Privacy Policy

Effective: October 10, 2026
Last updated: October 10, 2026
Version: 1.0

1. Introduction

India Gold Metaverse Limited (“IGM”, “Company”, “we”, “our” or “us”) owns and operates RamMudra, a digital and physical gold platform accessible through the RamMudra mobile application, the website at www.rammudra.com, IGM's APIs, SDK integrations, and authorised partner channels, through which eligible Users may purchase, sell, redeem and manage Digital Gold and such other precious-metal products as IGM introduces from time to time (the “Services”).

This Privacy Policy (“Policy”) explains how IGM collects, uses, discloses, retains and otherwise Processes Personal Data of individuals accessing or using the RamMudra website, mobile application, APIs, customer support channels and related digital interfaces (the “Platform”).

This Policy forms part of, and is to be read together with, IGM's Terms and Conditions, KYC Policy and Anti-Money Laundering Policy. By creating an Account, completing KYC verification, initiating a transaction or otherwise using the Platform, you confirm that you have read, understood and agreed to this Policy.

2. Objectives of this Policy

This Policy is intended to:

(a) identify the categories of Personal Data IGM collects;
(b) state the lawful purposes for which IGM Processes such Personal Data;
(c) describe how Personal Data is protected;
(d) identify the circumstances in which Personal Data is disclosed to third parties;
(e) set out the rights available to Users under Applicable Law; and
(f) record IGM's compliance with Applicable Law relating to privacy and data protection.

3. Applicability

This Policy applies to the Personal Data IGM Processes in connection with the Platform, of:

(a) registered Users;
(b) prospective customers who initiate but do not complete registration;
(c) visitors to the Platform;
(d) purchasers and sellers of Digital Gold and physical gold;
(e) merchants and referral or business partners, to the extent IGM Processes their Personal Data; and
(f) any other individual who interacts with IGM in relation to the Services.

This Policy applies irrespective of the device or technology used to access the Platform.

4. Applicable Law

This Policy is prepared with reference to the following Indian laws, in each case as amended, substituted or re-enacted from time to time:

(a) the Digital Personal Data Protection Act, 2023, and rules made thereunder;
(b) the Information Technology Act, 2000;
(c) the Prevention of Money Laundering Act, 2002, where applicable to the Services; and
(d) directions, circulars and notifications issued by a competent governmental or regulatory authority that apply to the Services.

This Policy does not limit IGM's obligation to comply with any additional legal or regulatory requirement applicable to the Services.

5. Definitions

In this Policy, unless the context otherwise requires:

“Account” means the account a User creates on the Platform to access the Services.

“Applicable Law” means the statutes, rules, regulations, notifications, circulars, directions, judicial decisions and governmental orders identified in Clause 4, and any other law that applies to IGM or the Services.

“Consent” means a free, specific, informed, unconditional and unambiguous indication of agreement by a User to the Processing of the User's Personal Data.

“Digital Gold” means electronically represented ownership of physical gold purchased through the Platform, backed by physical gold held under an authorised custodial or vaulting arrangement.

“Personal Data” has the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

“Processing” means collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, sharing, transfer, restriction, anonymisation, deletion or destruction of Personal Data, and “Process” shall be construed accordingly.

“Services” means the products and services IGM offers through RamMudra from time to time.

“User”, “you” or “your” means an individual accessing or using the Platform.

Words importing the singular include the plural and vice versa.

6. Blockchain-based Recordkeeping: Special Disclosures

6.1 Use of Blockchain

As part of the Services, IGM maintains blockchain-backed records relating to certain customer information, Digital Gold ownership, holdings and transactions to enhance transparency, integrity, auditability, reconciliation and fraud prevention.

Blockchain records maintained by IGM are intended solely to support the operation of the Platform and do not constitute crypto-assets, virtual digital assets, cryptocurrencies, transferable tokens or securities. Users do not own, control or have access to any blockchain wallets, private keys or blockchain infrastructure.

6.2 Information Recorded

Subject to Applicable Law and technical design, blockchain-backed records may include customer identifiers or references, transaction identifiers, Digital Gold ownership records, balances, timestamps and other transaction-related metadata. Sensitive personal information and KYC documents are generally maintained in secure off-chain systems unless otherwise required by law or technical necessity.

