Privacy Notice

Effective Date: 1st day of August 2026
Last Updated: 1st day of August 2026

Anand Group and its Subsidiaries (“we,” “us,” or “our”) respects your privacy and is committed to protecting your
personal data. This Privacy Notice explains how we collect, use, share, and protect your personal data when you
use our website, mobile application, and other online services (collectively, the “Services”). This Privacy
Notice is in compliance with the Digital Personal Data Protection Act, 2023 (“DPDPA”) and other applicable data
protection laws.

1. Scope and Applicability

This Privacy Notice applies to individuals who interact with our Services, including visitors, users, and
customers (“you” or “your). It is intended for individuals residing in India and is aligned with applicable
Indian data protection laws.

This Privacy Notice does not apply to our employees, interns, or contractors, who interact with us in their
professional capacity and whose personal data is governed under a separate Employee Privacy Notice. It also does
not apply to third-party websites, applications, or services that may be linked from our platform. We encourage
you to review the privacy policies of such third parties to understand how they handle your information.

If you use Anand Group and its Subsidiaries IoT devices, this Privacy Notice also applies to any personal data
collected through such devices, including but not limited to device identifiers, usage logs, location
information, and environmental or sensor data.

In situations where a specific privacy notice is not presented at the point of data collection, the most recent
version of the Privacy Notice available on our official website shall apply and will govern the collection, use,
and processing of your personal data. We encourage users to review the Privacy Notice on our website regularly
to stay informed about how we protect and use your data.

2. Personal Data collected, Purpose of Processing and Goods and services to be Provided

We collect only such personal data as is necessary for the specified purpose. The table below is intended to
provide an itemised and understandable description of the main categories of personal data, purposes of
processing, and goods or services enabled.

These lists include examples and are not exhaustive.

3. Purpose of Processing Personal Data

Your Personal data is collected and processed by Anand Group and its Subsidiaries based on the following legal
grounds depending upon the nature of Personal Data and the purposes for which it is processed:

1. You have provided consent for the specified purpose after receiving the consent notice;
2. You have voluntarily provided your personal data for a specified purpose and have not indicated that you do
   not consent to its use for that purposes;
3. Processing is necessary for compliance with applicable law, statutory reporting, court orders, regulatory
   requests, or other obligations permitted under the Digital Personal Data Protection Act, 2023;
4. Processing is necessary for medical emergency, safety, fraud prevention, cybersecurity, or other permitted
   legitimate uses under the Act, as applicable;

Consent

Where processing is based on consent, you have the right to withdraw consent at any time through the mechanisms
provided in the privacy notice. However, Withdrawal of consent will not affect processing already carried out
before withdrawal.

If we process your Personal Data based on other lawful grounds, like that of legitimate use, legal obligations,
or statutory requirements, such processing shall continue as permitted under the applicable law.

4. Children Data and Person with Disabilities

If we process personal data of a child, we will obtain verifiable consent from the parent before processing such
personal data, unless an exemption under applicable law permits otherwise.

We will not undertake tracking, behavioural monitoring of children, or targeted advertising directed at children,
except where expressly permitted under applicable law and implemented with appropriate safeguards.

If we process personal data of a person with disability who has a lawful guardian, we will verify that the
individual providing consent is lawfully appointed as guardian under applicable law, where such verification is
required.

5. Disclosure of personal data

Anand Group and its Subsidiaries does not sell or rent your Personal Data. However, we may share your data with
trusted third parties in the following circumstances:

Service Providers & Business Partners
We may share your Personal Data with third-party vendors, contractors, or service providers who assist us in
delivering our services, such as:

1. Payment processing and transaction services
2. Customer support and communication platforms
3. IT infrastructure, analytics, and security providers
4. Marketing and advertising partners (where applicable)
5. Cloud storage and data hosting providers
6. IoT platform service providers who enable device connectivity, diagnostics, and software updates

Legal & Regulatory Compliance
We may disclose your Personal Data if required to:

1. Comply with applicable laws, regulations, or legal processes (including government and law enforcement
   requests)
2. Respond to court orders, notices, or regulatory authorities
3. Protect our legal rights, privacy, safety, or property (including fraud prevention and cybersecurity
   measures)

Business Transactions
In the event of a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred
as part of the business transaction, subject to appropriate privacy safeguards.

Fraud Prevention & Security
We may share Personal Data with government agencies, financial institutions, or fraud prevention organizations
to:

1. Detect, investigate, and prevent fraud, cyber threats, or security breaches
2. Ensure compliance with anti-money laundering (AML) and other regulatory requirements

International Data Transfers
If we transfer your Personal Data outside India, we ensure that such transfers comply with applicable laws and
are subject to adequate safeguards, such as:

1. Contractual Clauses wherever applicable with the recipient ensuring data protection
2. Government-approved mechanisms for secure international data transfers
3. Transfers to jurisdictions not explicitly restricted by the Government of India

6. Accuracy of Personal Data

You are responsible for ensuring that the Personal Data you provide to Anand Group and its Subsidiaries is
accurate, complete, and up to date.

• Anand Group and its Subsidiaries takes reasonable steps to verify and maintain the accuracy of your personal
  data. To ensure the information we hold is current and accurate, we may periodically request updates where
  necessary. However, it is your responsibility to promptly inform us of any changes to your personal data,
  including contact details or preferences. This collaborative effort helps us provide you with uninterrupted
  services and remain compliant with the Digital Personal Data Protection Act, 2023.

If you believe any personal data we hold is inaccurate or incomplete, you may exercise your right to request
corrections as outlined in the in Contact Us section of this Privacy Notice.

7. Security measures

We implement appropriate technical, organizational, and security measures to protect your Personal Data from
unauthorized access, loss, misuse, disclosure, or alteration.

