Privacy Policy

Scope and Purpose

This policy is applicable to the Processing of users' Personal Data at Krutrim SI Designs Private Limited (“Krutrim”, “our”, “us” or “we”). The purpose of this policy is to provide our current, former, and potential users (jointly referred to as “users” or “you”) with a general understanding of:

• Type of personal information and manner of collection
• Purpose of collection and processing of personal information
• How information is processed
• Sharing/Transfer of Personal Data
• Distribution of responsibility for the Processing of Personal Data between affiliates of Krutrim, and
• Contact details for us so you can receive information about and claim your rights in relation to our processing of your Personal Data.

This policy is updated continuously to reflect the measures taken by us in relation to your Personal Data.

This Privacy Policy applies to Personal Data that Krutrim processes as a Data Fiduciary for its own purposes. Where Krutrim processes Personal Data contained in Customer Data on behalf of a customer in connection with the Services, such processing is governed by the applicable agreement and Data Processing Addendum, as set out below.

Where Krutrim processes Personal Data contained in or submitted to Customer Data on behalf of a customer in connection with the Services, Krutrim shall act as a Data Processor and such processing shall be governed by the applicable agreement and Data Processing Addendum between Krutrim and the customer. In such circumstances, the customer shall remain responsible for determining the purposes and means of processing such Personal Data, except to the extent Krutrim is required to process such Personal Data independently under applicable law.

In the event of any inconsistency between this Privacy Policy and the applicable agreement or Data Processing Addendum in relation to Customer Data, the applicable agreement and Data Processing Addendum shall prevail.

Definitions

The following definitions are used in this policy. In case of any conflict with respect to interpretation of these definitions between applicable law and these terms, interpretation provided under the applicable law shall prevail.

• Anonymous data or anonymized data: Data not identifiable to a natural person.
• Automated decision making: Making a decision by automated means through algorithms without human involvement.
• Customer Data: Any data, information, content, files, datasets, Personal Data, prompts, inputs, outputs, models, applications, configurations, metadata and other materials submitted, uploaded, stored, transmitted or otherwise processed by or on behalf of a customer through the Services, but excludes Service Usage Data, telemetry and other information generated by Krutrim independently in connection with the operation, security and improvement of the Services, provided that such exclusion shall not apply to Personal Data contained in Customer Data or information that identifies or can reasonably be linked to a customer or an identifiable individual merely because it is generated or processed in connection with the Services. Krutrim's use of Customer Data for model training or improvement shall be governed by the Customer Data and AI Processing section below.
• Consent: Any freely given, informed, and unambiguous statement which may be given by a clear affirmative action.
• Cookies: Small pieces of data given to a web browser by a web server.
• Data Fiduciary: A natural or legal person that determines the purposes and means of the processing of personal data.
• Data Processor: The natural or legal person who processes personal data on behalf of the data fiduciary.
• Data Principal: The natural person who interacts with us and whose personal data we collect.
• Erasure or Deletion: The irretrievable obliteration or destruction of saved personal data.
• Personal Data: Any information identified or identifiable to a natural person.
• Personal Data Breach: Any breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data processed by Krutrim.
• Processing: Any operation performed on personal data, including collection, recording, structuring, alteration, use, disclosure, and analysis.
• Pseudonymization: A processing technique where the processed data is not identifiable to a natural person unless coupled with other information.
• Third Party: A natural or legal person, public authority, agency, or body other than the data principal, data fiduciary, or processor.
• Security Incident: Any actual or reasonably suspected unauthorised access to, acquisition, disclosure, alteration, loss, destruction or compromise of Customer Data or any event that materially compromises the confidentiality, integrity or availability of Customer Data or the Services.
• Service Usage Data: Technical and operational information generated through your use of the Services, such as usage volumes, resource consumption, configuration and performance information, feature usage, access times, system logs and diagnostics, and other telemetry relating to the operation, security and performance of the Services, excluding Customer Data and Personal Data contained in Customer Data.

