PURASKRIT CUSTOMER PRIVACY POLICY

DATA COLLECTION NOTICE (As required under Section 5, Digital Personal Data Protection Act, 2023)

Before you use Puraskrit, please read this notice. Asraubh Private Limited (“Puraskrit”) collects your name and phone number for the purpose of creating your loyalty account and enabling merchants to track your loyalty milestones. By tapping “I Agree” at registration, you provide your free, specific, informed, unconditional, and unambiguous consent to this collection and use. You may withdraw consent at any time by deleting your account. To exercise your rights or raise a grievance, contact our Grievance Officer at: support@puraskrit.com.

1. About This Policy

This Privacy Policy governs how Asraubh Private Limited (“Puraskrit,” “we,” “us,” or “our”) collects, uses, stores, and protects the personal data of customers (“Data Principals”) who use the Puraskrit mobile application. This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“IT Rules 2011”).

This Policy must be read together with the Customer Terms & Conditions and the Customer Terms of Use. In the event of any conflict, the document hierarchy is: (1) Customer Terms & Conditions, (2) Customer Privacy Policy, (3) Customer Terms of Use.

2. Definitions

• Data Fiduciary: Asraubh Private Limited, which determines the purpose and means of processing your personal data.
• Data Principal: You, the individual customer whose personal data is being processed.
• Personal Data: Any data about a Data Principal who is identifiable by or in relation to such data.
• Processing: Wholly or partly automated operation or set of operations performed on digital personal data.
• Consent Manager: A platform registered with the Data Protection Board enabling you to manage your consents.

3. Data Collection & Usage

3.1 Personal Data We Collect

Puraskrit collects only the minimum personal data necessary for platform operation:

• Name (mandatory for account creation and merchant identification)
• Phone number (mandatory for account authentication via OTP)
• Optional profile photo (if you choose to upload one)

We do not collect email addresses, location data, payment information, biometric data, or any financial account information from customers.

3.2 Purpose of Processing

Your personal data is used exclusively for the following purposes:

• Creating and maintaining your loyalty account
• Enabling merchants to record and track your loyalty milestones
• Sending you loyalty updates, reward notifications, and platform alerts
• Verifying your identity when you request account changes or deletion

Your data will not be used for any purpose not listed above without your fresh, explicit consent.

3.3 Consent

Your consent is obtained through a clear, affirmative action: by tapping “I Agree” on the consent screen presented at the time of registration on the Puraskrit app. This consent is:

• Free: Not conditional on acceptance of any additional terms beyond what is necessary.
• Specific: Limited to the purposes listed in Section 3.2 above.
• Informed: You will have had the opportunity to read this Policy before consenting.
• Unambiguous: Your tap of “I Agree” constitutes an unambiguous affirmative act.

You may withdraw your consent at any time by submitting an account deletion request as described in Section 6.2. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

4. Data Processing Roles

Puraskrit acts as the Data Fiduciary with respect to the personal data of customers, as defined under the DPDP Act 2023. Puraskrit determines the purpose and means of processing your personal data on its platform.

When merchants interact with your loyalty records through Puraskrit, they access aggregated milestone data only. Merchants do not receive your raw personal data (name or phone number) beyond what is necessary for them to identify your account at their point of sale.

Puraskrit remains jointly responsible for securing the core platform infrastructure against unauthorised access, alteration, or destruction.

5. Security Measures

Puraskrit implements industry-standard technical and organisational security measures including:

• Strict role-based access controls limiting data access to authorised personnel only
• AES-256 encryption of all personal data at rest and in transit
• Continuous system monitoring and intrusion detection
• Security practices aligned with ISO 27001 standards

In the event of a personal data breach that is likely to cause harm to you, Puraskrit will notify you and the Data Protection Board (when constituted) in the manner and within the timeline prescribed by the DPDP Act and applicable rules. Such notification will describe the nature of the breach, the data affected, and the remedial steps taken.

6. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the following rights with respect to your personal data:

6.1 Right to Access Information

You have the right to obtain from Puraskrit: (a) a summary of the personal data we hold about you; (b) a description of the processing activities undertaken with respect to your data; and (c) identities of all Data Fiduciaries and Data Processors with whom your data has been shared. To submit an access request, contact: support@puraskrit.com.

6.2 Right to Correction, Completion, and Updation

You have the right to request the correction of inaccurate or misleading personal data, completion of incomplete data, and updation of data that is no longer current. Requests may be submitted via your account settings or by contacting our Grievance Officer.