6.3 Reconciliation and Operational Corrections

Blockchain records form an additional evidentiary and audit layer supporting the Platform. In the event of fraud, disputes, payment reversals, operational errors, regulatory requirements, court orders or other legitimate business requirements, IGM may make corresponding corrective entries or adjustments in its operational records and, where technically feasible and appropriate, record corresponding blockchain transactions. The Company's operational records, together with records maintained by its custodian and trustee, shall prevail for the purposes of determining customer entitlements where reconciliation is required.

6.4 Data Retention

Due to the nature of blockchain technology, certain blockchain records may not be capable of being modified or deleted. Where Personal Data cannot be erased from blockchain infrastructure, IGM shall, where feasible, delete, anonymise or restrict access to corresponding off-chain Personal Data and retain blockchain records only to the extent necessary to comply with Applicable Law, regulatory obligations, fraud prevention, audit and legitimate business requirements.

7. Privacy Principles

IGM Processes Personal Data in accordance with the following principles:

(a) Personal Data is Processed only where a lawful basis exists under Applicable Law;
(b) Personal Data is Processed fairly and without unjustifiably prejudicing the rights of Users;
(c) IGM provides clear and accurate information about its privacy practices;
(d) Personal Data is collected only for specified, explicit and lawful purposes and is not Processed in a manner incompatible with those purposes;
(e) IGM collects only such Personal Data as is reasonably necessary to provide the Services, comply with Applicable Law, and protect its legitimate interests;
(f) IGM takes reasonable steps to keep Personal Data accurate, complete and up to date;
(g) Personal Data is not retained longer than necessary, except where retention is required under Applicable Law or for the establishment, exercise or defence of legal claims;
(h) IGM implements technical and organizational safeguards against accidental loss, unauthorized access, disclosure, alteration or destruction of Personal Data; and
(i) IGM maintains governance measures to demonstrate compliance with Applicable Law and this Policy.

8. User Acknowledgement

By using the Platform, you acknowledge and agree that:

(a) you have read and understood this Policy;
(b) the Personal Data you provide is true, accurate and complete to the best of your knowledge;
(c) you shall promptly notify IGM of any change to your Personal Data;
(d) IGM may Process your Personal Data in accordance with this Policy and Applicable Law; and
(e) where you provide Personal Data relating to another individual, you are duly authorised to do so and have obtained all consents required under Applicable Law.

9. Information We Collect

IGM collects the categories of Personal Data set out in this Clause 9 to establish and administer a User's Account, facilitate transactions, comply with Applicable Law, safeguard the Platform, prevent fraud, and deliver the Services. The specific data collected from a User depends on the Services availed and the legal or regulatory requirements that apply.

9.1 Identity Information

Full name; date of birth; gender; nationality; photograph; signature; PAN; Aadhaar details or Virtual ID; passport, driving licence or Voter ID; and any other identification document required under Applicable Law.

9.2 Contact Information

Residential and correspondence address; email address; mobile and telephone number; emergency contact details, where provided; and preferred language of communication.

9.3 KYC Information

Where required under Applicable Law or IGM's internal compliance policies: PAN verification records; Central KYC (CKYC) records; video-KYC recordings; a selfie or live facial image for identity verification; address-verification records; Politically Exposed Person declarations; Ultimate Beneficial Ownership declarations, where applicable; source-of-funds or source-of-wealth information; and FATF and AML screening records. IGM Processes this information only to the extent necessary for compliance with Applicable Law.

9.4 Financial Information

Bank account details; account-holder name; IFSC code; UPI ID; wallet identifiers; payment-instrument identifiers; transaction reference numbers; refund details; payment confirmations; and GST information, where applicable.

IGM does not store complete debit card, credit card or internet-banking credentials. Such information is Processed by IGM's authorised payment aggregators and gateways in accordance with applicable regulatory standards.

9.5 Digital Gold Information

Quantity of Digital Gold purchased, sold or held; purchase and sale price; transaction date and time; wallet balances; customer-wise allocation of gold holdings; redemption and delivery requests; nominee details, where provided; settlement records; tax invoices and statutory records; and transaction history. IGM maintains these records for reconciliation, settlement, audit, regulatory reporting and administration of customer holdings.

9.6 Device and Technical Information

IP address; device identifiers; device model and manufacturer; operating system and version; browser type and version; application version; language settings; time zone; network information; device tokens; error reports; and crash logs. IGM uses this information to maintain system integrity, improve performance and detect fraudulent or malicious activity.

9.7 Usage Information

Login and logout history; pages visited; features accessed; search queries; navigation patterns; clickstream data; session duration; user preferences; and referral URLs. IGM uses this information to analyse usage trends, optimise the Platform and improve customer experience.

