Privacy Policy

1.INTRODUCTION

BIOART SYNERGY LLP (“Company”, “we”, “us”, or “our”) operates the Twellr platform. We take our responsibility in handling your personal data seriously and are committed to being transparent about what we collect, why we collect it, and what we do with it . This Privacy Policy explains how we collect, use, process, store, disclose, transfer, protect, and otherwise handle your personal data when you access or use the Twellr platform, including any associated websites, applications, software, interfaces, reports, devices, tablets, kiosks, and services made available through partner-operated locations or directly by us (collectively, the “Platform”). This Privacy Policy should be read together with our Terms and Conditions, available at [terms and conditions url], our Cancellation and Refund Policy, available at [url] and any specific notices shown to you at the time your data is collected. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will seek your explicit consent before collecting or processing your personal data, particularly for sensitive categories of information. Where you access the Platform through a device at a partner location, this Policy applies equally to data collected through that interaction.

2. IMPORTANT NATURE OF SERVICE DISCLAIMER

The Platform is an advanced AI-enabled skin and hair wellness analysis tool. It is designed to provide insights and recommendations based on the data you provide.

The Platform generates automated outputs, insights, reports, and recommendations based on the information and images provided by you. These outputs are intended solely for informational and general wellness purposes. They are not a substitute for professional medical, dermatological, or trichological advice.

The Platform does not provide medical advice, diagnosis, prognosis, treatment, or healthcare services, and should not be used as a substitute for consultation with a qualified medical or healthcare professional. Always seek the advice of a physician or other qualified health provider with any questions you may have regarding a medical condition. Never disregard professional medical advice or delay in seeking it because of something you have read on this Platform.

The Platform has not been approved, cleared, or certified as a medical device or diagnostic tool by any regulatory authority, including the Central Drugs Standard Control Organisation (India) or the Dubai Health Authority (UAE). Nothing in the Platform's outputs should be construed as a clinical finding, medical assessment, or professional recommendation of any kind.

3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data collected:

Directly from you when you register an account, use the Platform’s scanning features, fill out forms, upload information, complete a questionnaire, or undergo a scan.
Through devices or interfaces used at partner-operated locations, including salons, clinics, wellness centres, stores, or other third-party facilities that integrate with or facilitate access to the Platform.
When you communicate with us, request support, or interact with our customer service or grievance channels.
Automatically through technical means when you browse, log in to, or otherwise interact with the Platform, including through cookies, logs, and analytics tools.

Through the booking and appointment facilitation features of the Platform, where you provide personal data in connection with scheduling a service with a Partner.

Through the curated marketplace, where you provide personal data in connection with purchasing a product through the Platform.

This Privacy Policy does not apply to third-party websites, services, or applications that are not owned or controlled by us, even if they are linked through the Platform. We encourage you to review the privacy policies of any third-party services you interact with.

4. NOTICE AT THE TIME OF COLLECTION

In compliance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"), before or at the time of collecting your personal data, including facial images and hair data, we will provide you with a clear and specific notice setting out, at a minimum:

The categories of personal data being collected.
The specific purposes for which such personal data will be processed.
Whether any part of the processing involves automated decision-making.
Whether any data will be used for optional purposes, such as AI model training or marketing communications.
The manner in which you may withdraw your consent.
The manner in which you may exercise your rights as a data principal.
The manner in which you may raise a complaint or grievance.

Where your consent is required by law, such consent will be requested through a clear, affirmative action before the relevant data is collected or processed. Under no circumstances will a scan or data collection process be initiated before the required notice has been displayed and the required consent obtained.

g communications.

• The manner in which you may withdraw your consent.

• The manner in which you may exercise your rights as a data principal.

• The manner in which you may raise a complaint or grievance.

5. CATEGORIES OF PERSONAL DATA WE COLLECT

Depending on how you use the Platform, we may collect the following categories of personal data:

5.1 Identity and Profile Data

We may collect:

Your name;
Username or account ID;
Age or date of birth;
Gender;
Profile preferences;
Account credentials, where applicable, for secure access to your Twellr.AI account.

5.2 Contact Data

We may collect:

Email address;
Phone number;
Address or location details, where relevant for service delivery or communication;
Contact preferences to manage how we communicate with you.