Details of the Data Fiduciary

Krutrim SI Designs Private Limited and its subsidiaries and affiliates (the 'Company', 'we' or 'us') having its registered office at 8th Floor, Wing C, Prestige RMZ Startech Block C, Industrial Layout, Hosur Road, Koramangala, Bengaluru, Bengaluru Urban, Karnataka, 560095 is the data fiduciary under this Privacy Policy only in respect of Personal Data that it processes for its own purposes, including in connection with account administration, customer relationship management, billing, security, fraud prevention, service improvement, legal and regulatory compliance and other purposes expressly described in this Privacy Policy.

Where Krutrim processes Personal Data contained in Customer Data on behalf of a customer in connection with the Services, Krutrim acts as a Data Processor and shall process such Personal Data only for the purposes of providing, securing, maintaining and supporting the Services, in accordance with the customer's documented instructions, the applicable agreement and Data Processing Addendum, and applicable law.

Krutrim shall not determine the purposes or means of processing Customer Data except to the extent necessary to provide, secure, maintain or support the Services or as required by applicable law.

Privacy Queries

If you have any queries under this Privacy Policy or want clarification about our processing of your personal information, you can connect with us at cloudsupport@olakrutrim.com. We will review and respond to your query in accordance with our applicable procedures and within the timelines prescribed by applicable law, where applicable. Where applicable law provides a right to approach a competent authority, you may exercise that right in accordance with the applicable law.

Type of Personal Information and Manner of Collection

User Sign-Up Consent and Account Information

We will be collecting and storing the following details from you during the sign-up process to create your profile:

• Name
• Phone number
• Primary location
• Email Address

The above-mentioned information is required to create and administer your account and to provide the Services. If you do not provide the information that is necessary for these purposes, we may not be able to create or maintain your account or provide the relevant Services. The information that we collect is stored and processed in accordance with the applicable service-specific data-location commitments and applicable law. We maintain appropriate technical and organisational measures to protect the information we collect. We may use third-party service providers to support analytics and service improvement. Where such processing requires consent under applicable law, we will obtain your consent before undertaking such processing.

Information You Provide to Us

• Contact and account information, such as your first and last name, email address, and phone number.
• Content and metadata of any messages that you send using our services.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Automatic Data Collection

We may automatically log and combine information about you, your computer or mobile device, and your interaction over time with the Services, online resources, and our communications, such as:

• Device data such as your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, and general location information such as city, state, or geographic area.
• Online activity data such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Services, navigation paths between pages or screens, information about your activity on a page or screen, access times, duration of access, and whether you have opened or otherwise engaged with our communications.

Service Usage Data: We may collect Service Usage Data generated through your use of the Services, including information relating to resource consumption, usage volumes, feature usage, access times, system performance, configuration, diagnostics, logs and other technical telemetry. We use such information to provide, maintain, secure, monitor, troubleshoot and improve the Services, comply with applicable law, and prevent fraud, abuse or misuse.

Service Usage Data excludes Customer Data and Personal Data contained in Customer Data. Customer Data shall not be treated as Service Usage Data solely because it is processed through the Services.

We use the following tools for automatic data collection:

• Cookies: Text files that websites store on a visitor's device to uniquely identify the visitor's browser or to store information or settings in the browser.
• Local storage technologies: Like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data.
• Web beacons: Also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

Service Usage Data and other telemetry shall be used only for the purposes described in this Privacy Policy and subject to applicable law. Customer Data, including Personal Data contained in Customer Data, shall not be treated as Service Usage Data solely because it is processed through the Services.

Krutrim Pages: Hosted Site and Visitor Data

If you use Krutrim Pages to publish a website, we may additionally collect and process information relating to your use of Krutrim Pages, including your IAM account and organisation identifiers; the site name, subdomain and resource identifiers you select; the versions of the applicable Terms and Acceptable Use Policy accepted by you and the date and time of such acceptance; files and metadata you upload to publish your Hosted Site; IP addresses and access logs relating to visitors to your Hosted Site; results of automated security or malware scans and records of manual reviews of your Hosted Site content undertaken for security, abuse prevention or policy enforcement purposes; and records relating to abuse reports, investigations, enforcement actions or suspension or termination of your Hosted Site.

We process such information for purposes including operating, maintaining and securing Krutrim Pages, detecting and preventing abuse, enforcing the applicable Terms and Acceptable Use Policy, including investigating policy violations and suspending or terminating Hosted Sites where appropriate, investigating security incidents, protecting the Services and responding to legal or regulatory requirements.

