VAHAN360 PRIVACY POLICY

For purposes of applicable Indian data-protection law, the relevant Data Fiduciary is:

• Legal Entity: Swift Events India Private Limited
• Registered Office: Road No. 24, Rajeev Nagar, Patna – 800024, Bihar, India
• Privacy / Data Protection Contact: Ravish Kumar
• Privacy Email: [email protected]
• Support Email: [email protected]

Where Vahan360 determines the purpose and means of processing personal data, Vahan360 acts as a Data Fiduciary under applicable Indian law. Where Vahan360 processes personal data solely on behalf of another Data Fiduciary and in accordance with that party’s documented instructions, Vahan360 may act as a Data Processor for that engagement. The allocation of responsibilities will depend on the actual processing arrangement, applicable law and the contract between the parties.

This Privacy Policy, and the collection, use, processing, storage, disclosure and protection of personal data by Vahan360, shall be governed primarily by the laws of India, including applicable provisions of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), the Information Technology Act, 2000 and applicable rules, regulations, directions and notifications issued thereunder, together with applicable cybersecurity, telecommunications, consumer-protection and other Indian laws and regulatory requirements.

For the purposes of contractual interpretation, enforcement and disputes arising directly from this Policy or Vahan360’s privacy practices, the courts and competent judicial authorities having jurisdiction at Patna, Bihar, India shall have exclusive jurisdiction, subject to any mandatory jurisdiction conferred by applicable Indian law.

Nothing in this jurisdiction clause limits any statutory right, remedy, complaint mechanism or jurisdiction that cannot lawfully be excluded under applicable Indian law.

Vahan360’s privacy practices are designed to comply with applicable Indian legal requirements. Depending on the processing activity and the law in force at the relevant time, these may include:

• Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, including provisions relating to notice, consent, specified lawful uses, security safeguards, breach management, retention/deletion, rights of Data Principals, grievance redressal and obligations of Data Fiduciaries and Data Processors.
• Information Technology Act, 2000 and applicable rules, directions and regulations made under it, to the extent applicable to Vahan360 and its processing activities.
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent any provision remains applicable to Vahan360 during the transition to the DPDP framework or otherwise applies by law.
• CERT-In directions issued under the Information Technology Act, including applicable cybersecurity incident reporting, log retention and information-security requirements.
• Telecom Regulatory Authority of India requirements, including the Telecom Commercial Communications Customer Preference Regulations, 2018 (“TCCCPR”) and applicable directions, where Vahan360 or its communication partners undertake commercial communications through regulated telecom channels.
• Applicable consumer-protection, contract, intellectual-property, criminal-law and other Indian laws that may affect the lawful collection, processing, disclosure or use of information.

Where an Indian law or legally binding regulatory requirement imposes a higher or more specific obligation for a particular processing activity, Vahan360 will comply with that requirement.

The DPDP Act, 2023 and DPDP Rules, 2025 form the principal modern data-protection framework for Vahan360’s Indian operations. The Central Government has prescribed a phased commencement of provisions of the DPDP Act. Accordingly, Vahan360 will comply with provisions that are legally in force at the relevant time and will maintain its systems and processes so that they can comply with provisions becoming operative under the notified commencement schedule.

Nothing in this Policy should be interpreted as stating that a provision is presently enforceable if its statutory commencement date has not yet arrived. Where appropriate, Vahan360 may implement a control in advance of its mandatory commencement date as a voluntary compliance and risk-management measure.

We collect personal data that is reasonably necessary for specified purposes, information you voluntarily provide, information generated through your use of the Platform, and information lawfully obtained from third parties and public or governmental sources.