9.8 Communications

Customer support requests; emails; chat messages; telephone conversations, which may be recorded after notice where required by Applicable Law; complaints; grievances; feedback; survey responses; and reviews.

9.9 Regulatory and Compliance Information

Risk classification; AML and fraud monitoring records; tax residency; regulatory declarations; court orders or regulatory restrictions applicable to a User, where any; and information required to respond to a lawful request from a competent authority.

9.10 Marketing Preferences

Communication and subscription preferences, Consent records, and campaign-interaction data, collected where a User elects to receive promotional communications.

9.11 Information Voluntarily Provided

IGM may Process additional Personal Data a User voluntarily provides while using the Platform, to the extent such Processing is consistent with the purposes described in this Policy.

10. Sources of Personal Data

IGM collects Personal Data directly from the User, automatically through the Platform, and from authorised third parties, as set out below.

10.1 Collected Directly from the User

IGM collects Personal Data directly from a User when the User:

(a) creates or registers an Account;
(b) completes KYC verification or any identity-authentication process;
(c) purchases, sells, redeems, transfers or gifts Digital Gold;
(d) links a bank account, UPI account, wallet or other payment instrument;
(e) submits identity documents or supporting documentation;
(f) communicates with IGM's customer support team;
(g) submits a query, complaint, grievance or item of feedback;
(h) participates in a promotional campaign, survey or referral programme;
(i) subscribes to a newsletter or marketing communication;
(j) updates account information or profile details; or
(k) otherwise interacts with IGM in relation to the Services.

10.2 Collected Automatically

When a User accesses or uses the Platform, IGM automatically collects the technical and usage information described in Clauses 9.6 and 9.7, through cookies, device identifiers, server logs, SDKs, web beacons, pixel tags and local-storage technologies, for the purposes of maintaining security, improving functionality, preventing fraud, advertising, personalisation and enhancing user experience.

10.3 Received from Third Parties

Subject to Applicable Law, IGM may receive Personal Data from:

(a) banks and financial institutions;
(b) payment aggregators and payment gateways;
(c) KYC Registration Agencies (“KRAs”) and the Central KYC Registry (“CKYCR”);
(d) identity-verification and fraud-prevention agencies;
(e) custodians, trustees and vaulting partners engaged for Digital Gold administration;
(f) technology and analytics service providers;
(g) government authorities acting under Applicable Law; and
(h) a business partner the User has authorised to share the User's Personal Data with IGM.

IGM Processes Personal Data received from a third party only for the purposes described in this Policy.

11. Purposes of Processing Personal Data

IGM processes Personal Data only for lawful purposes connected with the provision, improvement, protection and operation of the Platform and in accordance with Applicable Law. Subject to Applicable Law and, where required, your Consent, IGM may process your Personal Data for the following purposes:

11.1 Provision of Services

To establish and manage your Account, verify your identity, process purchases and sales of Digital Gold, facilitate redemption into cash, physical gold, jewellery vouchers or jewellery, process payments, maintain customer records, provide customer support, communicate with you regarding your transactions, and otherwise provide, administer and improve the Services.

11.2 Regulatory Compliance, Risk Management and Security

To comply with Applicable Law, regulatory directions, court orders and contractual obligations; conduct customer due diligence, KYC and AML checks; perform sanctions screening; prevent fraud, money laundering, terrorist financing, cyber threats and other unlawful activities; investigate suspicious transactions; manage disputes; protect the security and integrity of the Platform; and enforce our legal rights.

11.3 Product Development, Analytics and Personalisation

To analyse Platform usage, transaction behaviour and customer preferences; improve existing products and services; develop new products, features and business offerings; conduct research, testing, experimentation and analytics; personalise user experience; optimise customer journeys; measure campaign effectiveness; perform customer segmentation, behavioural analytics and profiling; and generate insights to improve the Platform and customer experience.

11.4 Recommendations, Marketing and Business Development

Subject to Applicable Law and, where required, your Consent, to communicate with you regarding products, services, promotions, educational content, surveys, events, loyalty programmes and other offerings; provide personalised recommendations; assess eligibility for current and future products and services; recommend products offered by IGM, its affiliates or authorised business partners; deliver targeted offers; and undertake marketing, customer engagement and business development activities.