5.3 Facial Image and Analysis Input Data

We may collect:

Facial images captured through the Platform’s camera functionality;
Photographs or scan images of your hair and scalp submitted by you;
Information you provide relating to your skin type, skin condition, hair type, hair condition, and specific wellness concerns;
Questionnaire responses, where applicable, to gather additional context for analysis;
Partner-assisted scan inputs, where a trained professional at a partner location helps you conduct the scan.

For clarity, facial image data and hair scan data collected by the Platform are used exclusively for the purpose of generating skin and hair wellness analysis and related service delivery. Unless expressly stated otherwise and with your explicit consent, the Platform is not intended to use your facial image for identity verification, facial recognition, or authentication purposes. Facial images are treated as sensitive personal data under applicable law. Where you access the Platform in guest mode and have not consented to retention, your facial image will be processed for the purpose of the scan only and discarded immediately upon generation of the output (the "analyse-and-discard" approach).

5.4 Analysis Outputs and Reports

We may generate and store:

AI-generated skin and hair analysis results, including scores, metrics, and visualisations;
Personalised reports and summaries of your skin and hair condition;
Recommended product categories, routines, or general wellness suggestions based on the analysis;
Scan history and historical comparison outputs to track your progress over time.

5.5 Technical and Device Data

We may automatically collect:

IP address;
Browser type and version;
Operating system;
Device identifiers (e.g., IMEI, MAC address);
App version;
Access times and dates;
Crash logs and diagnostic logs to identify and resolve technical issues;
Cookies and similar technologies data (as further described in Section 12);
Usage and navigation data, including pages viewed, features used, and interaction patterns.

5.6 Communication and Support Data

We may collect:

Messages sent to us through the Platform, email, or other communication channels;
Support requests and their resolution;
Feedback and complaints you provide;
Call or chat records, where applicable, for quality assurance and training purposes.

5.7 Marketing and Engagement Data

Where you separately opt in, we may collect and use:

Communication preferences regarding marketing;
Campaign responses and engagement with our emails, offers, or promotions.

5.8 Booking and Appointment Data

Your preferred appointment date, time, and location;
The type of service or treatment booked;
The identity of the Partner with whom the appointment is booked;
Any specific requests or notes you provide in connection with the booking;
Booking confirmation and cancellation records.

5.9 Marketplace and Transaction Data

Where you purchase products through the Platform's curated marketplace, we may collect:

Billing name and address;
Delivery address;
Order details, including product names, quantities, and amounts;
Payment method details – please note that full payment card details are processed by our third-party payment gateway and are not stored by the Company;
Order history and return or refund records.

6. HOW WE COLLECT YOUR PERSONAL DATA

We may collect your personal data in the following ways:

Directly from you: When you sign up for an account, fill out forms, upload information, complete a questionnaire, or actively engage with the Platform’s features, including undergoing a facial or hair scan.
Through the device camera or scanning interface: When you choose to proceed with a facial or hair scan using your device’s camera or a dedicated scanning device integrated with the Platform.
Through partner-operated staff or locations: When you visit a salon, clinic, or other wellness centre that facilitates your use of the Twellr.AI Platform, where staff may assist in the data collection process.
Automatically: Through cookies, web beacons, logs, analytics tools, and device telemetry as you browse, log in to, or otherwise interact with the Platform.
From service providers, vendors, or partners: Acting on our behalf, who may provide us with data necessary for the functioning of the Platform or related services.
From communications, support, or grievance channels: When you contact us for assistance, provide feedback, or raise a complaint.
Through the booking flow: When you schedule an appointment with a Partner through the Platform, including any preferences or details you provide at the time of booking.
Through the marketplace checkout: When you purchase a product through the Platform, including delivery and billing details provided at the time of purchase.

7. PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA

We process personal data only for lawful purposes, including the following:

7.1 To Provide Core Platform Services

We may process your personal data to:

Create and manage your Twellr.AI account;
Conduct AI-based skin and hair analysis using your submitted images and inputs;
Generate personalised outputs, reports, and recommendations based on the analysis;
Provide access to your scan history and ensure service continuity;
Enable guest-mode or account-based usage of the Platform;
Support partner-assisted scan flows and integrate with partner systems where applicable.

7.2 To Operate, Maintain, and Improve the Platform

We may process personal data to:

Maintain and administer the Platform, ensuring its smooth and efficient operation;
Troubleshoot errors, technical issues, and bugs to enhance stability;
Improve system functionality, accuracy, performance, and overall user experience;
Monitor service quality and reliability to ensure consistent delivery;
Conduct internal testing, analytics, and product refinement to develop new features and enhance existing ones.

