PRIVACY AND DATA PROTECTION POLICY

OUR COMMITMENT TO DIGITAL TRUST

Business Tokri is built on the principle that meaningful enterprise visibility must be supported by trust, transparency and responsible digital governance. As a video-first enterprise visibility and growth platform, we recognise that the credibility of our ecosystem depends not only on how businesses are presented and discovered, but also on how responsibly personal data is collected, used, protected and shared.

We are committed to respecting the privacy, dignity and lawful rights of every individual whose personal data forms part of the Business Tokri ecosystem.

Our approach is guided by lawful processing, transparency, accountability, data security and responsible innovation. We seek to maintain a clear distinction between information authorised for public visibility and information entrusted to us for private, administrative, contractual or service-related purposes.

1. LEGAL STATUS, PURPOSE AND ACCEPTANCE

This Privacy and Data Protection Policy (the "Policy") governs the processing of personal data in connection with Business Tokri and the Services offered through or under the Business Tokri brand.

This Policy forms part of the Business Tokri Legal and Platform Governance Framework and shall be read together, where applicable, with the Terms of Use, specific privacy notices, consents, the Business Services Agreement ("BSA"), and other policies or contractual documents expressly incorporated by reference.

By accessing or using a Service involving the processing of personal data, or by voluntarily providing personal data to Business Tokri, a User acknowledges the practices described in this Policy.

Such acknowledgement shall not, by itself, constitute consent where Applicable Law requires separate, specific or affirmative consent. Where consent is legally required, Business Tokri shall obtain it through an appropriate mechanism.

2. PLATFORM OPERATOR AND DATA FIDUCIARY

Business Tokri is owned and operated by: Oprash Worldwide LLP

Oprash Worldwide LLP is a limited liability partnership incorporated under the laws of India.

Where Oprash Worldwide LLP determines the purpose and means of processing personal data, it shall act as the Data Fiduciary, to the extent such designation applies under Applicable Law.

For the purposes of this Policy, Oprash Worldwide LLP may be referred to as the "Company," "Platform Operator," "Business Tokri," "we," "us" or "our,"as the context requires.

3. DEFINITIONS AND INTERPRETATION

For the purposes of this Policy:

• "Applicable Law" means any law, statute, rule, regulation, notification, legally binding direction, order or regulatory requirement applicable in India to the relevant activity or processing operation from time to time.
• "Business Tokri" or "Platform" means the website, digital platform, enterprise visibility ecosystem, applications, Services and authorised digital properties operated under the Business Tokri brand.
• "Client" means an enterprise, organisation or other person that engages Oprash Worldwide LLP for contracted Services.
• "Company" means Oprash Worldwide LLP.
• "Data Principal" means the individual to whom personal data relates, as recognised under Applicable Law.
• "Data Fiduciary" means a person who, alone or together with another person, determines the purpose and means of processing personal data.
• "Data Processor" means a person who processes personal data on behalf of a Data Fiduciary.
• "Personal Data" means data about an individual who is identifiable by or in relation to such data, as defined under Applicable Law.
• "Processing" shall have the meaning assigned under Applicable Law and includes automated operations performed on digital personal data.
• "Services" means the services, features, programmes and facilities made available through or in connection with Business Tokri.
• "User" means any individual, founder, promoter, enterprise representative, professional, customer, participant or other person who accesses, uses or interacts with the Platform or Services.

Headings are included for convenience and shall not affect interpretation.

4. APPLICABLE LEGAL AND REGULATORY FRAMEWORK

This Policy shall be administered in accordance with Applicable Law, including, to the extent applicable and in force:

1. the Digital Personal Data Protection Act, 2023;
2. the Digital Personal Data Protection Rules, 2025, in accordance with their notified commencement provisions;
3. the Information Technology Act, 2000 and applicable rules and legally binding directions issued thereunder;
4. applicable directions issued by the Indian Computer Emergency Response Team concerning cybersecurity and incident management;
5. the Consumer Protection Act, 2019 and applicable subordinate legislation, where relevant; and
6. other applicable laws governing privacy, electronic records, digital transactions, cybersecurity and lawful disclosure of information.

Business Tokri shall implement the requirements of the applicable data-protection framework in accordance with their legally effective commencement dates.

Where Business Tokri qualifies as an intermediary in relation to a particular Service or function, applicable intermediary obligations shall apply only to the extent required by law.

Nothing in this Policy shall be construed as asserting that every law referred to above applies to every activity undertaken by Business Tokri. Applicability shall depend upon the nature of the relevant activity and the law in force at the relevant time.