Vahan360 may process personal data for the following specified purposes, depending on the service used:

• To respond to vehicle enquiries and provide assistance requested by you.
• To connect your enquiry with a dealer, OEM, manufacturer, distributor, lender, insurer, service provider or other relevant recipient.
• To administer accounts, enquiries, leads, requests and service records.
• To provide market intelligence, fleet/key-account mapping, custom reports, campaign administration, lead management and related business services.
• To operate, secure, maintain, troubleshoot and improve the Platform.
• To perform analytics, measurement, attribution, fraud prevention, abuse prevention and security monitoring.
• To personalise content or recommendations where lawfully permitted.
• To send service, transactional, security and operational communications.
• To send promotional communications where the applicable consent, preference or other lawful permission exists.
• To create aggregated or anonymised statistics, market trends and business insights that do not reasonably identify an individual.
• To comply with applicable law, court orders, regulatory requirements and lawful government or law-enforcement requests.
• To establish, exercise or defend legal claims and protect Vahan360, users, systems and property.
• To fulfil another purpose specifically disclosed at the time of collection or otherwise permitted by applicable Indian law.

Vahan360 will process personal data only where permitted by applicable Indian law. Depending on the activity and the law in force at the relevant time, the processing may be based on consent, certain specified lawful uses recognised by the DPDP Act, performance of a requested service or contract where legally relevant, compliance with a legal obligation, protection of lawful interests where recognised by applicable law, or another statutory basis.

Where Vahan360 relies on consent under the DPDP Act, the consent request will be presented in clear and plain language and will identify the purpose and the personal data necessary for that purpose. Consent will be free, specific, informed, unconditional and unambiguous, and will require clear affirmative action.

Where consent is the basis of processing, you may withdraw consent through an accessible mechanism. Withdrawal will not affect the lawfulness of processing undertaken before withdrawal and will not require Vahan360 to cease processing where continued processing is otherwise required or authorised by Indian law.

Vahan360 does not treat your submission of personal data as blanket permission to disclose it to any future partner, advertiser or unrelated third party. Personal data will be disclosed only for a specified purpose and where Vahan360 has a lawful basis, valid consent where required, contractual authority, legal obligation or other lawful authority.

1. Purpose limitation — personal data is shared for identified and lawful purposes.
2. Data minimisation — recipients receive only information reasonably necessary for the stated purpose.
3. Recipient accountability — contracts and arrangements will define permitted use, confidentiality, security and deletion/return obligations where applicable.
4. No unrestricted onward sharing — recipients may not treat Vahan360 data as an unrestricted independent database unless the applicable legal and contractual framework permits such use.
5. Consent separation — optional promotional consent is separate from consent necessary to provide a requested service where separate consent is required.
6. Traceability — Vahan360 will maintain appropriate records of consent, disclosures and processing where required.
7. Security — sharing will be conducted using appropriate technical and organisational safeguards.

Vahan360 may use cookies, pixels, tags, SDKs, local storage and similar technologies for essential functionality, security, preferences, analytics, performance, personalisation and advertising.

The actual technologies and third-party providers used by Vahan360 should be identified in a Cookie Notice or consent-management interface. Where consent is required, non-essential tracking will not be activated before the required consent is obtained.

Vahan360 may send service-related communications necessary to respond to enquiries, administer an account, provide a requested service, address security matters or comply with law.

Promotional communications are subject to applicable Indian telecom and commercial-communication requirements. Where communications are sent through regulated telecom channels, Vahan360 and/or its communications partners will comply with applicable TCCCPR requirements, including applicable consent, preference, sender, template and opt-out requirements.

You may withdraw promotional consent or opt out through the mechanism provided in the communication or by contacting [email protected]. Withdrawal of promotional consent will not necessarily stop non-promotional communications that are necessary for an active enquiry, requested service, security matter or legal obligation.

Vahan360 will retain personal data only for as long as reasonably necessary for the purpose for which it was collected or processed, for providing requested services, maintaining necessary business records, complying with applicable law, resolving disputes, preventing fraud and abuse, maintaining security, enforcing agreements or otherwise as permitted by law.

When the specified purpose is no longer being served, Vahan360 will delete or cause deletion of personal data, or anonymise it where appropriate, subject to applicable legal retention requirements.

Where personal data is retained in backups, deletion from active systems may not result in immediate physical deletion from every backup copy. Backup copies will remain subject to access restrictions and the applicable backup lifecycle, and will not be restored for ordinary processing except as required for business continuity, security or law.