7.3 To Communicate With You

We may process personal data to:

Send service-related messages, including account notifications, updates, and important alerts;
Share scan results or follow-up information directly relevant to your use of the Platform;
Respond to your queries, requests, or complaints efficiently and effectively;
Provide user support and handle any grievances you may have.

7.4 For Security and Fraud Prevention

We may process personal data to:

Detect and prevent misuse, unauthorised access, or fraudulent activities on the Platform;
Protect the integrity and security of the Platform, our systems, and our users’ data;
Monitor, investigate, and prevent suspicious, fraudulent, or unlawful activities;
Maintain audit trails and security logs for compliance and incident response purposes.

7.5 For Optional AI Model Training and Improvement

Where you have separately and explicitly opted in, we may use anonymised or de-identified data to:

Train and improve our AI models and algorithms, enhancing their accuracy and capabilities;
Validate model performance against diverse datasets;
Reduce error rates and biases in AI outputs;
Improve the quality, consistency, and relevance of the analysis and recommendations provided by the Platform. This processing is strictly for product improvement and not for re-identifying individuals.

7.6 For Marketing and Promotional Purposes

Where you have separately and explicitly opted in, we may use your contact details and engagement data to:

Send newsletters, promotions, and product updates related to Twellr.AI or our affiliated services;
Communicate special offers, campaigns, and exclusive content;
Inform you about new features, services, or partnerships that may be of interest to you.

7.7 To Comply With Legal and Regulatory Obligations

We may process personal data to:

Comply with applicable legal requirements, regulations, and industry standards;
Respond to lawful requests or orders from governmental, regulatory, or law enforcement authorities;
Exercise or defend legal claims and protect our legal rights;
Meet internal governance, risk management, and audit requirements.

7.8 To Facilitate Bookings and Appointments

Where you use the Platform's booking features, we process your personal data to:

Match you with available Partner appointment slots;
Communicate booking confirmations, reminders, and changes;
Process cancellations and refunds in accordance with the Cancellation and Refund Policy;
Maintain records of appointments for support and dispute resolution purposes.

7.9 To Process Marketplace Transactions

Where you purchase products through the Platform, we process your personal data to:

Process and fulfil your order, including arranging delivery;
Send order confirmations, dispatch notifications, and delivery updates;
Handle returns, refunds, and product complaints in accordance with the Cancellation and Refund Policy;
Comply with tax, accounting, and legal obligations arising from the transaction.

8. LEGAL BASIS FOR PROCESSING

Depending on the jurisdiction and the specific nature of the processing activity, we may rely on one or more of the following legal bases for processing your personal data:

8.1 Consent

We rely on your explicit consent where required by applicable law, particularly for:

The collection and processing of sensitive personal data, such as facial images and hair scan data, for analysis;
Automated AI-based processing of your data to generate wellness insights;
Optional use of anonymised or de-identified data for AI model training and improvement;
Sending marketing communications.

8.2 Performance of Requested Services

We may process personal data where such processing is necessary to provide the services requested by you, including creating your account, performing scans, and delivering reports as per our Terms and Conditions.

8.3 Compliance With Legal Obligations

We may process personal data where necessary to comply with applicable laws, legal requests, court orders, or regulatory obligations to which we are subject.

8.4 Legitimate and Internal Operational Purposes

To the extent permitted by applicable law and where consent is not the applicable legal basis, we may process limited personal data for our legitimate operational interests, including internal administration, network security, fraud detection and prevention, and service continuity. We carry out a balancing assessment before relying on this basis and will not use it where your fundamental rights and interests override our legitimate purposes. Note that under the DPDP Act (India), legitimate interest is not presently a standalone recognised legal basis; for Indian users, processing outside of consent or legal obligation will be structured accordingly.

9. CONSENT FRAMEWORK

We are committed to a transparent and robust consent framework:

9.1 Prior Consent

Where consent is required by applicable law, we seek it before collecting or processing the relevant personal data. This ensures you are informed before any data is handled.

9.2 Layered Consent

We may use a layered consent mechanism that separately addresses different aspects of data processing:

Consent for core service processing, including the collection and AI analysis of your facial and hair data.
Acknowledgement of the automated nature of AI processing and its inherent limitations.
Acknowledgement of the non-medical nature of the outputs and disclaimer regarding professional advice.
Acceptance of the Terms and Conditions and this Privacy Policy.
Optional consent for AI training and model improvement using anonymised or de-identified data.
Optional consent for receiving marketing communications.

