Data Fiduciary / Entity: M/s. Krispire Solutions LLP (LLPIN: ACM-8122)

Platform: https://krispire.com and associated subdomains (including *.krispire.cloud and LumosCRM)

STATUTORY COMPLIANCE MANDATE

THIS PRIVACY POLICY AND DATA PROTECTION NOTICE ("PRIVACY POLICY") IS PUBLISHED IN COMPLIANCE WITH:

1. THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 (ACT NO. 22 OF 2023) ("DPDP ACT, 2023") AND RULES FRAMED THEREUNDER (INCLUDING SECTION 5 NOTICE OBLIGATIONS, SECTION 6 CONSENT STANDARDS, AND SECTIONS 11–14 DATA PRINCIPAL RIGHTS);
2. SECTION 43A AND SECTION 72A OF THE INFORMATION TECHNOLOGY ACT, 2000 ("IT ACT"), READ WITH THE INFORMATION TECHNOLOGY (REASONABLE SECURITY PRACTICES AND PROCEDURES AND SENSITIVE PERSONAL DATA OR INFORMATION) RULES, 2011 ("SPDI RULES, 2011");
3. RULE 3(1)(a) AND RULE 3(2) OF THE INFORMATION TECHNOLOGY (INTERMEDIARY GUIDELINES AND DIGITAL MEDIA ETHICS CODE) RULES, 2021; AND
4. APPLICABLE CYBERSECURITY DIRECTIONS ISSUED BY THE INDIAN COMPUTER EMERGENCY RESPONSE TEAM ("CERT-IN") UNDER SECTION 70B(6) OF THE INFORMATION TECHNOLOGY ACT, 2000.

Notice Language Availability (Section 5(3) of the DPDP Act, 2023): In accordance with Section 5(3) of the Digital Personal Data Protection Act, 2023, Data Principals have the right to access the contents of this Privacy Notice in English or in any of the twenty-two (22) languages specified in the Eighth Schedule to the Constitution of India. To request a translated copy of this Notice in an Eighth Schedule language, please write to our Grievance Officer at admin@krispire.com.

1. INTRODUCTION, IDENTITY OF DATA FIDUCIARY, AND SCOPE

1.1 Who We Are: M/s. Krispire Solutions LLP ("Krispire", "we", "us", or "our") is a Limited Liability Partnership incorporated under the Limited Liability Partnership Act, 2008 on March 19, 2025, bearing LLP Identification Number (LLPIN) ACM-8122, with its Registered Office at Unit No. 309, 3rd Floor, Tower-A, SAS Tower, Support Area, Medicity, Sector-38, Gurugram (Gurgaon), Haryana – 122001, India. Krispire provides enterprise technology services—spanning Cloud & Infrastructure modernization, Data & Applied AI, Application Engineering, and Cybersecurity & Trust—as well as proprietary software products including LumosCRM.

1.2 Dual-Role Privacy Architecture (Data Fiduciary vs. Data Processor): This Privacy Policy is structured into three distinct parts to reflect Krispire's legal capacity depending on the nature of the interaction:

• PART I — Krispire as a "Data Fiduciary" (Controller): Applies when Krispire determines the purpose and means of processing personal data of website visitors on https://krispire.com, prospective B2B clients, individuals booking working sessions, product subscribers, vendor/partner personnel, and job applicants.
• PART II — Krispire as a "Data Processor" ("Service Data"): Applies when enterprise clients entrust personal data or operational datasets to Krispire in the course of custom software development, cloud migrations, AI model governance, GRC integrations, or hosted SaaS deployments (such as LumosCRM and *.krispire.cloud).
• PART III — General Statutory Provisions: Applies across both Parts I and II, covering technical security safeguards, cross-border data transfers, children's privacy in EdTech engagements, retention schedules, and statutory Grievance Redressal.

PART I: INFORMATION KRISPIRE COLLECTS AND CONTROLS AS A DATA FIDUCIARY

2. CATEGORIES OF PERSONAL DATA COLLECTED (SECTION 5 NOTICE)

In accordance with Section 5(1)(i) of the DPDP Act, 2023 and Rule 4 of the SPDI Rules, 2011, we collect and process only the minimum Personal Data necessary for specified, lawful business purposes:

Note on Sensitive Personal Data or Information ("SPDI"): Under the SPDI Rules, 2011, SPDI includes passwords, financial account details, health conditions, biometric data, and sexual orientation. Krispire does not intentionally collect SPDI from website visitors on https://krispire.com. Where authentication passwords are created for LumosCRM or staging portals, they are stored strictly in salted, cryptographically hashed form.

