Privacy Policy

This Privacy Policy (hereinafter referred to as the “Privacy Policy”) shall be effective as of August 18, 2026 (the “Effective Date”). Please note that this Privacy Policy shall be subject to regular updates to reflect any changes in the way we handle your personal data or any changes in applicable laws and policies.

Indicosmic Infotech Limited (hereinafter referred to as “IIL”, “we”, “us”, or “our”) operates as a Data Fiduciary under applicable laws and is committed to protecting your (the “User(s)”) privacy and ensuring the lawful, fair, and transparent Processing of the User’s Personal Data. This Privacy Policy outlines how we collect, use, Process, store, disclose, and safeguard the User’s Personal Data when they interact with our website (www.indicosmic.com) and its associated sub-domains, web pages, or digital interfaces (collectively, the “Platform”). This Privacy Policy is published in compliance with:

Information Technology Act, 2000 (the “IT Act”);

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011 (the “SPDI Rules”); and

Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and Digital Personal Data Protection Rules, 2025.

In accordance with the DPDP framework, this Privacy Policy serves as an explicit notice to the User regarding the purposes for which the User’s personal data is collected and Processed. This Privacy Policy is available in English and can be made available in other languages specified in the Eighth Schedule to the Constitution of India upon explicit request.

By accessing, browsing, or using the Platform, or by clicking to accept or agree to this Privacy Policy where such an option is made available, the User acknowledges that he/she has read and understood the terms herein. This Privacy Policy is incorporated by reference into, and forms an integral part of, the IIL Terms of Use.

This Privacy Policy applies strictly to data collection via the Platform. The Platform may contain links to third-party websites, plug-ins, social media handles, or applications that are not owned, controlled, or operated by IIL. We do not endorse or assume any responsibility for the content, privacy practices, or security safeguards of such external third-party platforms. Any data the User provides to third-party websites is governed entirely by their respective privacy statements, which the User is advised to review independently.

This Privacy Statement does not apply to the extent we Process Personal Data in the role of a Data Processor or service provider, including Personal Data Processed on behalf of our customers when they utilize our products or services.

Definitions

• “Consent”: means a freely given, specific, informed, unconditional, and unambiguous expression of assent by the Data Principal, through a clear affirmative action, signifying agreement to the Processing of their Personal Data for the specified purpose.
• “Data Breach”: means any unauthorized Processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to Personal Data as defined under Section 2(u) of the DPDP Act.
• “Data Fiduciary”: means IIL, which alone or in conjunction with others, determines the purpose and means of Processing Personal Data on the Platform.
• “Data Principal” (synonymous with "User") means the individual to whom the Personal Data relates, and who accesses, browses, or interacts with the Platform, including but not limited to business leads, prospects, clients, job applicants, and visitors.
• “Data Processor”: means any person or entity who Processes Personal Data on behalf of a Data Fiduciary.
• “Data Protection Board of India” or “DPBI”: means the statutory body established under Section 18 of the DPDP Act to adjudicate non-compliances, Data Breaches, and grievances.
• “Legitimate Use”: means the statutory basis under Section 7(a) of the DPDP Act, whereby Personal Data may be Processed if the Data Principal voluntarily provides such Personal Data to the Data Fiduciary for a specific purpose and has not indicated to the Data Fiduciary that they do not Consent to the use of such Personal Data.
• “Personal Data”: mean any data about the User who may be identifiable by or in relation to such data. Unless otherwise stated, and depending on the nature of the User’s interaction with us, the information Processed generally includes the User’s contact details (such as name, title, company, email address or telephone number), the content of the User’s communication with us, information about how the User uses our Platforms, the User’s feedback and interests in our Platforms, and any other publicly available information relevant from a business-to-business perspective. It shall include but is not limited to any data or information about a User from which the User can be identified whether derived from that data on its own or when combined with other data, that we or any other party may hold about the User. In addition, this may include information about the User’s computer and about the User’s visits to and usage of our Platform, such as the User’s internet protocol (IP) address, computer’s operating system (OS) and browser type, and any other ancillary information that may be collected via Cookies.
• “Sensitive Personal Data”: includes financial information, health data, biometric data, or any other data categorized as sensitive under applicable laws.
• “Processing” (including expressions such as “Process”, “Processes”, and “Processed”): in relation to Personal Data, means a wholly or partly automated operation or set of operations performed on Personal Data, and includes operations such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
• Any capitalized terms used in this Privacy Policy but not explicitly defined herein shall have the respective meanings assigned to them under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