11.5 Business Operations and Service Delivery

To manage our relationships with custodians, trustees, jewellers, logistics providers, payment partners, bullion suppliers, marketplace partners, API and SDK partners, technology providers and other service providers; perform internal administration; maintain business records; undertake audits and reconciliations; manage insurance, legal proceedings and contractual obligations; and support the efficient operation of the Platform.

11.6 Corporate Governance and Legal Purposes

To exercise or defend legal claims; respond to regulatory or law enforcement requests; support investigations, audits and corporate transactions; maintain business continuity; protect the rights, property and legitimate interests of IGM, its affiliates, partners and Users; and fulfil any other purpose permitted or required under Applicable Law.

12. Legal Basis for Processing

IGM Processes Personal Data only where one or more of the following lawful bases applies.

Where required by Applicable Law, IGM obtains the User's Consent before Processing Personal Data.

12.2 Performance of a Contract

Processing necessary to create and administer a User's Account, provide the Services the User requests, execute transaction instructions, and fulfil IGM's contractual obligations to the User.

12.3 Compliance with Legal Obligations

Processing necessary to comply with a statutory obligation, a judicial or quasi-judicial order, a regulatory direction, a governmental request, tax and accounting requirements, or anti-money-laundering and fraud-prevention obligations.

12.4 Legitimate Business Interests

Where Applicable Law permits, Processing for fraud prevention, information security, internal administration, service enhancement, product development, business continuity, risk management, internal audit or compliance monitoring.

Where Processing is based on a User's Consent:

(a) Consent is obtained through an affirmative action or another mechanism recognised under Applicable Law;
(b) the User may withdraw Consent at any time, through the mechanism available on the Platform or by contacting IGM;
(c) withdrawal does not affect the lawfulness of Processing carried out before the withdrawal; and
(d) withdrawal may result in suspension or discontinuation of a Service where the underlying Processing is necessary to provide that Service or to comply with Applicable Law.

IGM maintains records evidencing a User's Consent where required under Applicable Law.

14. KYC, AML and Regulatory Compliance

IGM collects, verifies, Processes, retains and discloses Personal Data as necessary to comply with KYC, AML, counter-terrorist-financing, sanctions-screening and other regulatory requirements. For these purposes IGM verifies identity documents; conducts customer due diligence and, where warranted, enhanced due diligence; monitors transactions for suspicious activity; performs sanctions and watchlist screening; assesses customer risk profiles; maintains records required under Applicable Law; and files reports with a competent authority where legally required.

IGM may request additional information or documentation from a User where required for compliance with Applicable Law or IGM's risk-management policies. Failure to provide such information may result in refusal, suspension or termination of the Services, subject to Applicable Law.

15. Automated Processing, Profiling and Fraud Prevention

IGM uses automated tools and algorithms to support:

(a) identity verification;
(b) fraud detection and prevention;
(c) transaction monitoring;
(d) cybersecurity monitoring;
(e) account security;
(f) risk scoring; and
(g) suspicious-activity detection.

Where automated Processing is likely to materially affect a User, IGM shall provide for human oversight of the relevant decision, to the extent required under Applicable Law.

16. Privacy by Design, Privacy by Default and Data Minimisation

IGM integrates privacy and data-protection considerations into the design of the Platform's products, systems, processes and technologies from the outset of development, and reviews its privacy governance framework periodically to address evolving risks and regulatory requirements.

Accordingly, IGM shall:

(a) Process only the minimum Personal Data necessary for a specified purpose;
(b) enable privacy-protective settings by default;
(c) assess privacy risk before introducing a new Processing activity; and
(d) protect Personal Data throughout its lifecycle.

Where Applicable Law or a regulatory direction requires additional Personal Data, IGM may request that information from the User.

17. Accuracy of Personal Data

A User is responsible for ensuring that the Personal Data provided to IGM is accurate, complete and up to date, and shall update such data promptly upon any change. IGM may request that a User verify or update Personal Data to maintain accuracy. IGM is not responsible for any loss, delay or inability to provide the Services caused by inaccurate, incomplete or outdated information the User has supplied.

18. Anonymised and Aggregated Data

IGM may anonymise, de-identify or aggregate Personal Data so that it no longer identifies an individual. Information that has been irreversibly anonymised is not treated as Personal Data under this Policy and may be used for statistical analysis, research, service improvement, product development, risk management and security monitoring.

19. User Responsibilities

Each User shall:

(a) provide accurate, complete and up-to-date Personal Data;
(b) promptly notify IGM of a change to such information;
(c) keep account credentials confidential;
(d) immediately report suspected unauthorised access to the Platform; and
(e) provide Personal Data relating to another individual only with the authorisation and consent that Applicable Law requires.

