PRIVACY POLICY & DATA PROTECTION NOTICE

1. GENERAL & LEGAL FRAMEWORK

a) Legal Compliance & Regulatory Foundation

This Privacy Policy and Data Protection Notice ("Policy") is a legally binding digital contract published in absolute compliance with the statutory laws of India. Specifically, this Policy is anchored upon:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") and all subsequent central rules and notifications governing the processing of digital personal data within India.
• Section 43A, Section 72A, and Section 79 of the Information Technology Act, 2000 ("IT Act"), which govern electronic records, data protection, and intermediary exemptions.
• Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which mandates the publication of privacy frameworks by digital intermediaries.

b) Electronic Record Status

This document is an electronic record generated by a computer system and does not require any physical, digital, or electronic signatures to be legally enforceable. By accessing the Platform, you acknowledge that this electronic record governs your relationship with the Company.

c) Corporate Identity & Jurisdiction

The domain name www.nemeex.com and its associated mobile applications (collectively referred to as the "Platform" or "Website") are owned, managed, and operated by Nemeex Advisory (OPC) Private Limited ("the Company"), a One Person Company limited by shares, incorporated under the provisions of the Companies Act, 2013. The Company maintains its principal place of business at House No. 10, 1st Floor, Block C-5, Sector-6, Rohini, Delhi-110085, India.

d) Scope of Application

This Policy applies universally to all natural persons who access, browse, register, or utilize the tech-enabled consultation matching services provided on the Platform. Under this framework, the Company acts strictly as a "Data Fiduciary" under the DPDP Act, as it determines the purpose and means of processing your data. The User acts as the "Data Principal", retaining ultimate statutory ownership and rights over their personal information.

e) Absolute Consent Architecture

In strict compliance with Section 6 of the DPDP Act, the Company does not rely on passive, implied, or "deemed browsing" consent. To use the Platform's core matching and consultation features, you must click a mandatory, un-ticked "I Agree and Accept" checkbox during account registration or data submission. This action constitutes your free, specific, informed, unconditional, and unambiguous consent to allow the Company to process your digital personal data strictly for the itemized purposes detailed in Section 2 of this Policy. You maintain an absolute, unconditional right to withdraw this consent at any point by contacting our Grievance Officer.

2. STATUTORY DEFINITIONS AND INTERPRETATION

For the purposes of this Privacy Policy, and in strict accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 (IT Act), the following terms shall have the meanings assigned to them below:

• "Data Fiduciary": refers to Nemeex Advisory (OPC) Private Limited ("the Company"), as the entity which alone or in conjunction with others determines the purpose and means of processing Personal Data on the Platform.
• "Data Principal": refers to You, the natural person, User, or Client accessing the Website, who is the subject of the Personal Data and to whom the data belongs.
• "Data Processor": refers to any trusted third-party service provider, platform partner, cloud host, or affiliate who processes Personal Data on behalf of the Data Fiduciary under an explicit service contract.
• "Personal Data": means any digital data or information about an individual who is identifiable by or in relation to such data, including but not limited to identity, contact details, transaction histories, and consultation logs.
• "Processing": in relation to Personal Data, means a wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, sharing, indexing, restriction, erasure, or destruction.
• "Intermediary": shall have the same meaning as defined under Section 2(1)(w) of the Information Technology Act, 2000, signifying that the Platform operates strictly as a technology enabler facilitating transmission between independent parties.
• "Personal Data Breach": means any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, alteration, destruction, or loss of access to personal data that compromises its confidentiality, integrity, or availability.
• "Consent Manager": refers to a data fiduciary registered with the Data Protection Board of India (DPBI) that is authorized by the Data Principal to give, manage, review, and withdraw consent on their behalf.
• "Platform Content": means all third-party data, communication logs, independent professional opinions, strategies, or diagnostic advice hosted, transmitted, or made available by independent Consultants through the technological conduit of the Website.