Where your Hosted Site collects Personal Data directly from its visitors, you are responsible for determining the purposes and means of such collection and processing and for providing any notices and obtaining any consents or other authorisations required under applicable law. To the extent Krutrim processes such Personal Data solely on your behalf in providing Krutrim Pages, Krutrim acts as a Data Processor and such processing is governed by the applicable agreement and any applicable Data Processing Addendum.

The customer's responsibilities under this paragraph do not affect any obligations that Krutrim may have under applicable law in respect of Personal Data that Krutrim processes as a Data Fiduciary or Data Processor.

Krutrim may process Personal Data independently where required to comply with applicable law, respond to lawful requests, protect the security of the Services, prevent or investigate fraud, abuse or security incidents, or enforce its contractual and acceptable use requirements.

Personal Information That We May Receive from Other Sources

The third parties from whom We may receive information may include our subsidiaries, affiliates, or parent companies or other third-party companies. For example, you may avail our services by logging in through your ID linked with Ola Cabs account or any other application owned by ANI Technologies Private Limited (“ANI”) and its Group Companies where such integration is available and you choose to use it. We will process information received through such integration for the purposes described in this Privacy Policy and in accordance with applicable law.

In any instance, We will use the Personal Information We obtain from these sources for the purposes as mentioned below. The remaining provisions of this Policy also apply to any Personal Information We obtain from these sources as well.

Purpose of Collection and Processing of Personal Information

Provide our Services: We use personal information to operate, maintain, and provide you with our Services. In particular, we use personal information to perform our contractual obligations under our Terms of Service.

Communicate with you about our Services: It is in our legitimate business interests to use personal information to respond to your requests, provide user support, and communicate with you about our Services, including by sending announcements, surveys, reminders, updates, security alerts, and support and administrative messages.

Improve, monitor, personalize, and protect our Services: It is in our legitimate business interests to improve and keep our Services safe for our users, which includes:

• Understanding your needs and interests, and personalizing your experience with the Services and our communications.
• Troubleshooting, testing, and research, and keeping the Services secure.
• Investigating and protecting against fraudulent, harmful, unauthorized, or illegal activity.

Research and development: We may use personal information for research and development purposes where it is in our legitimate business interests, including to analyze and improve the Services and our business. As part of these activities, we may create or use aggregated, de-identified or other anonymized data from personal information we collect. We may create aggregated or de-identified data from Personal Data for lawful business purposes, including analysing and improving the Services. We will treat information as anonymous only where it can no longer reasonably be used to identify an individual, taking into account the means reasonably likely to be used. We will handle information that remains Personal Data in accordance with this Privacy Policy and applicable law.

Compliance and protection: We may use personal information to comply with legal obligations, and to defend us against legal claims or disputes, including to:

• Protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims).
• Audit our internal processes for compliance with legal and contractual requirements and internal policies.
• Enforce the terms and conditions that govern the Services.
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.
• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

We process Krutrim Pages information to operate and secure the service, prevent and investigate abuse, protect users and Krutrim systems, enforce our terms, respond to reports and legal requests, and comply with applicable law. Customers are responsible for providing any notices and obtaining any permissions or consents required for personal data that they publish or collect through their Hosted Sites.

How Information Is Processed

The information may be processed by our Website. Your Personal Information is processed by us under different circumstances and under a different lawful basis. The same is provided below for your information:

• To provide, administer, maintain and/or analyze the Services;
• To improve our Services and conduct research;
• To communicate with you; including to send you information about our Services and events;
• To develop new programs and services;
• To prevent fraud, criminal activity, or misuses of our Services, and to protect the security of our IT systems, architecture, and networks;
• To carry out business transfers;
• To process your customer account transaction; and
• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Aggregated or De-Identified Information. We may aggregate or de-identify Personal Information so that it may no longer be used to identify you and use such information to analyze the effectiveness of our Services, to improve and add features to our Services, to conduct research and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of users of our Services and share aggregated information like general user statistics with third parties, publish such aggregated information or make such aggregated information generally available. We may collect aggregated information through the Services, through cookies, and through other means described in this Privacy Policy. We will maintain and use de-identified information in anonymous or de-identified form and we will not attempt to re-identify the information, unless required by law.