IGM is not responsible for loss or prejudice arising from inaccurate, misleading or incomplete information a User has provided.

IGM does not sell, rent, trade or license Personal Data to a third party for that party's independent commercial or marketing purposes without the User's prior Consent, except as this Policy expressly permits or Applicable Law requires. IGM discloses Personal Data only on a need-to-know basis, limited to what is reasonably necessary for the purposes described in this Policy, and requires every recipient to maintain technical, organizational and contractual safeguards over the Personal Data it receives.

21. Categories of Recipients

IGM may disclose or share Personal Data only where necessary for the purposes described in this Privacy Policy, to provide the Services, comply with Applicable Law, protect legitimate interests, or with your Consent where required.

21.1 Service Providers

IGM may share Personal Data with third-party service providers engaged to support the operation of the Platform, including providers of cloud infrastructure, hosting, cybersecurity, identity verification, KYC and AML services, payment processing, banking, fraud prevention, analytics, customer support, communications, logistics, document management, technology, auditing and other operational services. Such service providers shall be permitted to process Personal Data only for authorised purposes and shall be subject to appropriate contractual confidentiality, privacy and security obligations.

21.2 Business and Ecosystem Partners

IGM may share Personal Data with custodians, trustees, bullion suppliers, jewellers, marketplace partners, API and SDK integration partners, referral partners, employers, corporate partners and other authorised business partners where reasonably necessary to facilitate transactions, fulfil customer requests, provide the Services, prevent fraud, comply with Applicable Law or improve customer experience.

21.3 Regulatory Authorities and Professional Advisors

IGM may disclose Personal Data to government authorities, regulators, law enforcement agencies, courts, tribunals, statutory bodies, auditors, insurers, legal advisors, consultants and other professional advisers where required or permitted under Applicable Law, to comply with legal obligations, respond to lawful requests, exercise or defend legal rights, investigate fraud or unlawful activity, or protect the rights, property or safety of IGM, its Users or third parties.

21.4 Corporate Group and Business Transfers

IGM may share Personal Data with its affiliates, subsidiaries and group companies for internal administration, risk management, compliance, customer support, product development, service delivery and other lawful business purposes consistent with this Privacy Policy. In the event of any merger, acquisition, investment, restructuring, financing, sale of assets or business transfer, Personal Data may be transferred to the relevant successor entity or prospective transaction parties, subject to appropriate confidentiality obligations and Applicable Law.

21.5 Aggregated and De-identified Information

IGM may use and disclose aggregated, anonymised or de-identified information that does not identify an individual User for analytics, research, product development, business planning, statistical reporting, fraud prevention, marketing measurement and other lawful business purposes.

22. Customer Holdings and Digital Gold Records

IGM maintains accurate records of Digital Gold holdings through its internal systems and authorised custodial arrangements, on a customer-wise basis, so that each User's holdings remain separately identifiable and reconcilable at all times.

23. International Transfer of Personal Data

IGM primarily stores and Processes Personal Data within India. Where a technology, cloud, cybersecurity or software provider IGM engages Processes Personal Data outside India, IGM shall ensure that the transfer is permitted under Applicable Law, that appropriate contractual safeguards are in place, that the recipient maintains reasonable security measures and confidentiality obligations, and that the transfer is necessary for providing the Services or complying with Applicable Law. IGM shall take reasonable steps to ensure that an overseas recipient's level of protection is substantially equivalent to that required under Applicable Law.

24. Third-party Processors and Vendor Due Diligence

Before engaging a third-party processor to Process Personal Data on its behalf, IGM shall conduct due diligence on the processor's ability to maintain adequate privacy and information-security standards, and shall periodically review the processor's performance and compliance.

IGM requires each such processor to:

(a) Process Personal Data only under IGM's documented instructions;
(b) implement appropriate technical and organisational security measures;
(c) maintain confidentiality obligations;
(d) promptly notify IGM of an actual or suspected Personal Data breach;
(e) permit an audit or provide a compliance certification where the contract requires it; and
(f) return or securely delete Personal Data on termination of the engagement, unless Applicable Law requires retention.

25. Data Localisation

Where Applicable Law or a regulatory direction requires a category of Personal Data or records to be stored or maintained within India, IGM shall comply with that requirement. This Clause does not prevent IGM from maintaining mirrored backups, disaster-recovery environments or secure processing arrangements outside India where Applicable Law permits and appropriate safeguards apply.