3. NOTICE OF DATA COLLECTION AND PURPOSES OF PROCESSING

In accordance with Section 5 of the DPDP Act, this section serves as an explicit notice of the Personal Data we collect and the specific purposes for which it is processed:

4. DATA PRINCIPAL RIGHTS (YOUR CONTROL OVER YOUR DATA)

As a Data Principal under Chapter III of the DPDP Act, you possess the following statutory rights, which you can exercise through our platform interface or by reaching out to our Grievance Officer:

• Right to Access: You have the right to request a summary of your Personal Data currently processed by the Company, along with a description of all third parties with whom your data has been shared.
• Right to Correction and Erasure: You have the right to correct inaccurate data, complete incomplete details, or request the permanent erasure of your Personal Data when it is no longer necessary for the purpose it was collected.
• Right to Withdraw Consent: You may withdraw your consent to data processing at any time. Upon withdrawal, we will cease processing your data unless required by overriding statutory frameworks.
• Right of Grievance Redressal: You have the right to lodge a complaint regarding any data processing practice with our internal Grievance Officer. If your grievance is not resolved within the legally mandated timelines, you may escalate your complaint to the Data Protection Board of India (DPBI).
• Right to Nominate: You have the right to nominate any other individual to exercise your data principal rights in the event of your death or systemic incapacity.
• Right to Deploy a Consent Manager: You have the statutory right to give, review, manage, or withdraw your consent through a registered Consent Manager authorized under the DPDP Act. You may deploy your authorized Consent Manager to exercise these rights either by navigating to your account dashboard settings or by having your Consent Manager submit a formal digital request directly to our Grievance Officer at grievance@nemeex.com.

5. SHARING AND TRANSFER OF PERSONAL DATA

a) Data Processors & Affiliates

To facilitate tech-enabled consultations, the Company may share your Personal Data with third-party cloud service providers, customer management tools, and business affiliates acting strictly as Data Processors under explicit data processing contracts. These processors are contractually bound to deploy security measures at least equivalent to those maintained by the Company.

b) Cross-Border Transfers

The Company will only transfer or process Personal Data outside India in strict compliance with the notifications, restrictions, and blacklists issued by the Government of India under Section 16 of the DPDP Act.

c) Legal Disclosures

We may disclose your Personal Data to judicial, regulatory, or law enforcement authorities only when compelled by valid subpoenas, court orders, or statutory commands under applicable Indian laws.

d) Penalty for Unauthorized Disclosure under Section 72A of the IT Act

In accordance with Section 72A of the IT Act, 2000, any access, use, or disclosure of a Data Principal's personal data or electronic records without express consent, or in breach of a lawful contract, is strictly prohibited. The Company enforces strict internal access controls and confidentiality protocols across all employees, representatives, and Data Processors. Any individual or affiliate found accessing, utilizing, or disclosing personal data with the intent to cause wrongful gain or wrongful loss shall face immediate termination, regulatory escalation, and criminal prosecution to the fullest extent of applicable Indian laws.

6. DATA RETENTION AND ERASURE SCHEDULES

a) Retention Limitation

In compliance with Section 8(7) of the DPDP Act, the Company will not retain your Personal Data indefinitely.

b) Deletion Triggers

Your Personal Data will be systematically erased from our active production environments, database aggregates, and disaster recovery backup architecture upon the occurrence of any of the following events:

• You withdraw your consent for processing.
• You initiate an explicit profile erasure request under Section 4 of this Policy.
• The purpose for which the data was collected has been fully realized, or your user account remains completely inactive for a consecutive period of 365 days.

7. DATA SECURITY AND PROTECTION

a) Technical Protections

The Company treats your data as an asset requiring protection against unauthorized access, loss, or alteration. We deploy industry-standard Advanced Encryption Standard (AES) protocols for data at rest and Transport Layer Security (TLS) framework layers for data in transit.

b) Payment Card Isolation

The Platform does not receive, process, or store your credit card, debit card, or banking credentials. All monetary interactions are routed through secure, external payment gateways that fully comply with the Payment Card Industry Data Security Standard (PCI-DSS) and Reserve Bank of India (RBI) directives.

c) Statutory Security Compliance under Section 43A of the IT Act

In compliance with Section 43A of the IT Act, 2000, and the SPDI Rules, 2011, the Company maintains industry-standard data security frameworks to protect personal and sensitive assets against unauthorized access or disclosure.

d) Statutory Breach Notification

While we deploy robust protective layers, no system is entirely impenetrable. In the highly unlikely event of a personal data breach, the Company will immediately execute its incident response protocol, notify the Data Protection Board of India (DPBI), and send clear notices to affected Data Principals in accordance with Section 8(6) of the DPDP Act.

8. COOKIES AND AUTOMATED TRACKING

a) Mechanism Disclosure

The Platform utilizes temporary (session) and permanent cookies to remember user authentication details, analyze web flow, evaluate promotional milestones, and ensure operational safety.

b) User Autonomy

You have full authority to decline or block cookies through your web browser preferences. However, disabling technical or functional cookies may prevent the proper rendering of certain automated consultation pipelines on the Platform.