9.3 Separate Optional Consents

Optional uses, including AI training and marketing, are not bundled with the mandatory consent required to provide the core scan service. You have the freedom to choose whether to provide these optional consents without affecting your access to the primary Platform features.

9.4 Refusal of Optional Consent

Refusal to provide optional consent should not, by itself, prevent you from accessing the core Platform services that do not rely on that specific optional processing.

9.5 Withdrawal of Consent

You may withdraw your consent at any time using the mechanism provided within the Platform, through your account settings where available, or by contacting us using the details set out in Section 18. Withdrawal of consent may affect our ability to continue providing certain services, especially where the relevant processing is necessary for the core scan or analysis service. We will inform you of the implications of withdrawing consent. Where you withdraw consent and request deletion of your personal data, we will action your request in accordance with Section 13 (Data Retention) and applicable law. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

9.6 Consent Records

We maintain a record of each consent obtained, including the date and time of consent, the version of the Privacy Policy and Terms and Conditions in force at that time, the specific consents given or withheld, and the device or session through which consent was recorded. These records are maintained for the period required under applicable law and are available to regulatory authorities on request.

10. AUTOMATED PROCESSING AND AI DISCLOSURE

The Twellr Platform extensively uses automated Artificial Intelligence (AI) and machine-learning systems to process your personal data, particularly facial images and hair scan data, and to generate analysis outputs and recommendations.

You acknowledge and understand that:

The processing of your data to generate insights and reports may occur without direct human intervention unless expressly stated otherwise (e.g., for quality assurance or specific support requests).
The outputs, insights, and recommendations provided by the AI are probabilistic and may vary over time due to continuous model improvements, changes in data inputs, or evolving scientific understanding.
Outputs may be affected by factors such as image quality, lighting conditions, environmental factors, user-provided inputs, inherent model limitations, or system updates.
Outputs may contain inaccuracies, inconsistencies, or limitations, and should be interpreted with caution.

The Platform is designed for informational and general wellness use only and not for clinical diagnosis, medical decision-making, or treatment.

Where the Platform makes automated recommendations, including product suggestions, Partner service recommendations, or wellness routines, those recommendations are generated entirely by the AI system based on your submitted data and do not constitute professional advice of any kind. You are under no obligation to act on any recommendation generated by the Platform.

You have the right to request that a specific output or recommendation be reviewed, or to seek clarification on why a particular output was generated, by contacting us at [insert email]. While we cannot guarantee human review of every output, we will respond to such requests in good faith.

11. AI TRAINING, MODEL IMPROVEMENT, AND ANONYMISATION

Where you have provided separate and explicit consent, we may use anonymised or de-identified data for AI model training, validation, testing, and continuous improvement of our algorithms.

For this purpose:

We will remove or reduce direct identifiers from your data, such as your name or contact information, before it is used for AI training.
We will only use data in a form that is not reasonably linked back to a specific individual, applying techniques like pseudonymisation or aggregation.
We apply internal controls and strict protocols to prevent unauthorised re-identification of individuals from anonymised or de-identified datasets.
We limit such use strictly to product development, quality assurance, safety enhancement, and performance improvement purposes of the Twellr Platform.

If you do not provide such optional consent, your data will not be used for this optional AI training purpose. Anonymised or de-identified data used for AI training will not be re-identified or linked back to any individual. If at any point we determine that anonymisation has been or may have been compromised, we will immediately cease use of that data for training purposes and notify affected users where required by applicable law.

12. COOKIES, ANALYTICS, AND SIMILAR TECHNOLOGIES

We may use cookies, software development kits (SDKs), pixels, local storage, and similar technologies to enhance your experience and understand Platform usage:

Essential Cookies: Necessary for the Platform to function correctly, enabling features like logging in securely and maintaining session state.
Performance/Analytics Cookies: Help us understand how users interact with the Platform, identify popular features, and detect areas for improvement. We may use third-party analytics services, which may include Google Analytics or similar services, for this purpose.
Functionality Cookies: Remember your preferences (e.g., language, settings) to provide a more personalised experience.
Marketing/Targeting Cookies: Where you have opted in, these may be used to deliver relevant advertisements to you on other platforms based on your interests.