Where this Policy conflicts with a mandatory requirement of Applicable Law, the mandatory legal requirement shall prevail.

5. SCOPE AND APPLICATION

This Policy applies to personal data processed in connection with:

• access to and use of the Platform;
• enterprise registration and onboarding;
• business, founder and leadership profiles;
• video-first enterprise profiling;
• interviews and professional showcases;
• photography and audiovisual production;
• business enquiries and professional engagements;
• consulting and enterprise support Services;
• training programmes, events and workshops;
• newsletters and business communications;
• business networking and ecosystem engagement;
• customer and technical support;
• memberships, subscriptions, advertising and promotional Services, where offered; and
• other Services, technologies and integrations introduced by Business Tokri from time to time.

This Policy does not govern the independent processing practices of third-party platforms or services that Business Tokri does not own or control.

6. PRINCIPLES GOVERNING PERSONAL DATA

Business Tokri shall process personal data in accordance with the following principles:

• Lawfulness: Personal data shall be processed only for lawful purposes and in accordance with Applicable Law.
• Transparency: Data Principals shall receive appropriate information concerning material processing activities.
• Purpose Limitation: Personal data shall be processed for specified, legitimate and communicated purposes.
• Data Proportionality: Business Tokri shall seek to process only personal data reasonably necessary for the relevant purpose.
• Accuracy: Reasonable steps shall be taken, where necessary, to maintain the accuracy and completeness of personal data.
• Security: Appropriate technical and organisational safeguards shall be maintained having regard to the nature and risk of processing.
• Accountability: Business Tokri shall maintain appropriate responsibility for personal data processed under its control.

7. CATEGORIES OF PERSONAL DATA

Depending on the nature of a User's interaction with Business Tokri, the Company may process:

• names and identity information;
• professional designations and qualifications;
• business affiliations;
• founder, promoter and leadership information;
• professional and business contact details;
• biographies and professional profiles;
• photographs and profile images;
• video and voice recordings;
• interviews and testimonials;
• account and authentication information;
• communications and enquiries;
• event, workshop and training information;
• technical, device and usage information;
• transaction, billing and invoice information; and
• other information voluntarily provided in connection with the Services.

Information relating exclusively to a company or other legal entity may not constitute personal data. Information identifying or relating to a founder, director, partner, proprietor, employee, representative or other natural person shall, however, be handled in accordance with Applicable Law.

Business Tokri shall not intentionally collect personal data unnecessary for the purpose for which it is sought.

8. SOURCES AND METHODS OF COLLECTION

Business Tokri may obtain personal data:

• directly from a Data Principal;
• from an enterprise or authorised representative;
• through Platform registration and onboarding;
• through enterprise profile submissions;
• during professional or contractual engagements;
• during video, photography or media production;
• through events, workshops and training programmes;
• through communications and enquiries;
• from authorised service providers;
• through lawful third-party integrations; or
• from legitimately accessible public professional or business sources.

Business Tokri shall not knowingly obtain personal data through unlawful, fraudulent or deceptive means.

Where personal data is provided by an enterprise or authorised representative on behalf of another individual, the submitting party shall be responsible for ensuring that it has the necessary authority or lawful basis to provide such information.

9. PURPOSES OF PROCESSING

Business Tokri may process personal data where reasonably necessary to:

1. create, maintain and publish authorised enterprise and professional profiles;
2. produce, edit, publish and distribute authorised business content;
3. provide enterprise visibility, communication, branding and professional Services;
4. administer accounts and, where offered, memberships or subscription-based Services;
5. communicate with Users and respond to enquiries;
6. facilitate authorised business networking and ecosystem connections;
7. organise training programmes, events, workshops and professional engagements;
8. process transactions and maintain business and financial records;
9. provide relevant Platform, industry and business communications;
10. operate, maintain and improve the Platform and Services;
11. protect Platform integrity, reliability and security;
12. prevent fraud, impersonation, misuse and unauthorised activity;
13. investigate grievances and resolve disputes;
14. comply with Applicable Law and lawful regulatory requirements; and
15. establish, exercise or defend legal claims.

Personal data shall not knowingly be processed for a materially incompatible purpose without an appropriate lawful basis and, where required, further notice or consent.

10. NOTICE, CONSENT AND LAWFUL PROCESSING

Where consent is required, Business Tokri shall provide an appropriate notice and obtain consent through a clear affirmative action in accordance with Applicable Law.