9. POLICY AMENDMENTS AND RE-CONSENT PROTOCOLS

The Company reserves the right to modify this Policy to reflect changing regulatory requirements or operational pivots. We will not silently alter our data processing guidelines. Any material changes to how your data is collected, shared, or retained will be communicated to you via your registered email address or a prominent UI banner alert. If an update modifies the core purpose or nature of processing, you will be presented with a clear Notice to provide fresh, affirmative consent before the updated processing rules take effect.

10. INTERMEDIARY STATUS AND SAFE HARBOUR PROTECTION

a) Acknowledge of Status

The User explicitly acknowledges and agrees that the Platform operates strictly as an "Intermediary" as defined under Section 2(1)(w) of the Information Technology Act, 2000 (as amended).

b) Exemption from Content Liability

Users explicitly acknowledge that the Platform operates strictly as an "Intermediary" as defined under Section 2(1)(w) of the Information Technology Act, 2000. In strict accordance with Section 79 of the IT Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Platform is exempt from any liability for third-party data, communication logs, professional opinions, consultation streams, or advice transmitted or hosted on or through the Platform.

c) Absence of Editorial Control

The Platform functions solely as a technology facilitator connecting independent consultants with prospective Clients. The Platform does not initiate communication or consultation sessions; does not pre-screen, select, or modify the opinions, diagnostics, strategies, or data exchanged within a private session; and does not select the receiver of any transmission. Any professional representation or diagnostic summary belongs entirely to the independent Consultant. The Platform is not liable for professional negligence or misrepresentations.

d) Indemnification:

Any advice, diagnostic, professional opinion, or strategy provided by a consultant is exclusively the personal representation of that independent Consultant. The Platform does not pre-screen, validate, monitor, or endorse any such content, and the User agrees to indemnify the Company against any damages arising out of professional negligence or misrepresentation by third parties.

e) Notice and Take-Down Framework

In compliance with its statutory obligations under the IT Act, 2000, the Platform maintains a diligent notice-and-takedown mechanism. Upon receiving actual knowledge or a formal notification from an affected user, regulatory body, or law enforcement agency regarding unlawful, infringing, or defamatory material on the Platform, we will act swiftly to remove or disable access to such content within the legally prescribed timelines.

f) ILLEGAL AND PROHIBITED CONTENT PROHIBITION

In accordance with Rule 3(1)(b) of the IT Intermediary Guidelines Rules, 2021, the User agrees and guarantees that they shall not host, display, upload, modify, publish, transmit, store, update, or share any information or data on the Platform that:

• Belongs to another person and to which the user does not have any right.
• Is obscene, pornographic, pedophilic, invasive of another's privacy, insulting or harassing on the basis of gender, libelous, racially or ethnically objectionable, or encouraging money laundering or gambling.
• Infringes any patent, trademark, copyright, or other proprietary rights.
• Deceives or misleads the addressee about the origin of the message or knowingly communicates any misinformation.
• Impersonates another person or contains software viruses designed to interrupt, destroy, or limit the functionality of any computer resource.
• Threatens the unity, integrity, defence, security, or sovereignty of India, or incites the commission of any cognizable offense.

11. GRIEVANCE REDRESSAL MECHANISM

If you have any questions, concerns, complaints, or if you wish to exercise your rights regarding your Personal Data under this Policy, please reach out to our designated Grievance Officer:

• Name of the Grievance Officer: Nita Gurha
• Designation: Grievance Officer & Data Protection Liaison
• Postal Address: Nemeex Advisory (OPC) Private Limited, House No. 10, 1st Floor, Block C-5, Sector-6, Rohini, Delhi-110085, India.
• Electronic Mail Contact: grievance@nemeex.com

12. DISPUTE RESOLUTION AND JURISDICTION

a) Alternate Dispute Resolution (ADR)

Any dispute, divergence, or claim arising out of the interpretation, breach, or performance of this Policy shall be settled through a two-step Alternate Dispute Resolution mechanism:

• 1. Mediation: The Parties will first attempt to resolve the issue amicably through mutual negotiations within thirty (30) days of notification of the dispute.
• 2. Arbitration: If mediation fails, the dispute shall be referred to binding arbitration by a sole arbitrator mutually appointed by both Parties. The arbitration proceedings shall be conducted in English, governed by the Arbitration and Conciliation Act, 1996, with the seat and venue fixed at Delhi, India.

b) Governing Law

This Policy, its underlying mechanisms, and all relationships between the Parties are governed exclusively by the laws, statutory acts, and regulations of India. The courts at Delhi shall retain exclusive judicial jurisdiction over all matters connected to this Policy.