26. Disclosures Required to Protect Rights

IGM may disclose Personal Data where it reasonably believes disclosure is necessary to:

(a) protect the rights, property or safety of IGM, its Users or the public;
(b) prevent fraud, cybercrime or financial crime;
(c) investigate a security incident or unlawful activity;
(d) enforce IGM's Terms and Conditions or another contractual arrangement;
(e) establish, exercise or defend a legal claim; or
(f) comply with a lawful request from a competent authority.

27. Data Retention

IGM retains Personal Data only for so long as is necessary to fulfil the purpose for which it was collected, comply with Applicable Law, protect IGM's legal rights and legitimate business interests, and satisfy contractual and regulatory obligations. IGM shall periodically review the necessity of retaining Personal Data and shall securely delete, anonymise or irreversibly destroy it once retention is no longer required, unless Applicable Law mandates continued retention.

27.1 Retention Criteria

The retention period applicable to a category of Personal Data is determined by reference to:

(a) the nature and sensitivity of the Personal Data;
(b) the purpose for which it was collected;
(c) the duration of the User's relationship with IGM;
(d) statutory and regulatory record-keeping requirements;
(e) taxation and accounting obligations;
(f) pending or reasonably anticipated litigation, investigation or enforcement proceedings;
(g) fraud-prevention and risk-management requirements; and
(h) IGM's contractual obligations to Users or third parties.

27.2 Regulatory Records

Without limiting Clause 27, IGM retains: KYC and customer-due-diligence records; transaction records relating to Digital Gold purchases, sales, transfers and redemptions; payment and settlement records; audit logs; communication records; complaint and grievance records; cybersecurity logs; and records required under anti-money-laundering law, each for the period Schedule B specifies.

27.3 Backup and Archival Copies

Personal Data may continue to exist within an encrypted backup system or disaster-recovery environment for a limited period after deletion from active systems. Such a backup copy remains subject to the confidentiality and security obligations in this Policy and shall not be restored except for business continuity, disaster recovery, legal compliance or security purposes.

28. Information Security

IGM maintains the confidentiality, integrity, availability and resilience of Personal Data through the administrative, technical, organisational and physical safeguards described in Clause 29, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful Processing. IGM reviews and enhances its information-security programme in light of technological developments, regulatory requirements and evolving cybersecurity risk.

29. Technical and Organisational Security Measures

IGM implements the following safeguards, each to the extent appropriate to the risk presented.

29.1 Access Controls

IGM implements role-based access controls so that Personal Data is accessible only to personnel who require access for a legitimate business purpose, and reviews access rights periodically, revoking access promptly when no longer required.

29.2 Authentication and Identity Management

IGM implements multi-factor authentication, strong password policies, privileged-access management, identity-and-access-management controls, and secure authentication protocols.

29.3 Encryption

IGM protects Personal Data in transit and at rest using industry-accepted encryption, and manages encryption keys under a documented key-management practice.

29.4 Network Security

IGM implements firewalls, intrusion detection and prevention systems, endpoint and malware protection, network segmentation, secure VPNs, web-application firewalls, and continuous security monitoring.

29.5 Logging and Monitoring

IGM maintains security logs of user authentication, access to sensitive systems, administrative activity, system events, cybersecurity incidents and transaction monitoring, and retains such logs for security investigation, regulatory compliance and forensic analysis.

29.6 Secure Development Practices

IGM incorporates secure coding practices, code review, vulnerability assessment, penetration testing, change-management procedures and pre-deployment security testing into its software development lifecycle.

30. Data Classification

IGM classifies information Processed through the Platform as Public, Internal, Confidential or Restricted Information, based on confidentiality, sensitivity and business criticality. Personal Data is classified as Confidential or Restricted Information and is subject to enhanced protection measures accordingly.

31. Business Continuity and Disaster Recovery

IGM maintains business-continuity and disaster-recovery procedures to minimise disruption to the Services and protect the availability of Personal Data, including redundant infrastructure, encrypted backups, disaster-recovery environments, periodic restoration testing, contingency planning and incident-response coordination. IGM does not warrant uninterrupted availability of the Platform but shall use commercially reasonable efforts to restore operations following a disruption.

32. Security Testing and Audits

IGM conducts periodic assessments of its information-security controls, including vulnerability assessments, penetration testing, configuration reviews, internal audits, third-party security assessments and compliance reviews. The frequency and scope of such assessments is determined by IGM's internal governance framework, regulatory expectations and risk profile.