3. SPECIFIED PURPOSES AND LAWFUL BASIS OF PROCESSING (SECTIONS 4, 6 & 7, DPDP ACT)

Pursuant to Section 4 of the DPDP Act, 2023, Krispire processes your Personal Data solely for a lawful purpose: (a) for which you have given your free, specific, informed, unconditional, and unambiguous consent with a clear affirmative action (Section 6(1)), or (b) for Certain Legitimate Uses permitted under Section 7 of the DPDP Act, 2023 (such as where you voluntarily provide your Personal Data to us for scheduling an engineering consultation, or for performance of a legal obligation or employment purpose). Specifically, we process Personal Data to:

1. Respond to Technical Inquiries & Deliver Proposals: Evaluate your engineering requirements, schedule working sessions with domain engineers, and prepare bespoke software development proposals, SOWs, and architecture assessments.
2. Execute & Administer Contracts: Perform our obligations under executed MSAs, SOWs, NDAs, and SaaS subscriptions, including provisioning accounts on LumosCRM and *.krispire.cloud, managing source-code repositories, and delivering GRC migration evidence.
3. Billing, Accounting & Statutory Filings: Issue GST-compliant invoices, process payments via authorized payment gateways, reconcile TDS, and comply with statutory audit and tax mandates under the Income-tax Act, 1961, the Central Goods and Services Tax Act, 2017, and the Limited Liability Partnership Act, 2008.
4. Platform Security, Fraud Prevention & CERT-In Compliance: Monitor system health, detect and prevent unauthorized access, DDoS attacks, spam, or fraudulent transactions, and maintain mandatory ICT system logs as required by CERT-In Directions.
5. Client Communications & Service Updates: Send essential transactional notices, security advisories, deployment window alerts, and policy updates. Where you have opted in to receive technical insights or product announcements, you may opt out at any time via the unsubscribe mechanism or by emailing admin@krispire.com.
6. Recruitment & Human Resources: Evaluate job applications, verify candidate credentials, and onboard selected engineers and consultants.

4. COOKIES AND TRACKING TECHNOLOGIES

• Strictly Necessary Cookies: Required for core website operation, security, route caching, and session integrity on https://krispire.com and *.krispire.cloud. These do not store personally identifiable marketing profiles.
• Functional & Preference Cookies: Remember user choices such as language or region settings.
• Performance & Analytics Telemetry: Collect aggregated, de-identified metrics regarding page load performance and navigation paths to improve engineering reliability.
• No Monetization or Ad-Brokerage: Krispire never sells, rents, or trades your Personal Data to data brokers or third-party advertising networks. You may configure your browser settings to block or delete non-essential cookies at any time.

PART II: INFORMATION KRISPIRE PROCESSES ON BEHALF OF CLIENTS ("SERVICE DATA")

5. ENTERPRISE CLIENT ENGAGEMENTS AND SAAS DEPLOYMENTS

5.1 Role as Data Processor: When Krispire modernizes mission-critical estates, migrates databases, builds custom ERPs or marketplaces (such as peer-to-peer platforms, FinTech portals, EdTech scholarship suites, Luxury concierge systems, or Spiritual/community platforms), or hosts client workspaces on LumosCRM (*.krispire.cloud), Krispire acts as a Data Processor (as defined under Section 2(k) of the DPDP Act, 2023) on behalf of the enterprise Client (the Data Fiduciary).