Customer Data and AI Processing

Krutrim may process Customer Data, including prompts, inputs, outputs, models, datasets, files and other content submitted by a customer, solely to provide, secure, maintain, support and improve the customer's use of the Services, in accordance with the applicable agreement and Data Processing Addendum.

Krutrim shall not use Customer Data to train, fine-tune or otherwise improve any general-purpose artificial intelligence or machine learning model, or disclose Customer Data to any third party for such purposes, unless the customer has expressly authorised such use in writing or such processing is otherwise expressly permitted under the applicable agreement.

Where a customer separately elects to participate in any model training, research, benchmarking or product improvement programme involving Customer Data, such processing shall be subject to the terms expressly applicable to that programme and any required consent or authorisation.

Krutrim may use aggregated or irreversibly anonymised information derived from use of the Services for analytics, security, research and development and service improvement, provided that such information does not identify, or reasonably permit identification of, the customer or any Data Principal.

Sharing/Transfer of Personal Data

We do not sell or share your personal information with third parties for interest-based advertising purposes. We may disclose your personal information as described below:

Service providers: We may rely on third-party service providers in furtherance of the purposes described above. In these cases, personal information may be accessed by these third-parties and processed or stored on our behalf. These service providers can include hosting services, cloud computing and storage services, maintenance services, security services, and user support services. Where we use third-party providers for analytics, advertising attribution or measurement, we will do so only in accordance with applicable law, applicable consent requirements and our disclosed purposes. Any sharing of hashed identifiers or device data will be subject to appropriate safeguards and will not be treated as anonymised merely because the data has been hashed.

Affiliated: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with Krutrim. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy.

Authorities and others: If we are legally obliged or otherwise believe it necessary to do so, personal information may be disclosed to regulatory agencies, law enforcement agencies, courts, and other government authorities, including for the compliance and protection purposes described above.

International Transfers

Personal Data will be stored and processed in accordance with the applicable service-specific data-location commitments and applicable law. Where a transfer of Personal Data outside India is permitted and necessary, Krutrim will ensure that the transfer complies with applicable law and any applicable contractual commitments, restrictions and safeguards.

Marketing Based on Your Online Web Behavior Data

When you visit our website(s), and if you consent to the use of cookies, we collect and process your IP address, information on your browsing on our website, e.g. product interest and configuration, device information, unique online identifiers and interaction in relation to our ads on third-party websites (your “Online Web Behaviour Data”). Such data is collected by cookies that we and third parties place on our website and in our app.

Where required by applicable law, we will obtain your consent before placing or accessing cookies or similar technologies used for advertising, profiling or other non-essential purposes. We may use the resulting Online Web Behaviour Data to understand website usage, identify product interests and display relevant advertisements, subject to applicable law and your cookie preferences. Where consent is the applicable legal basis, you may withdraw it at any time through the available cookie settings or other applicable mechanism. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. We will not rely on legitimate interests as a substitute for consent where consent is required by applicable law.

All data that we store about you for these purposes may also be stored in pseudonymised form, meaning that the information stored about you is connected to an online identifier. The data that we use has been collected by cookies and we always ask for your consent to place these cookies before collecting and storing the data. Furthermore, the profiling is always conducted on group level, meaning that you will receive the same type of marketing as other individuals included in that same segment.

The profiles we create are also based on a few criteria, such as your behaviour on our website and product interest. To this end, we have a legitimate interest to process your personal data for these purposes. You always have the possibility to object to this processing by withdrawing your consent to the use of cookies.

If you consent, we may combine this data with your Online Web Behaviour Data for the purposes of sending you targeted marketing through email, or by mobile push notifications including but not limited to text messages and/or WhatsApp. Your email address and contact number will for example be collected when you register on our platform and in such cases the email address and the contact number will be connected to your online identifier. In that manner we will be able to store information regarding your online behaviour and connect it to your pseudonymised email address. By doing this, we will for example be able to send you personalized marketing by email.