The notice shall identify, to the extent required by law:

• the personal data proposed to be processed;
• the specified purpose of processing;
• the manner in which consent may be withdrawn;
• the means by which applicable rights may be exercised; and
• the grievance redressal mechanism.

Consent may be withdrawn through the mechanism made available by Business Tokri, subject to Applicable Law. Withdrawal shall not affect the lawfulness of processing undertaken before such withdrawal. Where withdrawal makes continued provision of a requested Service reasonably impossible, Business Tokri may discontinue the affected Service, subject to Applicable Law and any applicable contractual obligations.

Nothing in this Policy prevents processing without consent where expressly permitted under Applicable Law.

11. PUBLIC ENTERPRISE PROFILES AND PROFESSIONAL VISIBILITY

Business Tokri is designed to strengthen the visibility, credibility and discoverability of participating enterprises.

Information expressly submitted, approved or authorised for public enterprise profiling may therefore be published through Business Tokri and its authorised distribution channels.

Such information may include:

• enterprise profiles;
• founder and leadership profiles;
• professional biographies;
• designated business contact information;
• authorised photographs and videos;
• interviews and testimonials;
• information relating to products and Services; and
• other approved professional or enterprise information.

Business Tokri shall seek to maintain a reasonable distinction between information authorised for public visibility and information collected for private, administrative, contractual or transactional purposes.

Information provided privately shall not be treated as public merely because the relevant individual or enterprise uses the Platform.

12. VIDEO, PHOTOGRAPHY AND AUDIOVISUAL DATA

As a video-first enterprise visibility platform, Business Tokri may record, receive, produce, edit, reproduce, publish, communicate, distribute and promote authorised audiovisual material for enterprise profiling, professional visibility, editorial, educational or promotional purposes.

Where identifiable individuals are featured, Business Tokri shall obtain or rely upon appropriate consent, authorisation, contractual permission or another lawful basis, as applicable.

An enterprise commissioning, submitting or authorising media content represents that it has obtained permissions reasonably necessary in relation to persons, premises, trademarks, copyrighted materials and other protected elements supplied or authorised by it.

Detailed provisions concerning ownership, licences, consent, editing, publication, distribution, reuse and withdrawal of audiovisual content shall be governed by the Content Policy, applicable consent or media-release documentation and any applicable written commercial agreement.

13. USER AND CLIENT RESPONSIBILITIES

A User or Client submitting personal data relating to themselves or another individual represents and warrants, to the extent applicable, that:

1. the information provided is materially accurate;
2. they have lawful authority to provide it;
3. all permissions or consents required from their side have been obtained;
4. the submission does not knowingly infringe another person's privacy or legal rights;
5. the information has not been obtained unlawfully; and
6. they shall comply with Applicable Law and applicable Business Tokri policies.

Where an enterprise provides personal data relating to employees, representatives or other individuals, it shall remain responsible for ensuring that such information has been lawfully obtained and provided.

Nothing in this Clause relieves Business Tokri of any independent statutory obligation imposed upon it.

14. CHILDREN'S PERSONAL DATA

Business Tokri is primarily a business-to-business and professional platform and is not principally directed towards children. Where Business Tokri knowingly processes personal data relating to a child, it shall comply with applicable statutory requirements concerning parental or lawful guardian consent and other prescribed safeguards, to the extent applicable and in force.

Business Tokri shall not knowingly undertake processing relating to children that is prohibited under Applicable Law.

15. DISCLOSURE AND SHARING OF PERSONAL DATA

Business Tokri may disclose personal data where reasonably necessary and permitted or required by Applicable Law, including to:

• Data Processors and authorised service providers;
• hosting and technology providers;
• payment processors;
• communication service providers;
• cyber security providers;
• professional advisers;
• authorised video, media and creative partners;
• event and training partners;
• authorised business partners; and
• governmental, judicial, regulatory or law-enforcement authorities where legally required.

Where appropriate, service providers processing personal data on behalf of Business Tokri shall be subject to contractual obligations concerning confidentiality, security and authorised processing.

Business Tokri does not sell personal data as a standalone commercial commodity.

Participation in the Business Tokri ecosystem shall not, by itself, constitute consent to unrestricted disclosure of private personal or contact information to other Platform participants.

16. CLIENT-DIRECTED PROCESSING

Where Business Tokri processes personal data solely on the documented instructions of a Client in connection with contracted Services, the respective rights and responsibilities of the Parties may be further governed by the applicable Business Services Agreement, Work Order or Data Processing Addendum, where required.

