PRIVACY POLICY

1. Introduction

BirlaNu Limited ("Company", "we", "us", or "our") respects your privacy and is committed to protecting the personal data of individuals ("you" or "Data Principal") who access or use our website, mobile application, and related services, including the Registration Drive and any associated promotional campaigns (collectively, the "Platform"). This Privacy Policy explains what personal data we collect, why and how we process it, with whom we share it, and the rights available to you under applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), read with the Information Technology Act, 2000 and rules made thereunder, to the extent applicable (together, "Indian Data Protection Law").

By accessing or using the Platform, registering for the Registration Drive, or otherwise providing your personal data to us, you confirm that you have read and understood this Privacy Policy.

2. Definitions

"Board" means the Data Protection Board of India constituted under the DPDP Act.

"Consent" means the free, specific, informed, unconditional and unambiguous indication of a Data Principal's wishes by clear affirmative action, signifying agreement to the processing of their personal data for the specified purpose, and limited to such personal data as is necessary for that purpose.

"Data Fiduciary" means the Company, which alone or in conjunction with other persons, determines the purpose and means of processing personal data.

"Data Principal" means the individual to whom the personal data relates, and, where such individual is a child or a person with disability who has a lawful guardian, includes the parent or lawful guardian acting on their behalf.

"Data Processor" means any person who processes personal data on behalf of the Company pursuant to a contract.

"Personal Data" means any data about an individual who is identifiable by or in relation to such data.

"Personal Data Breach" means any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises its confidentiality, integrity, or availability.

"Processing" means any wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, erasure, or destruction.

3. Personal Data We Collect

Depending on how you interact with the Platform, including registering for the Registration Drive, creating an account, making a purchase, or contacting us, we may collect the following categories of personal data:

• 3.1 Identity and Contact Information: Aadhar, name, mobile number, email address, and postal address.
• 3.2 Bank Details: Account no., PAN and UPI Id.
• 3.3 Registration and Account Information: username, password (stored in encrypted form), date of registration, and any unique customer, dealer, or applicator ID assigned to you.
• 3.4 Transaction and Campaign Information: purchase records, invoice or bill numbers, product details, and details of your participation in, or redemption under, the Registration Drive or other campaigns.
• 3.5 Device and Usage Information: IP address, device identifiers, browser type, application usage logs, and location information, where enabled on your device.
• 3.6 Any other personal data you voluntarily provide to us, including through customer support communications, surveys, or feedback forms.

We collect only the personal data that is necessary for the specific, lawful purposes identified in this Policy, consistent with the data minimisation principle under the DPDP Act.

4. How We Use Your Personal Data

We process your personal data only on the basis of your consent, or where processing qualifies as a "legitimate use" under Section 7 of the DPDP Act, for the following purposes:

1. to register and verify your participation in the Registration Drive or other campaigns;
2. to create, administer, and maintain your account on the Platform;
3. to process and fulfil any prize, reward, or benefit for which you may be eligible;
4. to communicate with you regarding your registration, queries, updates, or grievances;
5. to comply with applicable law, regulatory requirements, or an order of a court or government authority;
6. to prevent, detect, and investigate fraud, security incidents, or unauthorised activity on the Platform; and
7. to maintain, secure, and improve the functionality and performance of the Platform.

5. Consent and Notice

1. Before, or at the time of, collecting your personal data, we will give you a notice, in clear and plain language, describing the personal data being collected and the purpose for which it is to be processed, either separately or together with the request for your consent.
2. You may withdraw your consent at any time, with the ease of withdrawal being comparable to the ease with which consent was given. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
3. Once you withdraw consent, we will, within a reasonable time, cease processing your personal data and cause our Data Processors to do the same, unless retention or further processing is required or authorised by law.
4. Where you are a child (an individual below 18 years of age) or a person with disability who has a lawful guardian, we will process personal data only on the basis of verifiable consent obtained from your parent or lawful guardian, and we will not undertake tracking, behavioral monitoring, or targeted advertising directed at children.

6. Disclosure and Sharing of Personal Data

We may share your personal data with:

1. Data Processors engaged by us under a written contract, solely to process personal data on our behalf and strictly in accordance with our instructions;
2. our affiliates, group companies, dealers, or distributors involved in administering the Registration Drive or related campaigns;
3. government or regulatory authorities, where disclosure is required under applicable law; and
4. professional advisors, auditors, or a successor entity in connection with a merger, acquisition, or corporate restructuring.

We do not sell your personal data to third parties.

7. Cross-Border Transfer of Personal Data

We may transfer and process your personal data outside India, except to any country or territory restricted by the Central Government by notification under the DPDP Act. Any such transfer will be carried out in a manner that provides a standard of protection to your personal data that is comparable to the protection under this Policy and applicable Indian Data Protection Law.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required to comply with any applicable legal, accounting, or regulatory obligation. Once the specified purpose is no longer being served and retention is not otherwise required by law, we will erase the personal data and will cause our Data Processors to do the same.

9. Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, and to prevent a Personal Data Breach, including:

1. encryption of personal data in transit and at rest, where applicable;
2. access controls that limit access to personal data to authorised personnel only;
3. regular security assessments, monitoring, and logging; and
4. contractual obligations requiring our Data Processors to maintain equivalent security safeguards.

10. Personal Data Breach

In the event of a Personal Data Breach, we will notify the Data Protection Board of India and the affected Data Principals, in the form and manner and within the timelines prescribed under the DPDP Rules.

11. Your Rights as a Data Principal

Subject to applicable law, you have the right to:

1. Access: obtain a summary of the personal data we hold about you and the processing activities undertaken with respect to it;
2. Correction and Updation: request correction of inaccurate or misleading personal data, and completion of incomplete personal data;
3. Erasure: request erasure of personal data that is no longer necessary for the purpose for which it was processed, subject to any legal retention requirement;
4. Grievance Redressal: register a grievance with us regarding the processing of your personal data; and
5. Nomination: nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, please contact our Grievance Officer using the details in Section 12 below.

12. Grievance Officer

In accordance with the DPDP Act, you may raise your queries and grievances concerning the processing of your personal data:

Email: compliance@birlanu.com

We will endeavor to resolve your grievance within the timeline prescribed under applicable law. If you remain dissatisfied with our response, you may lodge a complaint with the Data Protection Board of India.

13. Cookies and Tracking Technologies

The Platform may use cookies and similar tracking technologies to enhance your experience, remember your preferences, and analyse usage patterns. You can manage or disable cookies through your browser or device settings; however, doing so may affect certain features of the Platform.

14. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or in applicable law. The "Last Updated" date at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically for any changes.

15. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India. The courts at Hyderabad, India shall have exclusive jurisdiction over any disputes arising out of or in connection with this Policy.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

BirlaNu Limited
Office no 1 & 2, L7 Floor, SLN Terminus, Sy. No 113, Near Botanical Gardens, Gachibowli, Hyderabad, Telangana 500032
Email: customer.care@birlanu.com