Retention

We will retain your Personal Data for as long as necessary to fulfill the purposes outlined in this policy or the purposes of which you have otherwise been informed or as otherwise permitted or required by applicable law. Where retention is no longer necessary, we will delete or anonymise the Personal Data, subject to any retention required or permitted by applicable law. For Personal Data contained in Customer Data that Krutrim processes as a Data Processor, retention and deletion will be governed by the applicable agreement, Data Processing Addendum, customer instructions and applicable law.

Rights of Data Principals

Depending on the applicable data protection law, you may have certain rights in relation to your Personal Data. We may take steps to confirm your identity, wherever applicable, to ensure that your rights are being exercised appropriately. To exercise these rights or to raise a privacy-related query or grievance, you may write to us at cloudsupport@olakrutrim.com. We will handle your request in accordance with applicable law, including the timelines and procedures prescribed for the relevant request. The rights available to you will depend on the applicable law and the nature of the processing.

Accessing Your Personal Information

Where provided under applicable law, you have the right to access information about the Personal Data we process about you and to obtain a copy of such information to the extent required by law.

You have the right to access and copy your personal information that we hold in a standard form that will be easy and understandable. In rare occasions we may not provide you with a copy of your information in which case we will convey you this message with appropriate reasons. Generally, we can only deny you your right of access if it concerns the right of other individuals or we have another lawful reason to withhold that information and not otherwise. You also have the right to access in one place the identities of the data fiduciaries with whom your personal data has been shared by us together with the categories of personal data shared with them.

Where required by applicable law, we will also provide information about the categories of Personal Data processed, the purposes of processing, and the recipients or categories of recipients to whom Personal Data has been disclosed. Any request will be handled subject to applicable legal limitations, including where disclosure would adversely affect the rights of another person or where withholding the information is otherwise permitted by law.

Verify and Rectify

Where provided under applicable law, you may request correction, completion or updating of inaccurate or incomplete Personal Data that we maintain about you. We will assess and respond to such requests in accordance with applicable law.

Accuracy is an important principle of data protection and you have the right to verify your information with us and ask us to rectify it if it is inaccurate. You can correct, complete and update your name, address, contact details and other personal information you give us.

Withdrawing Your Consent

Where we rely on your consent to process Personal Data, you may withdraw your consent through the mechanism made available for that purpose or by contacting us at cloudsupport@olakrutrim.com. Following withdrawal, we will cease the processing for which consent was the applicable legal basis, subject to applicable law. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Also, we are legally permitted to continue collecting or processing your personal data if we can rely on grounds other than consent to process your information.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. We may continue to process Personal Data where permitted or required under another applicable legal ground.

Objection Processing and Automated Decisions, Where Applicable

Where applicable data protection law provides a right to object to the processing of your Personal Data, you may exercise that right in accordance with the requirements of the applicable law. We will assess and respond to your objection as required by law, including any applicable requirements to cease or restrict processing.

Where applicable data protection law provides rights in relation to automated decision-making, those rights may be exercised in accordance with the applicable law.

Erasing Your Personal Information

Where provided under applicable law, you may request erasure of your Personal Data. We will assess and comply with such requests in accordance with applicable law, including any applicable requirements concerning continued retention of Personal Data.

Data Portability, where applicable

Where applicable law provides a right to data portability, You have the right to ask for a copy of information that we collect from you in a structured data file. We will provide this to you electronically in a structured, commonly used and machine-readable form, to the extent required by applicable law and subject to any applicable lawful limitations.

Any request to transmit Personal Data directly to another data fiduciary will be handled only to the extent such a right is provided by applicable law and subject to applicable legal limitations.

Restriction of Processing, Where Applicable

Where applicable law provides a right to restriction of processing, you may request restriction in the circumstances specified by that law. We will assess and respond to your request in accordance with the applicable legal requirements.

Where applicable law permits you to request restriction of processing;

• You have objected to its use or withdrawn your consent and our assessment is pending, or
• Where your data has served the purpose.

In these situations, we may only process your personal information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.

Lodging of Complaint

If you have any issues with the way we process data or you need any clarification on our privacy practices you can always contact us at cloudsupport@olakrutrim.com. We will review and respond to your query or grievance in accordance with applicable law and our applicable procedures. Where applicable law provides a right to approach a competent authority, you may exercise that right in accordance with the applicable law.