33. Data Breach Management

IGM maintains documented procedures for identifying, investigating, containing and responding to an actual or suspected Personal Data breach or cybersecurity incident.

On becoming aware of a security incident involving Personal Data, IGM shall:

(a) contain and mitigate the incident;
(b) preserve relevant evidence;
(c) assess the nature, scope and impact of the incident;
(d) identify the affected systems and individuals;
(e) implement corrective and preventive measures;
(f) notify the competent regulatory authority where Applicable Law requires; and
(g) notify affected Users where Applicable Law requires notification, or where IGM otherwise considers notification appropriate.

This Clause does not constitute an admission of liability by IGM in respect of any cybersecurity incident.

34. Employee Confidentiality and Training

IGM ensures that an employee, officer, consultant, contractor or other authorised representative with access to Personal Data:

(a) is bound by a contractual or statutory confidentiality obligation;
(b) receives periodic training on privacy, cybersecurity and information security;
(c) accesses Personal Data only to the extent necessary to perform their duties; and
(d) complies with IGM's internal privacy and information-security policies.

Non-compliance may result in disciplinary action, contractual remedies or other legal action, as appropriate.

35. Security of User Accounts

A User is responsible for the confidentiality of their account credentials, passwords, OTPs, authentication codes and security devices.

A User shall:

(a) not disclose their credentials to a third party;
(b) use a strong, unique password;
(c) promptly notify IGM of suspected unauthorised access to, or compromise of, their Account; and
(d) log out of the Platform after each session on a shared or public device.

IGM is not liable for unauthorised activity resulting from a User's failure to safeguard their credentials, except where the loss is directly attributable to IGM's negligence or wilful misconduct.

36. Limitation of Security Obligations

While IGM implements the safeguards described in this Policy, no method of electronic transmission or storage is completely secure, and IGM does not warrant that the Platform will be entirely free from cyberattack, malware, unauthorised access or other security threat. A User accepts the inherent risk of transmitting information over the internet. Nothing in this Clause limits a non-excludable right or obligation under Applicable Law.

37. Security Governance

IGM maintains an internal privacy and information-security governance framework appropriate to the nature, scale and complexity of its business, comprising designated personnel responsible for privacy and security oversight, documented policies and procedures, periodic risk assessments, vendor risk management, internal incident-reporting mechanisms, and regular review of security controls, with oversight by senior management or a designated governance committee where applicable. IGM reviews and updates this framework to address evolving legal requirements, technology and cybersecurity risk.

38. Your Rights in Relation to Personal Data

IGM shall facilitate the exercise of a User's rights under the Digital Personal Data Protection Act, 2023 and other Applicable Law, as set out in this Clause 38, subject in each case to Applicable Law.

38.1 Right to Access Information

A User may request confirmation of whether IGM is Processing the User's Personal Data and, where it is, information on the categories of Personal Data Processed, the purposes of Processing, the categories of recipients with whom it has been shared, the manner of Processing, and any other information Applicable Law requires. IGM may require reasonable identity verification before responding.

38.2 Right to Correction and Updation

A User may request correction, completion or updating of inaccurate, incomplete or outdated Personal Data IGM maintains. IGM may require documentary evidence to substantiate the requested correction.

38.3 Right to Erasure

A User may request deletion or erasure of Personal Data where:

(a) it is no longer necessary for the purpose for which it was collected;
(b) Consent has been withdrawn and no other lawful basis for Processing exists; or
(c) Applicable Law no longer requires its retention.

IGM may refuse such a request where continued retention is required for a legal, regulatory, contractual, audit, dispute-resolution or enforcement purpose.

Where Processing is based on Consent, a User may withdraw it at any time. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal, and may prevent IGM from providing a Service where the underlying Processing is necessary for account administration, transaction processing, identity verification or regulatory compliance.

38.5 Right to Nominate

Where Applicable Law recognises it, a User may nominate another individual to exercise the User's rights in relation to Personal Data on the User's death or incapacity. IGM may require documentary evidence before acting on a nomination.

38.6 Right to Grievance Redressal

A User may submit a complaint or grievance relating to the Processing of Personal Data in accordance with Clause 40.

39. Exercising Your Rights

A User may submit a request relating to Personal Data through the mechanism available on the Platform or by contacting IGM's Grievance Officer. IGM may require identity verification before processing the request.