Information We Collect

IIL functions primarily as a business-to-business (B2B) informational platform designed to showcase our digital infrastructure, Insurtech and road-side assistance product suites, and automated solutions. We do not actively collect any Personal Data beyond what is essential for general browsing, communication, employment applications, and standard Platform functionality as may be permitted under the applicable laws. Notwithstanding the foregoing, Personal Data may be collected by us in the following circumstances:

We do not collect, store, or Process financial data, proprietary information, or Sensitive Personal Data unless expressly required for a lawful purpose. All Processing activities undertaken by us are in compliance with applicable laws and are based on Legitimate Use or other lawful grounds.

Should we introduce any additional Processing activities in the future, such as marketing initiatives, analytics tracking, behavioural monitoring, the use of non-essential Cookies, or any other Processing requiring explicit User Consent, we shall obtain such Consent in strict adherence to the provisions of the DPDP Act, and other applicable laws.

IIL Processes and stores the Personal Data collected through the Platform primarily within the territory of India. We shall not transfer, transmit, or allow access to the User’s Personal Data outside India, except in strict compliance with Section 16 of the DPDP Act. IIL shall adhere to all blacklists, restrictions, or notifications issued by the Central Government of India from time to time regarding restricted geographic territories.

To the extent permitted by applicable laws, we may receive the User’s Personal Data from third parties authorized to act on the User’s behalf, joint marketing partners, or publicly accessible databases. If the User provides IIL with Personal Data relating to any other individual, the User represents and warrants that he/she possesses the requisite legal authority and has obtained the necessary statutory Consent from such individuals to authorize the Processing of their Personal Data in accordance with this Privacy Policy.

Use of Information Collected

IIL Processes the Personal Data collected through the Platform strictly in connection with its business-to-business (B2B) corporate operations, commercial relationships, and allied enterprise activities. This includes, but is not limited to, the provision, development, and scaling of digital infrastructure, modular Insurtech and road side assistance solutions, enterprise modernization architectures, API integration frameworks, artificial intelligence (AI) and machine learning (ML) optimization suites, predictive analytics models, and corporate recruitment. Furthermore, Personal Data may be Processed to facilitate general business development, manage corporate administration, handle client onboarding, optimize Platform performance, maintain vendor relationships, and support the overall execution of our commercial services and strategic operations. In furtherance of the same, we may Process the Personal Data collected on our Platform for the following Legitimate Uses:

• To evaluate, respond to, and manage commercial inquiries, corporate correspondence, or technical feedback initiated by the User via email, telephonic channels, or the interactive features of the Platform.
• To facilitate and schedule User-requested product demonstrations, sandbox evaluations, or proof-of-concept showcases of our modular digital infrastructure and Insurtech product suites.
• To deliver newsletters, industry whitepapers, research reports, or specialized case studies that the User has explicitly requested or subscribed to on the Platform.
• To evaluate the User’s professional qualifications, experience, credentials, and background when the User applies for careers, internships, or contractual positions with IIL.
• To ensure compliance with legal and regulatory requirements, including responding to lawful requests from authorities.

Cookies and Tracking Technologies

IIL utilizes Cookies (hereinafter referred to as the “Cookies”), web beacons, pixels, and localized tracking technologies on the Platform to maintain system security, optimize performance, and understand basic User interaction. Cookies are small text files containing an identifier that is downloaded to the User’s computer, mobile device, or tablet when the User visits or interacts with certain digital interfaces.

• What are Cookies?

These are utilized to enhance the User’s online experience by saving the User’s preferences while visiting the Platform, and without them, the User may not be able to take full advantage of the features and functionality of the Platform.