Vahan360 will maintain an internal retention schedule covering, as applicable, enquiries, leads, accounts, campaign records, consent records, analytics data, security logs and backups.

Vahan360 will implement reasonable security safeguards appropriate to the nature and risk of processing and as required by applicable Indian law. No website, database, network or electronic transmission can be guaranteed to be completely secure. This does not reduce Vahan360’s obligation to implement reasonable security safeguards required by applicable Indian law.

If Vahan360 becomes aware of a personal data breach or cybersecurity incident affecting personal data, Vahan360 will assess and contain the incident, investigate its scope and consequences, take reasonable mitigation and remediation measures, preserve relevant evidence and logs, and make notifications to Data Principals, the Data Protection Board of India, CERT-In or another competent authority where and when required by applicable Indian law.

Privacy-law breach notification and cybersecurity incident reporting are treated as separate compliance obligations. Where CERT-In directions require reporting of a specified cyber incident within the prescribed period, Vahan360 will follow the applicable CERT-In reporting process independently of any notification required under the DPDP framework.

Vahan360 will maintain an internal incident-response procedure covering identification, escalation, containment, evidence preservation, legal assessment, notification, remediation and post-incident review.

Subject to the DPDP Act, applicable commencement provisions and other applicable Indian law, you may have rights including:

• Right to access information about your personal data and its processing, as provided by law.
• Right to correction and updating of inaccurate or incomplete personal data.
• Right to erasure of personal data, subject to applicable legal retention and other exceptions.
• Right to withdraw consent where consent is the basis for processing.
• Right to grievance redressal.
• Right to nominate another individual to exercise rights on your behalf where permitted by law.

The precise scope, conditions and manner of exercising these rights will be governed by the Indian law applicable at the time the request is made.

You may submit a privacy request or grievance to [email protected]. Please identify the service or account involved and describe the request. Vahan360 may request proportionate information necessary to verify identity and prevent unauthorised requests.

Do not send passwords, payment credentials, authentication secrets or unnecessary identity documents in a general privacy enquiry.

Vahan360 will acknowledge and address requests within the period prescribed by applicable Indian law. Where a lawful exemption, retention requirement or other limitation applies, Vahan360 will explain the limitation to the extent permitted.

Where Vahan360 processes personal data solely as a Data Processor on behalf of another Data Fiduciary, Vahan360 may direct the request to the relevant Data Fiduciary or assist that Data Fiduciary as required by the applicable contract and law.

Vahan360’s ordinary vehicle enquiry and lead-generation services are intended for users who are legally able to use the relevant service. Vahan360 does not knowingly solicit children’s personal data for ordinary vehicle enquiries or targeted advertising.

Where Indian law requires verifiable parental or guardian consent or imposes restrictions on processing children’s personal data, Vahan360 will implement the safeguards applicable to the relevant processing activity.

Vahan360 may use analytics, segmentation, recommendation, fraud-detection or other automated technologies to understand enquiries, improve services, measure campaigns or prevent abuse.

Vahan360 will not knowingly use automated processing in a manner prohibited by applicable Indian law. Where Indian law requires additional notice, consent, safeguards or human review for a particular automated processing activity, Vahan360 will implement the applicable requirements.

The Platform may contain links, integrations, advertisements or services operated by third parties. Their privacy practices are governed by their own privacy notices. Vahan360 is not responsible for independent processing carried out by third parties outside Vahan360’s control. You should review the relevant third-party privacy notice before providing personal data to that third party.

You should provide information that is accurate, current and lawfully obtained. You should not submit another person’s personal data unless you are legally authorised to do so. Where you provide information relating to another person, you are responsible for ensuring that the disclosure is lawful and that any required notice or consent has been provided.

Vahan360 may update this Policy when its services, technologies, vendors, processing activities or legal obligations change. The latest version will display its effective date and last-updated date.

Where a change materially alters the purposes of processing, categories of personal data, recipient categories or another matter for which fresh notice or consent is legally required, Vahan360 will provide the required notice and obtain fresh consent where necessary.

Continued use of the Platform will not, by itself, be treated as affirmative consent where applicable Indian law requires affirmative consent.