IGM may:

(a) request additional information reasonably necessary to process the request;
(b) decline a request that is manifestly unfounded, fraudulent or excessive;
(c) refuse a request where Applicable Law permits refusal; and
(d) retain information where Applicable Law requires, or where necessary for the establishment, exercise or defence of a legal claim.

IGM shall respond to a valid request within the timeline Applicable Law prescribes.

40. Grievance Redressal

IGM has established a grievance-redressal mechanism for complaints relating to the Processing of Personal Data. A User may contact IGM's designated Grievance Officer regarding a privacy-related concern, a request relating to Personal Data, a complaint of unauthorised disclosure, a correction or deletion request, a concern regarding Consent, or a security incident affecting Personal Data.

Grievance Officer

Address: FT Tower, CTS No. 256 & 257, Suren Road, Chakala, Andheri (E), Mumbai-400 093 INDIA

Email: [email protected]

IGM shall acknowledge and endeavour to resolve a grievance within the timeline Applicable Law prescribes. This Clause does not prejudice a statutory remedy available to a User before the appropriate authority or forum.

41. Marketing Communications

Subject to Applicable Law, IGM may send communications relating to new products or services, promotional campaigns, educational content, newsletters, offers and rewards, surveys, and Platform updates. Where Applicable Law requires it, IGM sends such communications only after obtaining the User's Consent.

A User may opt out of promotional communications at any time by:

(a) selecting the unsubscribe option in the communication;
(b) updating communication preferences on the Platform; or
(c) contacting IGM.

IGM may continue to send a transactional, security or service-related communication that is necessary to provide the Services or comply with Applicable Law.

42. Children's Privacy

The Platform is intended solely for individuals who are legally competent to enter into a binding contract under Applicable Law. IGM does not knowingly collect or Process a child's Personal Data, except where Applicable Law expressly permits it and IGM has obtained verifiable Consent from the child's parent or lawful guardian. On becoming aware that a child's Personal Data has been collected without the requisite authorisation or Consent, IGM shall take reasonable steps to delete that information in accordance with Applicable Law. A parent or lawful guardian who believes a child has provided Personal Data to IGM may contact the Grievance Officer for assistance.

43. Third-party Websites, Applications and Services

The Platform may link to a website, application or online service a third party operates. IGM does not own, operate or control such a third-party platform and is not responsible for its privacy practices, information-security measures, availability, content accuracy, or the products or services it offers. A User should review the privacy policy and terms of use of a third-party platform before providing Personal Data to it. Inclusion of a third-party link does not constitute IGM's endorsement of that party.

44. Changes to this Privacy Policy

IGM may amend, update or replace this Policy to reflect a change in Applicable Law, a regulatory requirement, technological development, an enhancement to the Services, a change to IGM's business operations, or an improvement to its privacy or security practices. A revised Policy takes effect on publication on the Platform, unless it states otherwise. Where Applicable Law requires it, IGM shall notify Users of a material change through appropriate electronic means. Continued use of the Platform after the effective date of a revised Policy constitutes acknowledgement of the revision.

45. Governing Law and Jurisdiction

This Policy is governed by, and shall be construed in accordance with, the laws of India. Subject to a mandatory dispute-resolution mechanism Applicable Law prescribes, the courts at Mumbai, Maharashtra have exclusive jurisdiction over a dispute arising out of or relating to this Policy, the Processing of Personal Data, or the Services.

46. Severability

If a court or competent authority holds a provision of this Policy invalid, illegal or unenforceable, that provision shall be severed only to the extent of invalidity or unenforceability, and the remaining provisions shall continue in full force and effect.

47. Waiver

No failure or delay by IGM in exercising a right, power or remedy under this Policy operates as a waiver of it. A waiver is effective only if made in writing by IGM. A waiver of one breach does not waive a subsequent or continuing breach.

48. Entire Policy

This Policy constitutes IGM's entire privacy policy governing the collection, use, disclosure, storage, transfer and protection of Personal Data in relation to the Platform and is to be read together with IGM's Terms and Conditions, User Agreement, KYC Policy, Anti-Money Laundering Policy, Cookie Policy and Information Security Policy, and any other policy IGM publishes from time to time. Where this Policy is inconsistent with a mandatory provision of Applicable Law, Applicable Law prevails to the extent of the inconsistency.

49. Contact Us

For a question, request or concern regarding this Policy or the Processing of your Personal Data, contact IGM using the details below.

India Gold Metaverse Limited