Depending on the settings configured on the User’s device, our Platform may collect information through Cookies or similar technologies, including the User’s unique device identifier, mobile device IP address, device operating system details, mobile carrier information, and location data. Such collection is carried out in accordance with industry best practices and applicable data protection laws and is limited to Cookies necessary for the core functionalities of the Platform.

Most web browsers provide the User with the ability to manage Cookies, including options to accept, reject, or delete them. However, disabling necessary Cookies may impair the User’s access to certain essential features of the Platform.

• Classifications of Cookies Utilized
• Essential and Strictly Necessary Cookies: These Cookies are indispensable for the core operation, baseline navigation, security infrastructure, and system stability of the Platform. They assist in authenticating the User, detecting malicious traffic, safeguarding data entry fields, and executing standard Platform functionalities. These Cookies operate automatically upon the User’s visit to the Platform.
• Performance and Analytical Cookies: These Cookies collect aggregated, de-identified, and statistical data regarding how visitors navigate the Platform (e.g., tracking page visit counts, exit links, and error logs). This information is utilized solely to optimize User interfaces, diagnose server issues, and enhance operational efficiency.
• User Control

The User may manage, disable, or remove existing Cookies through the settings and preferences available in their respective web browser or mobile device. Certain browsers may also provide privacy-enhancing tools or extensions designed to restrict Cookie-related activities or tracking technologies. However, disabling or restricting Cookies may affect the functionality, accessibility, or proper display of certain features of the Platform, including the operation of specific links or services. Any such modification to browser settings shall be undertaken at the sole discretion and risk of the User.

Certain internet browsers may further offer a “Do Not Track” or “DNT” feature that enables the User to communicate his/her preference not to have their online activities tracked across websites. However, as there is currently no uniform technological standard or consistent regulatory framework governing the interpretation and implementation of DNT signals, the Platform does not presently respond to or recognize such signals.

We utilize the Cookies solely for the following essential purposes:

• Enhancing Platform Functionality: Ensuring seamless navigation and optimal Platform performance by remembering User preferences where required for operational efficiency.
• Security and Compliance: Maintaining Platform security, detecting fraudulent activities, and ensuring compliance with applicable legal and regulatory frameworks.
• Basic Analytical Insights: Collecting aggregated and anonymized data strictly for internal assessments of Platform performance and User engagement, without enabling extensive tracking or third-party behavioural monitoring.

We do not employ non-essential Cookies, including those for marketing, advertising, or behavioural tracking, without the explicit and informed Consent of the User.

Sharing of Personal Data

IIL values the User’s privacy and, as a baseline corporate practice, does not sell, rent, trade, or disclose without Consent the User’s Personal Data to third parties. We do not publish or make publicly accessible any Personal Data Processed through the Platform. Under limited circumstances, and strictly for Legitimate Use cases, we may share User’s Personal Data as follows:

• With Trusted Third Parties: To facilitate the provision, maintenance, or enhancement of our services, Platform, or solutions, we may share collected Personal Data with our employees, consultants, or authorized agents. These parties are legally and contractually bound to maintain confidentiality and adhere to rigorous data protection standards.
• For Joint Services and Partnerships: Certain products and services may be developed, marketed, or provided through strategic collaborations with other companies. In such instances, Personal Data may be shared on a strict need-to-know basis, ensuring full compliance with applicable data protection laws, including the DPDP Act.
• Legal and regulatory disclosures: We may disclose the User’s Personal Data when required by law, including in response to valid requests from public authorities (e.g., courts, law enforcement agencies, or regulatory bodies). Accordingly, we may share Personal Data or Sensitive Personal Data with Government agencies that are legally mandated to obtain such information for purposes such as identity verification, prevention, detection, investigation (including cyber incidents), prosecution, or punishment of offenses, or where we may believe in good faith that such disclosure is necessary to protect our rights, protect the User’s safety, or the safety of others.
• Intra-Group Transfers and Affiliates: We may share the User’s Personal Data with our corporate affiliates, or subsidiaries where necessary for unified corporate administration, centralized data storage infrastructure, or internal compliance auditing. Any such intra-group data sharing remains subject to the protections and purpose limitations established under this Privacy Policy.
• Corporate Restructurings: In the event that IIL undergoes a structural corporate transition, such as a merger, acquisition, asset sale, corporate reorganization, joint venture, or dissolution, the Personal Data collected through the Platform may be transferred to the successor or acquiring entity as part of the business assets. In such instances, the transitioning Personal Data shall remain fully protected, and the surviving entity shall continue to be bound by the obligations, rights, and conditions set forth in this Privacy Policy.
• Cross-Border Disclosures: Any transmission or disclosure of Personal Data to entities located outside the territory of India shall be executed strictly in accordance with Section 16 of the DPDP Act. IIL shall ensure that no Personal Data sharing is initiated with any third-party entity or cloud infrastructure situated within geographic territories blacklisted or restricted by notifications issued by the Central Government of India.