• Registered Legal Entity: Swift Events India Private Limited
• Registered Office: Road No. 24, Rajeev Nagar, Patna – 800024, Bihar, India
• Privacy / Data Protection Contact: Ravish Kumar
• Privacy Email: [email protected]
• Support Email: [email protected]

For privacy requests or grievances, please use the above privacy email and identify the service or processing activity concerned.

This Policy shall be governed by and construed in accordance with the laws of India.

Subject to mandatory statutory rights, regulatory complaint mechanisms and jurisdiction conferred by applicable Indian law, the courts at Patna, Bihar shall have exclusive jurisdiction over disputes arising out of or relating to this Privacy Policy or Vahan360’s privacy practices.

Nothing in this clause prevents a Data Principal from exercising any statutory right to approach the Data Protection Board of India, a competent regulator, consumer forum/commission, court or other authority where such right is available under applicable Indian law.

Where the EU GDPR or UK GDPR applies to Vahan360’s processing, Vahan360 will comply with the additional requirements applicable to the relevant processing activity, including requirements relating to lawful bases, transparency, data-subject rights, processor contracts, records, security, breach notification and restricted international transfers.

Depending on the circumstances, Vahan360 may act as a controller or processor under those laws. Where a restricted international transfer occurs, Vahan360 will use an applicable lawful transfer mechanism and appropriate safeguards.

Where Vahan360 is subject to the California Consumer Privacy Act as amended (“CCPA/CPRA”) or another applicable United States state privacy law, Vahan360 will provide the additional notices, rights and opt-out mechanisms required by that law.

Vahan360 will determine whether a particular data flow constitutes a “sale”, “sharing”, targeted advertising or another regulated activity under the applicable state law based on the actual data flow, contractual arrangement and consideration involved.

Where Vahan360 offers services to individuals in another jurisdiction and the privacy law of that jurisdiction applies, Vahan360 may provide a jurisdiction-specific privacy notice or supplemental terms addressing additional requirements such as lawful bases, consent, data localisation, transfer mechanisms, data-subject rights, representative requirements and complaint mechanisms.

For users and processing activities governed solely by Indian law, Part I of this Policy governs. Where an international privacy law also applies, the additional rights and obligations applicable to that jurisdiction will apply to the relevant processing activity. Nothing in Part II reduces any mandatory right or protection available under Indian law.

Nothing in this Policy is intended to waive, restrict or exclude any right or protection that cannot lawfully be waived, restricted or excluded. If any provision of this Policy is found to be invalid or unenforceable under applicable law, the remaining provisions will continue to operate to the extent permitted by law.

If a mandatory provision of applicable law conflicts with this Policy, the mandatory legal requirement will prevail.

This Policy is intended to describe Vahan360’s privacy framework and should be implemented consistently with Vahan360’s actual technical systems, databases, forms, cookies, SDKs, CRM workflows, lead-routing processes, vendors, client contracts, retention settings and security controls.

A privacy policy does not itself create a lawful basis for a processing activity or authorise a third party to provide data that it is not legally entitled to provide. Before commencing a new data source, commercial data-sharing model, audience-matching programme or material change in processing, Vahan360 should assess the activity against applicable Indian law and update its notices and controls where required.

For legal and compliance review, Vahan360 should maintain current copies of the following official materials:

• Digital Personal Data Protection Act, 2023 — Ministry of Electronics and Information Technology / Gazette of India.
• Digital Personal Data Protection Rules, 2025 — Ministry of Electronics and Information Technology / Gazette of India.
• DPDP Act commencement notification and enforcement timeline.
• Information Technology Act, 2000 and applicable rules/directions.
• CERT-In Directions under Section 70B of the Information Technology Act, including applicable cyber-incident reporting and log-retention requirements.
• Telecom Commercial Communications Customer Preference Regulations, 2018 and applicable TRAI directions, where commercial communications are undertaken through regulated telecom channels.

This Policy should be reviewed whenever the Central Government, MeitY, CERT-In, TRAI, the Data Protection Board of India, a court or another competent Indian authority issues a relevant amendment, notification, regulation, direction or binding interpretation.