You can control your cookie preferences at any time through our cookie consent manager, available at [cookie preferences link], or through your browser or device settings. Please note that disabling essential cookies will affect the functionality of the Platform and may prevent you from accessing certain features.

13. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. Our retention periods are carefully determined based on the type of data, the purpose of processing, and legal obligations.

Indicative retention periods may include:

13.1 Facial Images and Related Scan Inputs

Facial image data and associated hair scan inputs may be retained for up to [facial image retention period] from the date of collection or analysis. This period allows for re-analysis, historical comparison, and addressing any immediate support queries. This retention period is subject to:

A shorter retention period being operationally adopted by us.
A longer period being required by law (e.g., for audit or regulatory compliance).
Retention being necessary for dispute resolution, audit, fraud prevention, or legal defence.
You having separately consented to optional use for model improvement, in which case only the anonymised or de-identified form of data may be retained for that specific purpose.

13.2 Account and Profile Data

Account-related data (e.g., name, email, username, preferences) may be retained while your account remains active and for a reasonable period thereafter (e.g., [account data post deletion retention period]) for compliance, support, fraud prevention, or account reactivation purposes.

13.3 Outputs and Reports

AI-generated reports and analysis outputs may be retained for service continuity, historical comparison, user support, or legal purposes, subject to applicable law and your rights to erasure.

13.4 Consent and Audit Records

Consent logs, policy version records, security logs, and related evidence may be retained for audit, compliance, legal, and security purposes for periods mandated by law (e.g., [consent audit retention period]).

13.5 Anonymised or De-identified Data

Where data has been validly anonymised or de-identified and is no longer linked to you, it may be retained for research, analytics, and model improvement, subject to applicable law and internal controls, potentially indefinitely.

When personal data is no longer required for the stated purposes, we will delete, erase, anonymise, or securely dispose of it in accordance with our retention practices and applicable law.

Where you request deletion of your personal data, we will act on your request within a reasonable time, subject to any retention obligations under applicable law that require us to retain certain records for specified periods. We will inform you if any such legal retention obligation prevents us from fully acting on your deletion request.

14. HOW WE SHARE YOUR PERSONAL DATA

We do not sell your personal data. We may share your personal data only as reasonably necessary and subject to appropriate safeguards, including with the following categories of recipients:

14.1 Service Providers and Vendors

We may share personal data with trusted vendors and service providers who assist us with various functions, including:

Cloud hosting and storage (e.g., [cloud provider name]);
Cybersecurity and data protection services;
Analytics and performance monitoring;
Customer support and communication services;
Software development and maintenance;
AI infrastructure or related technical support.

Such parties are contractually obligated to process data only on our instructions and are subject to strict confidentiality and security obligations. Where a service provider is located outside India or the UAE, data transfers to that provider will be conducted subject to appropriate transfer safeguards as described in Section 15.

14.2 Partner Locations and Facilitation Partners

Where you use the Platform through a salon, clinic, store, or similar partner location, the Partner facilitates your access to the Platform and may assist with the scan process. Partners are bound by contractual obligations that prohibit them from accessing, storing, or independently using personal data collected through the Twellr Platform without your separate consent. The data collected through the Platform during a partner-assisted session remains governed by this Privacy Policy.

14.3 Professional Advisors and Corporate Affiliates

We may share data with our professional advisors (e.g., lawyers, auditors, consultants), insurers, and corporate affiliates for lawful internal, corporate, compliance, or transaction purposes.

14.4 Legal and Regulatory Authorities

We may disclose personal data:

Where required by law, regulation, or court order;
To comply with legal process or governmental requests;
To protect our rights, property, safety, and security, or the rights, property, safety, and security of our users or the public;
In connection with investigations, claims, or regulatory inquiries.

14.5 Business Transfers

In the event of a merger, acquisition, restructuring, investment, or sale of all or part of our business or assets, your personal data may be transferred as part of such transaction, subject to applicable law and appropriate safeguards. We will notify you of any such change in ownership or control of your personal data.

14.6 Payment Gateway Providers

Where you make a purchase through the Platform's marketplace, your payment details are processed by a third-party payment gateway provider. Twellr does not store or have access to your full payment card details. The payment gateway provider's own privacy policy governs the processing of your payment information. We will identify our payment gateway provider(s) at the point of checkout.