Our Obligations

We are committed to ensuring the integrity, accuracy, and security of the Personal Data we collect and Process. In pursuit of this commitment, we undertake the following obligations:

• Where the User’s Personal Data is Processed by us to make decisions that materially affect the User as a Data Principal, or where such data is shared with another Data Fiduciary, IIL shall ensure that the data is maintained in an accurate, complete, and consistent manner. We shall facilitate necessary technical workflows to allow the User to exercise his/her statutory rights to correction, completion, and updating of records as detailed in this Privacy Policy.
• We implement appropriate technical, physical, and organizational security measures to protect Personal Data against unauthorized access, Data Breach, alteration, accidental disclosure, acquisition, or destruction. We utilize industry-standard data security frameworks, localized encryption protocols, and network firewalls to fulfil our obligation to prevent Data Breaches.
• In the event of any security incident resulting in a Data Breach that compromises the User’s Personal Data, IIL shall, without undue delay, notify the Data Protection Board of India (DPBI) and each affected Data Principal. Such notification shall be delivered in the form, manner, and statutory timelines prescribed under Section 8(6) of the DPDP Act and the DPDP Rules, 2025.
• The User shall have the right to report grievances related to the Processing of their Personal Data or the exercise of their data protection rights to our Data Protection Officer, as specified in Clause 12.

The User’s Obligations

While interacting with our Platform and exercising data rights, the User shall comply with the following obligations:

• Adhere to all applicable laws, regulations, and policies governing data privacy and security while exercising his/ her data rights.
• Refrain from impersonating others or providing false, misleading, or fraudulent information when providing Personal Data or exercising their rights.
• Provide accurate, complete and up-to-date information, especially for identity verification and authentication purposes.
• Avoid submitting false, unsubstantiated or frivolous grievances or complaints, or data requests.
• Refrain from making repetitive or excessive requests that do not serve a legitimate purpose.
• Not abuse his/her rights under this Privacy Policy to cause disruption or harassment.
• Ensure that any request for Personal Data correction, modification or erasure is based on verifiable information and lawful reasons and supported by sufficient documentation or proof where applicable.
• Not attempt to access, modify, or misuse another User’s Personal Data without proper authorization.
• Take reasonable precautions to protect his/her account credentials and Personal Data, including using strong, unique passwords and keeping them confidential.
• Report any unauthorized access or suspected Data Breach immediately.

Data Security

We strive to maintain organizational, electronic, physical, and procedural safeguards to protect the User’s Personal Data. We have in place protocols, controls and relevant policies, procedures and guidance to maintain these arrangements taking into account the risks associated with the categories of Personal Data and the Processing we undertake. We adhere to SOC 2 compliance standards, which establish rigorous criteria for managing Personal Data based on five key Trust Service Principles:

