable Law, as set out in this Clause 38, subject in each case to Applicable Law.

38.1 Right to Access Information

A User may request confirmation of whether IGM is Processing the User’s Personal Data and, where it is, information on the categories of Personal Data Processed, the purposes of Processing, and the categories of recipients with whom it has been shared. IGM may require reasonable identity verification before responding.

38.2 Right to Correction and Updation

A User may request correction, completion or updating of inaccurate, incomplete or outdated Personal Data IGM maintains.

38.3 Right to Erasure

A User may request deletion or erasure of Personal Data where:

1. it is no longer necessary for the purpose for which it was collected,
2. Consent has been withdrawn and no other lawful basis exists; or
3. Applicable Law no longer requires its retention.

IGM may refuse such a request where continued retention is required for a legal, regulatory, contractual, audit, dispute-resolution or enforcement purpose.

38.4 Right to Withdraw Consent

Where Processing is based on Consent, a User may withdraw it at any time. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal, and may prevent IGM from providing a Service where the underlying Processing is necessary for account administration, Order processing, identity verification or regulatory compliance.

38.5 Right to Nominate

A User may nominate another individual to exercise the User’s rights in relation to Personal Data on the User’s death or incapacity, as recognised under the Digital Personal Data Protection Act, 2023. IGM may require documentary evidence before acting on a nomination.

38.6 Right to Grievance Redressal

A User may submit a complaint or grievance relating to the Processing of Personal Data in accordance with Clause 40.

39. EXERCISING YOUR RIGHTS

A User may submit a request relating to Personal Data through the mechanism available on the Platform or by contacting IGM’s Grievance Officer.

IGM may:

1. request additional information reasonably necessary to process the request;
2. decline a request that is manifestly unfounded, fraudulent or excessive;
3. refuse a request where Applicable Law permits refusal; and
4. retain information where Applicable Law requires, or where necessary for the establishment, exercise or defence of a legal claim.

IGM shall respond to a valid request within the timeline Applicable Law prescribes.

40. GRIEVANCE REDRESSAL

IGM has established a grievance-redressal mechanism for complaints relating to the Processing of Personal Data. A User may contact IGM’s designated Grievance Officer regarding a privacy-related concern, a request relating to Personal Data, a complaint of unauthorised disclosure, a correction or deletion request, a concern regarding Consent, or a security incident affecting Personal Data.

IGM shall acknowledge and endeavour to resolve a grievance within the timeline Applicable Law prescribes. This Clause does not prejudice a statutory remedy available to a User before the appropriate authority or forum, including escalation to the Data Protection Board of India.

41. MARKETING COMMUNICATIONS

Subject to Applicable Law, IGM may send communications relating to new products, promotional campaigns, Brand Partner collections, newsletters, offers, surveys and Platform updates, including by SMS, WhatsApp, email or call. Where Applicable Law requires it, IGM sends such communications only after obtaining the User’s Consent, and commercial communications by SMS or call are sent in accordance with the Telecom Regulatory Authority of India’s Do Not Disturb / National Customer Preference Register framework.

A User may opt out of promotional communications at any time by:

1. selecting the unsubscribe option in the communication;
2. updating communication preferences on the Platform; or
3. contacting IGM.

IGM may continue to send a transactional, security or service-related communication necessary to provide the Services or comply with Applicable Law.

42. CHILDREN’S PRIVACY

The Platform is intended solely for individuals who are legally competent to enter into a binding contract under Applicable Law, and who have completed 18 years of age within the meaning of the Digital Personal Data Protection Act, 2023. IGM does not knowingly collect or Process a child’s Personal Data, except where Applicable Law expressly permits it and IGM has obtained verifiable Consent from the child’s parent or lawful guardian, and does not undertake tracking, behavioural monitoring, or targeted advertising directed at children. On becoming aware that a child’s Personal Data has been collected without the requisite authorisation, IGM shall take reasonable steps to delete that information. A parent or lawful guardian who believes a child has provided Personal Data to IGM may contact the Grievance Officer for assistance.

43. THIRD-PARTY WEBSITES, APPLICATIONS AND SERVICES

The Platform may link to a website, application or online service a third party operates. IGM does not own, operate or control such a third-party platform and is not responsible for its privacy practices, information-security measures, or content. A User should review the privacy policy of a third-party platform before providing Personal Data to it. Inclusion of a third-party link does not constitute IGM’s endorsement of that party.

44. CHANGES TO THIS PRIVACY POLICY

IGM may amend, update or replace this Policy to reflect a change in Applicable Law, a regulatory requirement, technological development, an enhancement to the Services, or an improvement to its privacy or security practices. A revised Policy takes effect on publication on the Platform, unless it states otherwise. Where Applicable Law requires it, IGM shall notify Users of a material change through appropriate electronic means. Continued use of the Platform after the effective date of a revised Policy constitutes acknowledgement of the revision.

45. GOVERNING LAW AND JURISDICTION

This Policy is governed by, and shall be construed in accordance with, the laws of India. Subject to a mandatory dispute-resolution mechanism Applicable Law prescribes, the courts at Mumbai, India have exclusive jurisdiction over a dispute arising out of or relating to this Policy, the Processing of Personal Data, or the Services.

46. SEVERABILITY

If a court or competent authority holds a provision of this Policy invalid, illegal or unenforceable, that provision shall be severed only to the extent of invalidity or unenforceability, and the remaining provisions shall continue in full force and effect.

47. WAIVER

No failure or delay by IGM in exercising a right, power or remedy under this Policy operates as a waiver of it. A waiver is effective only if made in writing by IGM. A waiver of one breach does not waive a subsequent or continuing breach.

48. ENTIRE POLICY

This Policy constitutes IGM’s entire privacy policy governing the collection, use, disclosure, storage, transfer and protection of Personal Data in relation to the Platform and is to be read together with IGM’s Terms of Use, Brand Partner framework, KYC/Anti-Money Laundering Policy, Cookie Policy and Information Security Policy, and any other policy IGM publishes from time to time. Where this Policy is inconsistent with a mandatory provision of Applicable Law, Applicable Law prevails to the extent of the inconsistency.

49. CONTACT US

For a question, request or concern regarding this Policy or the Processing of your Personal Data, contact IGM using the details below.

SCHEDULE A: DATA COLLECTION AND PURPOSES MATRIX

SCHEDULE B: RETENTION SCHEDULE

DECLARATION

By using the Elanzia Platform, registering an Account, or clicking “I Accept”, you confirm that:

• you have read and understood this Privacy Policy in full;
• you consent to the collection, processing, use, and sharing of your Personal Data as described herein;
• you understand your rights as a Data Principal and the limitations on those rights arising from legal obligations, the marketplace model, and fraud-prevention requirements; and
• you are at least 18 years of age.