15. CROSS-BORDER TRANSFERS AND DATA STORAGE

The Twellr.AI Platform may operate across multiple jurisdictions. Your personal data may therefore be stored, accessed, or processed in one or more countries depending on:

Your geographical location;
The location of our service providers and their data centres;
The location of our technical infrastructure;
The operating model for specific partner locations.

Where personal data is transferred across borders, particularly outside your country of residence, we will seek to do so in accordance with applicable law and subject to appropriate contractual, organisational, or technical safeguards.

Depending on the jurisdiction, this may include transfers:

Within India;
Within the UAE;
Between India, UAE, and other jurisdictions (e.g., to cloud service providers in [other data storage countries]).

You acknowledge that the level of data protection in another jurisdiction may differ from that in your home jurisdiction. Where required, we will take steps intended to ensure that transferred personal data remains protected to a standard comparable to that required by your local data protection laws.

We recognise that data protection standards differ between jurisdictions. Where we transfer personal data outside your home jurisdiction, we will implement appropriate safeguards, which may include Standard Contractual Clauses, data processing agreements with receiving parties, or your explicit consent for specific transfers. We will not transfer your personal data to a jurisdiction that does not provide an adequate level of protection without first putting appropriate safeguards in place.

16. PARTNER LOCATIONS, SHARED DEVICES, AND DEVICE GOVERNANCE

The Twellr.AI Platform may be accessed through partner-operated tablets, kiosks, or other devices located in salons, clinics, wellness centres, or retail locations.

Where this occurs:

The partner may assist in facilitating the scan or onboarding process, guiding you through the Platform’s features.
The partner may control the physical environment or hardware through which the Platform is accessed.
We implement technical and contractual controls to reduce the risk of misuse of such devices and to ensure data security

Users should exercise caution when using shared devices. We recommend that you:

Ensure you are logged out of your account after each session.
Avoid sharing unnecessary personal information in public or open environments.
Ensure that you complete the scan in a manner that preserves your privacy as far as reasonably possible.

17. CHILDREN’S PRIVACY

The Twellr.AI Platform is not intended for use by children under the age of 18 (eighteen) years, except where use is specifically designed to comply with applicable law and any required parental or guardian permissions have been obtained.

We do not knowingly collect personal data from children under the age of 18. Where the Platform is accessed through a partner location, it is the responsibility of the Partner to ensure the Platform is not used by minors without appropriate parental consent. Twellr's Channel Partner Agreement requires Partners to comply with this obligation.

If we become aware that personal data has been collected from a child in a manner not permitted by applicable law, we will delete or restrict such data from our systems as soon as practicable and will notify the relevant parent or guardian where we are able to do so.

If you believe that a child has provided personal data to us inappropriately, please contact us immediately using the details provided in Section 18.

18. YOUR RIGHTS

Subject to applicable law, you may have the following rights regarding your personal data:

Right to Access: Request a summary of the personal data we process about you and obtain a copy of such data.
Right to Information: Request information on how your personal data has been processed, including the purposes, categories of data, and recipients.
Right to Correction: Request the correction, completion, or updating of inaccurate or incomplete personal data we hold about you.
Right to Erasure: Request the deletion or erasure of your personal data, where applicable (e.g., if the data is no longer necessary for the purposes for which it was collected, or you withdraw consent).
Right to Withdraw Consent: Withdraw your consent at any time for processing activities based on consent.
Right to Object or Restrict Processing: Object to or request restriction of certain processing activities, where applicable (e.g., for direct marketing).
Right to Opt-Out of Marketing: Opt out of receiving marketing communications from us.
Right to Grievance Redressal: Raise a complaint or grievance regarding our processing of your personal data.
Right to Nominate: Nominate any other individual who, in the event of your death or incapacity, shall exercise your rights under this Policy.

We may need to verify your identity before responding to such requests to ensure the security of your data. We may also retain certain data where required for legal, security, fraud prevention, or compliance reasons, even if you request its deletion.

To exercise any of the above rights, please contact us at [email address]. We will acknowledge your request within [5] business days and respond substantively within [30] days, or such other period as may be prescribed by applicable law. Where we are unable to comply with a request in full, we will explain the reasons for this.

For users in India: The rights listed above reflect the rights of a Data Principal under the Digital Personal Data Protection Act, 2023. Where the notified DPDP Rules specify particular procedures or timelines for the exercise of these rights, those procedures will apply.

For users in the UAE: The rights listed above reflect the rights available under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Additional rights or procedures may apply under UAE law or applicable emirate-level regulations.