• Security: We enforce stringent access control mechanisms to protect the Platform's perimeter and core databases. This includes the deployment of advanced network firewalls with strict incoming and outgoing traffic rules, multi-factor authentication (MFA) for all administrative entry points, intrusion detection and prevention systems (IDPS), continuous vulnerability monitoring, and encrypted communication protocols (such as TLS/SSL) for data in transit and rest.
• Privacy: The collection, storage, Processing, and disclosure of the User’s Personal Data are executed in strict conformity with the data minimization and purpose limitation mandates of the DPDP Act and DPDP Rules. We ensure that data lifecycle pathways prevent unauthorized access or systemic function creep, keeping analytical data entirely isolated from other commercial data layers.
• Availability: We strive to ensure that our services remain available in accordance with our contractual commitments and Service Level Agreements (SLAs). This requires the design and implementation of fault-tolerant systems that can handle high loads without compromising performance. We also invest in comprehensive network monitoring systems and have established disaster recovery plans to maintain service availability at all times.
• Confidentiality: In line with this Privacy Policy, we restrict access to confidential information, including Personal Data to authorized personnel only and enforce strict access control policies. We also adhere to the principle of least privilege by granting the User the minimum level of access and permissions required to perform their duties, minimizing exposure to confidential information.
• Processing Integrity: We implement systemic validation checks to ensure that Processing workflows are accurate, complete, authorized, and executed in a timely manner. Our internal Processing systems maintain logs and audit trails to guarantee data integrity across its administrative lifecycle on the Platform.

The User’s Rights

Under the DPDP Act and other applicable laws, the User has the following rights regarding their Personal Data:

• The User has the right to request and obtain from IIL:
• A clear summary of the User’s Personal Data currently being Processed by us, alongside a description of the explicit Processing activities undertaken.
• The identities of all other Data Fiduciaries and Data Processors with whom the User’s Personal Data has been shared, along with a description of the specific data categories disclosed.
• Any other technical or analytical information regarding the nature, duration, and scope of Processing as prescribed under applicable regulations.
• The User maintains the right to ensure the hygiene and accuracy of his/her digital footprint:
• The User may request that IIL correct any inaccurate Personal Data, complete any incomplete records, or update any outdated Personal Data stored within our system.
• The User may request the absolute erasure of his/her Personal Data from our active servers and cloud infrastructure. Upon receiving such a request, IIL shall delete the Personal Data unless its retention is strictly mandated for compliance with an operating statutory law or to fulfil a specified, subsisting lawful purpose.

Where the Processing of the User’s Personal Data is founded the User’s explicit Consent, the User shall maintain the right to withdraw that Consent at any time. Accordingly, the following shall apply:

Upon the valid withdrawal of Consent, IIL shall, within the reasonable timelines prescribed under the DPDP Rules, cease all further Processing of the User’s Personal Data, and ensure its systemic deletion across all internal data structures and engaged third-party Data Processors.

IIL shall not be required to cease Processing or erase Personal Data where its continued retention or Processing is strictly required or authorized under any other statutory law in force within the territory of India.

The User acknowledges that the withdrawal of his/her Consent may render it impossible for us to provide specific features, schedule product demonstrations, respond to the User’s business inquiries, or evaluate the User’s employment applications on the Platform.

• The User’s right to Grievance Redressal
• The User has the right to readily accessible means to register grievances or report non-compliance regarding the Processing of his/her Personal Data. IIL shall investigate and resolve all formal requests or grievances registered with the designated Grievance Officer in an efficient manner, and in any event, within the timelines prescribed under applicable law.
• The User must exhaust our internal grievance redressal mechanism before approaching the Data Protection Board of India or other regulatory authorities.
• The User’s right to Nominate
• The User shall have the right to nominate an individual who shall exercise the User’s data protection rights in the event of the User’s death or incapacity.

Retention of Information and Security

• We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the Legitimate Use, or as may be required by applicable laws. When such Personal Data is no longer necessary, we will take reasonable measures to securely delete or anonymize it to prevent unauthorised access misuse, or disclosure.

We will implement appropriate measures to ensure that Personal Data under our possession or control is either deleted or anonymized within five (5) years or sooner if:

• The purpose for which the Personal Data was collected is no longer served by its retention; and
• Retention of Personal Data is no longer required for compliance with applicable laws or other Legitimate Use.