The Client shall be responsible for ensuring that personal data provided or made available to Business Tokri for such processing has been lawfully collected and disclosed and that all notices, consents, permissions or other lawful bases required from the Client's side have been obtained.

Business Tokri shall process such personal data only for the authorised purposes of the engagement, subject to Applicable Law and the applicable contractual documents.

Nothing in this Clause alters any independent statutory obligation applicable to either Party.

17. BUSINESS NETWORKING AND ECOSYSTEM CONNECTIONS

Business Tokri may facilitate professional introductions and ecosystem connections involving enterprises, buyers, industry associations, experts, institutions, investors, service providers, strategic partners and other stakeholders. Where private personal contact information is proposed to be shared for such purposes, Business Tokri shall rely upon an appropriate lawful basis and obtain consent where required.

Information expressly designated as public business contact information may be used for the purpose for which it was made available, subject to Applicable Law.

Business Tokri does not guarantee any commercial, financial, investment or professional outcome arising from an introduction, connection or opportunity facilitated through the Platform.

18. DATA PROCESSORS, SERVICE PROVIDERS AND CROSS-BORDER PROCESSING

Business Tokri may engage third-party service providers for legitimate operational functions, including hosting, technology infrastructure, analytics, communications, payment processing, cybersecurity, media production and professional support.

Where a third party processes personal data on behalf of Business Tokri, appropriate safeguards shall be implemented having regard to the nature and risk of the processing, including contractual obligations where required.

The engagement of a Data Processor shall not relieve Business Tokri of any responsibility that cannot lawfully be delegated. Processing of personal data outside India shall be undertaken subject to Applicable Law and any legally binding restrictions imposed by the Government of India.

19. MARKETING, BUSINESS COMMUNICATIONS AND USER CHOICE

Subject to Applicable Law and User preferences, Business Tokri may communicate with Users regarding:

• requested Services;
• Platform developments;
• business and market opportunities;
• industry information;
• events and training programmes;
• new Services; and
• promotional offerings.

Where required, Users shall have a reasonable mechanism to withdraw from non-essential promotional communications.

Withdrawal from marketing communications shall not prevent Business Tokri from sending essential communications concerning accounts, transactions, security, contractual obligations or requested Services.

20. COOKIES, ANALYTICS AND SIMILAR TECHNOLOGIES

Business Tokri may use cookies and similar technologies for legitimate purposes, including essential Platform functionality, authentication, security, User preferences, analytics and performance measurement.

The categories of technologies actually deployed and their purposes shall be described in the Cookie Policy, Where Applicable Law requires consent for non-essential tracking technologies, Business Tokri shall implement an appropriate consent mechanism.

21. DATA RETENTION AND ERASURE

Business Tokri shall retain personal data only for as long as reasonably necessary for the relevant purpose or where continued retention is justified by:

• contractual obligations;
• statutory requirements;
• taxation or accounting obligations;
• dispute resolution;
• fraud prevention;
• cybersecurity requirements;
• the establishment, exercise or defence of legal claims; or
• another lawful purpose.

Upon expiry of the applicable retention period, personal data shall be erased, anonymised or securely disposed of, subject to Applicable Law.

Business Tokri may maintain an internal data-retention schedule appropriate to its operations and legal obligations.

22. INFORMATION SECURITY AND PERSONAL DATA BREACHES

Business Tokri shall implement reasonable technical and organisational safeguards proportionate to the nature, scale and risks of its processing activities.

Such safeguards may include, where appropriate:

• access controls and authentication;
• encryption and secure credential management;
• role-based permissions;
• backup and recovery procedures;
• security monitoring;
• vulnerability management;
• processor controls; and
• incident-response procedures.

In the event of a personal data breach, Business Tokri shall take appropriate measures to contain, investigate, assess, mitigate and remediate the incident. Where required by Applicable Law, Business Tokri shall notify affected Data Principals and competent authorities in the prescribed form, manner and timeframe.

Cyber security incidents subject to separate statutory reporting requirements shall be handled in accordance with applicable cyber security laws and legally binding directions.

No digital system can guarantee absolute security. Nothing in this Policy limits any mandatory security or breach-response obligation imposed upon Business Tokri.