19. GRIEVANCE REDRESSAL AND CONTACT FOR PRIVACY REQUESTS

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy or the handling of your personal data, you may contact our Grievance Officer / Privacy Contact:

Grievance Officer / Privacy Contact: [Grievance Officer Name]
Email: [Grievance Officer Email]
Phone: [Grievance Officer Phone Number]
Address: [Grievance Officer Address]

We will endeavour to review and respond to all privacy or grievance requests within a reasonable time and in accordance with applicable law (e.g., within [grievance redressal timeline] as per DPDP Act).

20. DATA SECURITY

We implement reasonable technical, organisational, administrative, and contractual safeguards intended to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. Our security measures are regularly reviewed and updated to address evolving threats.

Such safeguards may include:

Access Controls: Strict role-based access controls and authentication mechanisms to limit access to personal data to authorised personnel only.
Encryption: Encryption of personal data both in transit (using TLS/SSL) and at rest (using industry-standard encryption protocols) where appropriate.
Role-Based Permissions: Granular permissions to ensure personnel only access data necessary for their specific job functions.
Secure Hosting Environments: Utilisation of secure cloud hosting environments with robust physical and environmental security measures.
Audit Logging: Comprehensive audit logging to track access and changes to personal data.
Vulnerability Management: Regular vulnerability assessments and penetration testing to identify and remediate security weaknesses.
Incident Response Processes: Established incident response plans to effectively manage and mitigate potential data breaches.
Vendor Security Controls: Due diligence and contractual agreements with service providers to ensure they maintain adequate security standards.

However, no system, network, device, or method of transmission or storage can be guaranteed to be completely secure. You should also take appropriate precautions to protect your own devices, account credentials, and communications.

Notwithstanding the security measures described above, you should be aware that no transmission of data over the internet or storage system can be guaranteed to be completely secure. If you have reason to believe that your account or personal data has been compromised, please contact us immediately at [support email].

21. PERSONAL DATA BREACHES

If we become aware of a personal data breach affecting your personal data, we will take immediate steps including:

Investigating and containing the incident to prevent further unauthorised access or disclosure.
Assessing the scope, impact, and risk of the breach.
Notifying affected individuals, relevant regulators, or authorities where required by law, in a timely manner.
Taking appropriate remedial and preventive measures to address the root cause and enhance security.

You should notify us immediately if you suspect any unauthorised access, misuse, or compromise relating to your account or data.

Where we are required by applicable law to notify you of a personal data breach, we will do so through your registered email address, through the Platform, or by such other means as are reasonably likely to bring the breach to your attention. Notification timelines will comply with applicable law including, where applicable, the DPDP Act and UAE PDPL breach notification requirements.

22. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, products, applications, or services that are not owned or controlled by us. We do not control and are not responsible for the privacy practices, content, or conduct of such third parties.

Your interactions with such third parties are governed by their own privacy policies and terms. We encourage you to review these policies before providing any personal data to them.

23. CHANGES TO THIS PRIVACY POLICY

We may update or modify this Privacy Policy from time to time to reflect changes in:

Our services or business model;
Technology or security practices;
Legal or regulatory requirements (e.g., new data protection laws);
Data processing activities.

The updated version will be posted on the Platform with a revised “Last Updated” date. Where required by law, we may provide additional notice or seek fresh consent for significant changes.

Where a change to this Privacy Policy materially affects the way we process your personal data, particularly if it involves a new category of data, a new purpose, or a new sharing arrangement, we will notify you at least fourteen (14) days before the change takes effect, via your registered email address or through the Platform. Where the change requires fresh consent, we will seek that consent before the new processing begins.

Your continued use of the Platform after notice of a non-material change constitutes your acceptance of the revised Policy. For material changes requiring fresh consent, continued use will be conditional on consent being provided.

24. LANGUAGE AND INTERPRETATION

This Privacy Policy may be made available in multiple languages. In the event of any inconsistency or conflict between the English version and any translated version, the English version shall prevail unless otherwise required by applicable law.

Headings are for convenience only and do not affect the interpretation of any provision herein.

25. CONTACT INFORMATION

For all privacy-related matters, please contact:

[Company Full Legal Name]
[Company Registered Address]
Email: [Privacy Contact Email]
Phone: [Privacy Contact Phone Number]
Website / Support Page: [Company Website or Support Page]