While we take reasonable steps to protect your data.

These safeguards may include encryption, obfuscation, masking, virtual tokenisation, access controls, logging,
monitoring, review of access, backup and resilience measures, incident response processes, contractual
safeguards with processors, and other appropriate technical and organisational measures.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we will notify affected
Data Principals and the Data Protection Board of India in accordance with applicable law.

8. Data Breach Notification

If we become aware of a personal data breach, we will notify affected Data Principals in a concise, clear and
plain manner without delay through their registered communication channel or user account, where applicable.

We will notify the Data Protection Board of India without delay and provide the detailed information required by
applicable law within the prescribed timeline, including the nature, extent, timing and likely impact of the
breach, mitigation actions and remedial measures.

In case you as a user detect or suspect any breach of your data you can inform to us by reaching out to
privacy@anandgroupindia.com.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance user experience, analyse website traffic, and
personalize content. IoT devices may also use embedded tracking mechanisms to optimize functionality, detect
malfunctions, and enhance security.

You can manage cookie preferences through your browser settings or our Cookie Preference Centre.

For more details, refer to our Cookie Policy

10. Retention of Personal Data

Anand Group and its Subsidiaries will retain your personal data in accordance with its Data Retention Policy and
as required under applicable laws. We will only store your personal data for as long as necessary to fulfil the
purposes outlined in this Privacy Notice, unless a longer retention period is required for compliance with
legal, tax, regulatory, or contractual obligations.

11. Data Principal Rights and Duties

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you, as a Data Principal, have the following rights
concerning your Personal Data:

Your Rights

1. Right to Access: You have the right to request a summary of the personal data that Anand
   Group and its Subsidiaries holds about you.
2. Right to Correction and Erasure: You may request correction, completion, or erasure of your
   personal data if it is inaccurate or no longer necessary for processing.
3. Right to Grievance Redressal: If you believe your personal data is processed unlawfully or
   in violation of this Privacy Notice, you may file a grievance with Anand Group and its Subsidiaries DPO/DPO
   office/Grievance Officer, and we shall aim to resolve your grievance within a period of ninety
   (90) days. If unsatisfied with the resolution, you may escalate the matter to the Data
   Protection Board (DPB).
4. Right to Nominate: You have the right to nominate an individual who can exercise your
   rights under the Act in the event of your death or incapacity.
5. Right to Withdraw Consent: Where data processing is based on consent, you may withdraw your
   consent at any time. However, withdrawal will not affect the lawfulness of processing conducted before
   withdrawal.
6. Right to Be Informed: You have the right to receive clear, concise, and transparent
   information about how your personal data is collected and processed.

Your Duties

As a Data Principal, you also have certain duties under the DPDPA, 2023:

• Provide accurate information: Ensure that any personal data you provide to Anand Group and
  its Subsidiaries is accurate and up to date.
• Refrain from filing false or frivolous complaints: Misuse of rights under this Act may
  attract penalties as per applicable law.
• Comply with lawful processing: You must not attempt to access or modify personal data that
  you are not authorized to process.

Method to Exercise Your Rights

As an interim measure, if you wish to exercise any of your rights under this Privacy Notice, please contact us
directly at privacy@anandgroup.com. We will provide you with the appropriate Data Principal Request Forms, which
you can complete and submit to initiate your request.

We are currently working to streamline this process. Once available, you will be able to directly access all
necessary forms online and submit your requests electronically.

In the future, to exercise your rights, you may complete the Data Principal Request Form available at to be
updated once the DPB is established and submit it to our Data Protection Officer at privacy@anandgroup.com. We
will handle your request in accordance with applicable laws and respond within the prescribed timeframe within
ninety days.

12. Grievance Redressal

If you have any concerns regarding the processing of your personal data and you are not satisfied with the
initial response, you can file a complaint with Anand Group and its Subsidiaries Grievance
Officer.

Contact Details of Grievance Officer:
Email: privacy@anandgroup.com

Escalation to the Data Protection Board (DPB)
If you are not satisfied with the resolution provided by the Grievance Officer, you have the
right to escalate the matter to the Data Protection Board (DPB) of India, which is the
regulatory authority established under the DPDPA, 2023 for handling data protection disputes
and violations.

For more details on the DPB and how to escalate your complaint, please refer to the official government portal
(To be Updated post DPB is established)

13. Updates to this Notice

Anand Group and its Subsidiaries may update this Privacy Notice periodically to reflect changes in legal,
regulatory, or operational requirements. We will notify you of any significant changes through appropriate
means, such as updates on our website. The latest version of this Privacy Notice will always be available at
Anand Group India

14. Acknowledgment

1. You acknowledge that you have received, read, and understood this Privacy Notice.
2. You understand that this notice informs you of how Anand group and its Subsidiaries processes my personal
   data, and where required, my consent will be sought separately for certain processing activities.
3. You understand that you have the right to withdraw your consent for non-essential processing at any time by
   submitting a request to the Data Protection Officer at privacy@anandgroup.com

Consent for Collection and Processing of Personal Data

Company Name: The Anand Group and its Subsidiaries
Effective Date: 1st Day of January 2026

Pursuant to the Digital Personal Data Protection Act, 2023, Anand Group and its Subsidiaries requires your
consent to collect, process, and use your personal data for
specific purposes as detailed in the Privacy Notice.

□ I acknowledge that I have READ and UNDERSTOOD Anand Group and its Subsidiaries Privacy Notice and,
consent to the collection, processing, and use of my personal data for the stated purposes, in accordance with
the Digital Personal Data Protection Act, 2023.

□ I consent to receive marketing and promotional communications