6.3 Right to Erasure

You have the right to request the permanent deletion of your personal data. Upon receiving a verified erasure request, Puraskrit will:

• Purge your name and phone number from its active servers within 30 days.
• Delete your account and all associated loyalty milestone records.
• Request that any Data Processors (including cloud infrastructure partners) delete your data.

Erasure may be subject to any legal obligations requiring retention of data (for example, transaction records required under applicable tax laws).

6.4 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have such data transmitted to another Data Fiduciary. To make a portability request, contact: support@puraskrit.com. We will fulfil your request within 30 days.

6.5 Right to Grievance Redressal

You have the right to have your grievances pertaining to personal data processing addressed. All grievances will be acknowledged within 48 hours and resolved within 30 days of receipt. Contact details for our Grievance Officer are set out in Section 9.

6.6 Right to Nominate

You have the right to nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, contact: support@puraskrit.com with a written nomination and supporting identification.

7. Data Retention

Puraskrit retains your personal data for only as long as your account remains active or as necessary to fulfil the purposes outlined in this Policy.

• Active accounts: Data is retained for the duration of your account.
• Inactive accounts: Accounts with no activity for 24 consecutive months will receive a notification before any data action is taken.
• Post-deletion: Following a verified erasure request, data will be purged from active servers within 30 days, subject to any legal retention obligations.

8. Communications & Opt-Out

You may receive communications from Puraskrit via:

• Push notifications: Sent through the Puraskrit app.
• WhatsApp messages: Sent only if you have provided separate, specific consent to WhatsApp communications through the WhatsApp opt-in flow within the app.

All communications will be strictly limited to: loyalty milestone updates, rewards earned with merchants you have transacted with, and critical account or platform notifications.

You may opt out of promotional communications at any time via your account settings. Withdrawal of consent for promotional communications will not affect critical account notifications, which will continue to be delivered.

WhatsApp consent is managed separately from push notification consent. You may withdraw WhatsApp consent without affecting push notifications, and vice versa.

9. Grievance Officer

In accordance with Rule 5(9) of the IT Rules 2011 and the DPDP Act 2023, Asraubh Private Limited has designated a Grievance Officer whose details are as follows:

• Name: Krishna Kumar Pradhan
• Designation: Krishna Kumar Pradhan, Director, Asraubh Private Limited
• Email: support@puraskrit.com
• Address: Asraubh Private Limited, Bengaluru, Karnataka, India
• Response Time: Acknowledgement within 48 hours; resolution within 30 days

If your grievance is not resolved to your satisfaction by the Grievance Officer, you may escalate it to the Data Protection Board of India once constituted under the DPDP Act 2023.

10. Protection of Children's Data

Puraskrit's platform is intended solely for individuals aged 18 years and above. We do not knowingly collect or process personal data of minors (persons under the age of 18).

If you are under 18, you must not register for or use the Puraskrit customer application. If Puraskrit discovers that a minor's data has been inadvertently collected, it will be deleted immediately without further notice.

If you are a parent or guardian and believe that a minor has registered on the platform, please contact our Grievance Officer immediately at support@puraskrit.com. We will take prompt action to delete the account and all associated data.

Where required under the DPDP Act, processing of data in respect of children shall not be undertaken unless verifiable parental consent has been obtained. No behavioural tracking or targeted advertising directed at children will be conducted on this platform.

11. Data Storage & Cross-Border Transfers

All personal data is stored on secure AWS infrastructure located in India, ensuring that your data remains within Indian jurisdiction by default.

Puraskrit does not currently transfer personal data outside India. However, certain third-party service providers used in the operation of the platform (such as analytics tools or communication services) may have servers located outside India. Where any such transfer occurs, Puraskrit will ensure that it is conducted only to countries notified by the Central Government as permitted under the DPDP Act, or with your prior explicit consent, and subject to adequate contractual safeguards for data protection.

We will update this Policy if any change in our data transfer practices occurs.

12. Amendments to This Policy

Puraskrit reserves the right to update this Privacy Policy at any time. You will be notified of all updates through an in-app notification.

For changes that materially affect how your personal data is processed, we will present a fresh consent screen requiring your explicit re-acceptance before the new terms take effect. Continued use of the application after such a screen has been presented and accepted constitutes your acceptance of the updated Policy. Continued use alone, without explicit re-acceptance on the consent screen, shall not constitute consent to material data processing changes.

13. Governing Law

This Privacy Policy is governed by the laws of India, including the DPDP Act 2023, the IT Act 2000, and the IT Rules 2011. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts located in Bengaluru, India.

— End of Customer Privacy Policy —