Notwithstanding the above, we reserve the right to retain, store, and use anonymized and aggregated data for analytical, business, or operational purposes. Once anonymized, such data will no longer be considered Personal Data and may be retained indefinitely for improving our services and business operations.

We implement industry-standard technical, administrative, and organizational security measures, including encryption, secure storage, access controls, and periodic security audits, to protect Personal Data from unauthorized access, alteration, disclosure, or destruction. While we strive to ensure the highest levels of security, the User hereby acknowledges that no system is completely immune from potential risks.

Changes to this Privacy Policy

We reserve the right to update this Privacy Policy from time to time in order to comply with or adapt to legal, technical, or business developments. Any changes will be posted on this page with an updated effective date. Continued use of the Platform following any updates to this Privacy Policy constitutes acceptance of the revised terms. We encourage the User to review this Privacy Policy periodically to stay informed about how we are protecting the User’s information.

Contact Information

If the User has any questions, concerns, or complaints regarding this Privacy Policy or our data practices, please contact our Grievance Officer/ Data Protection Officer:

Address: 101, Baba House, Next to WEH Metro Station, Mathuradas Vasanji Road, Chakala MIDC, Andheri (E), Mumbai - 400093, Maharashtra, India

Email: legal@indicosmic.com

The User is encouraged to reach out via email for prompt assistance at all times.

• Third-Party Links

Our Platform may contain links to third-party websites, applications, or services. These third parties operate independently and may have their own privacy policies governing the collection, Processing, and use of Personal Data. We do not endorse, control, or assume responsibility for the privacy practices, security measures, or content of such Third Party Services.

We strongly encourage the User to review the privacy policies of any Third Party Services, which the User might visit, before providing any Personal Data. Further, we are not liable for any loss or damage which may be incurred by the User as a result of the collection and/or disclosure of information via Third Party Services. We shall not be liable for any disputes arising from or in connection with such transactions between the User and the aforementioned third parties.

Children’s Privacy

Our Platform is not intended for individuals under the age of 18 (the “Minor(s)”). We do not knowingly collect, Process, or store Personal Data from Minors. If we become aware that we have inadvertently collected Personal Data from a Minor, we shall take immediate steps to delete such information in accordance with applicable laws.

We encourage parents and legal guardians to monitor their children’s internet usage and help enforce this Privacy Policy by instructing them never to provide Personal Data on our Platform without permission.

If the User believes that a Minor has provided any Personal Data on our Platform, the User shall contact us promptly through the details provided in this Privacy Policy. Upon verification, we will take necessary measures, including the removal of such information and any associated accounts, as required by law.

Consent to Privacy Policy

By accessing, browsing, or utilizing the Platform, the User acknowledges that he/she have reviewed, understood, and are aware of the terms, data practices, and statutory disclosures outlined in this Privacy Policy. If the User does not agree with, or does not wish to be bound by, the frameworks established herein, the User is advised to cease all access, navigation, and usage of the Platform.

Artificial Intelligence

IIL is committed to using artificial intelligence (AI) responsibly to protect the User’s privacy and ensure transparency. When Processing User’s Personal Data with AI, we follow strict guidelines and ethical standards, ensuring that AI technologies are used to enhance the User’s experience while protecting User privacy in line with IIL’s commitment to use AI responsibly.

Disclaimer

While we are committed to implementing reasonable security measures to protect the User’s Personal Data and privacy, we cannot guarantee absolute security. Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure, and we cannot ensure that the User’s information, including Personal Data, will never be disclosed in ways not described in this Privacy Policy.

By using the Platform, the User acknowledges and accepts the inherent security risks of providing Personal Data online. We shall not be liable for any unauthorized access, hacking, Data Breaches, or other security incidents beyond our reasonable control.

As a User, he/she assumes full responsibility and risk for:

The use of the Platform and the internet in general.

The information the User provides, transmits, or accesses through the Platform.

The User’s conduct on and off the Platform, including interactions with third parties.