23. RIGHTS AND DUTIES OF DATA PRINCIPALS

Subject to Applicable Law and the commencement of relevant statutory provisions, a Data Principal may exercise applicable rights, including the right to:

• obtain prescribed information concerning the processing of personal data;
• seek correction, completion or updating of personal data;
• seek erasure where legally available;
• withdraw consent where processing is based on consent;
• access the applicable grievance redressal mechanism; and
• exercise nomination rights where recognised by law.

Business Tokri may undertake reasonable identity verification before acting upon a request to protect personal data against unauthorised access, alteration or erasure.

Data Principals shall also comply with duties imposed upon them under Applicable Law, including providing authentic information, refraining from impersonation and avoiding false or frivolous grievances.

The exercise of rights may be subject to lawful exceptions and mandatory retention requirements.

24. ACCOUNTABILITY, PRIVACY BY DESIGN AND EMERGING TECHNOLOGIES

Business Tokri shall seek to incorporate appropriate privacy, security and data-governance considerations into the development of new Services, technologies and integrations.

Depending upon the nature of the Service, this may include:

• clearly defined processing purposes;
• proportionate data collection;
• appropriate access restrictions;
• transparent privacy notices;
• assessment of material service providers;
• security safeguards;
• retention controls; and
• accessible mechanisms for exercising applicable rights.

Business Tokri may use technology-assisted tools for legitimate functions, including transcription, translation, search, content enhancement, recommendations, analytics and operational efficiency.

Where such technologies process personal data, their use shall remain subject to this Policy and Applicable Law.

The creation, use and disclosure of AI-generated or synthetically generated content shall be subject to Applicable Law, the Content Policy, and any specific standards or notices adopted by Business Tokri from time to time.

25. GRIEVANCE REDRESSAL AND POLICY GOVERNANCE

Questions, concerns, grievances and requests concerning personal data may be submitted to:

Business Tokri
Operated by Oprash Worldwide LLP
Contact: businesstokri@gmail.com

Business Tokri shall acknowledge and address grievances in accordance with Applicable Law.

Privacy-related grievances shall be handled under this Policy and Applicable Law. Content-related complaints and takedown requests may additionally be governed by the Grievance Redressal and Content Takedown Policy.

Contractual or commercial disputes shall be governed by the applicable contractual documents and shall not be determined solely through the privacy grievance mechanism.

Nothing in this Policy restricts any statutory right of a Data Principal to approach the Data Protection Board of India or another legally competent authority, subject to applicable statutory procedures.

26. POLICY AMENDMENTS

Business Tokri may amend this Policy to reflect changes in Applicable Law, regulatory requirements, Platform functionality, processing practices, technology, security requirements or Services.

Where a material amendment affects the rights of Data Principals or materially changes the purpose for which personal data is processed, Business Tokri shall provide appropriate notice and obtain further consent where required by Applicable Law.

The current version, effective date and date of latest revision shall be made available through the Platform.

27. RELATIONSHIP WITH COMMERCIAL AGREEMENTS

Where a Client enters into a Business Services Agreement or other written agreement with Oprash Worldwide LLP for specific Services, that agreement may further govern the Parties' respective privacy, data-protection and confidentiality obligations in relation to the contracted Services.

In the event of a direct inconsistency, the specific written agreement shall govern the relevant contractual allocation of responsibilities, except to the extent that this Policy or Applicable Law imposes a mandatory privacy or data-protection obligation that cannot lawfully be excluded or modified by contract.

Nothing in a commercial agreement shall authorise either Party to process personal data unlawfully.

28. GOVERNING LAW AND GENERAL PROVISIONS

This Policy shall be governed by the laws of India.

Subject to mandatory statutory jurisdictions, regulatory remedies and forums that cannot lawfully be excluded, disputes arising out of or in connection with this Policy shall be subject to the jurisdiction of the competent courts at Agra, Uttar Pradesh, India.

Nothing in this Policy shall:

• exclude or restrict any statutory right that cannot lawfully be excluded;
• prevent a Data Principal from approaching a legally competent authority;
• authorise processing prohibited by Applicable Law; or
• relieve Business Tokri of any statutory obligation imposed upon it.

If any provision is held invalid or unenforceable by a competent authority, the remaining provisions shall continue in force to the extent permitted by law.

Failure by Business Tokri to enforce any provision shall not constitute a waiver of any right or remedy.

This Policy shall be read together, where applicable, with the Terms of Use, Content Policy, Community Policy, Intellectual Property Policy, Cookie Policy, Verification Policy, Grievance Redressal and Content Takedown Policy, Disclaimer, and any applicable Business Services Agreement, Work Order, specific privacy notice, consent form or media release.