5.2 Processor Commitments (Section 8(2), DPDP Act, 2023): With respect to all Client Service Data:

• (a) Client Ownership: The Client retains full ownership and control over its Service Data;
• (b) Instruction-Bound Processing: Krispire processes Service Data strictly in accordance with the Client's documented instructions set forth in the applicable MSA, SOW, or Data Processing Addendum ("DPA"), and never uses Client Service Data for unrelated commercial profiling or to train public foundation AI models;
• (c) Need-to-Know Access & Named Owners: Access to production or staging Service Data is restricted strictly to named Krispire engineers assigned to the programme who are bound by written confidentiality obligations; and
• (d) Return or Deletion Upon Handover: Upon completion of handover or termination of a SaaS subscription, Krispire shall return or permanently erase all Client Service Data from active staging/hosting environments within the timeframe stipulated in the MSA/DPA (and purge encrypted backups within ninety (90) days thereafter), unless retention is mandated by Applicable Law.

5.3 End-User Data Principal Requests in Client Platforms: If you are an end-user, customer, student, donor, or employee of one of Krispire's enterprise Clients and wish to exercise your statutory rights regarding data controlled by that Client, please submit your request directly to the respective Client (the Data Fiduciary). Where a request is received by Krispire directly, we will promptly forward it to the relevant Client and assist them in fulfilling the request in accordance with our DPA.

PART III: GENERAL STATUTORY PROVISIONS

6. STATUTORY RIGHTS AND DUTIES OF DATA PRINCIPALS (DPDP ACT, 2023)

If you are a Data Principal (an individual to whom the Personal Data relates) whose Personal Data is processed by Krispire as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, you are entitled to exercise the following statutory rights free of charge:

1. Right to Access Information about Personal Data (Section 11): You have the right to obtain from Krispire:
2. • (a) A summary of the Personal Data which is being processed by us and the processing activities undertaken with respect to such Personal Data;
   • (b) The identities of all other Data Fiduciaries and Data Processors with whom the Personal Data has been shared by us, along with a description of the Personal Data so shared; and
   • (c) Any other information related to your Personal Data and its processing as may be prescribed by the Central Government.
2. Right to Correction, Completion, Updating, and Erasure (Section 12): You have the right to request that Krispire:
3. • (a) Correct inaccurate or misleading Personal Data;
   • (b) Complete incomplete Personal Data;
   • (c) Update your Personal Data; and
   • (d) Erase your Personal Data that is no longer necessary for the specified purpose for which it was processed (unless retention is necessary for compliance with any law in force in India).
3. Right to Withdraw Consent (Section 6(4) & Section 6(7)): Where processing is based on your consent, you have the right to withdraw your consent at any time, with the ease of doing so being comparable to the ease with which such consent was granted. You may withdraw consent by emailing admin@krispire.com or through a registered Consent Manager accountable to you under the DPDP Act, 2023. Withdrawal of consent shall not affect the lawfulness of processing of your Personal Data based on consent before its withdrawal. Upon withdrawal, Krispire and its Data Processors shall cease processing your Personal Data within a reasonable time, unless processing without consent is required or authorized under law.
4. Right of Grievance Redressal (Section 13): You have the right to have readily available means of grievance redressal provided by Krispire in respect of any act or omission regarding the performance of our obligations in relation to your Personal Data or the exercise of your rights under the DPDP Act, 2023.
5. Right to Nominate (Section 14): You have the right to nominate any other individual who shall, in the event of your death or incapacity (due to unsoundness of mind or infirmity of body), exercise your rights as a Data Principal in accordance with the provisions of the DPDP Act, 2023 and the rules made thereunder.

Statutory Duties of Data Principals (Section 15 of the DPDP Act, 2023): Under Section 15 of the DPDP Act, 2023, Data Principals are under a statutory duty to: (a) comply with all applicable laws while exercising rights under the Act; (b) not impersonate another person while providing Personal Data; (c) not suppress any material information while providing Personal Data for any document or identity proof; (d) not register a false or frivolous grievance or complaint with Krispire or the Data Protection Board of India; and (e) furnish only verifiably authentic information when exercising the right to correction or erasure.

7. PROTECTION OF CHILDREN'S PERSONAL DATA (SECTION 9, DPDP ACT, 2023)

7.1 General B2B Website Policy: Krispire's corporate website (https://krispire.com) is directed at enterprise decision-makers, engineers, and commercial organizations, and is not intended for children under the age of eighteen (18) years (the statutory threshold for a "Child" under Section 2(f) of the DPDP Act, 2023).

7.2 EdTech & Minor-Facing Client Platforms (Section 9 Compliance): Where Krispire engineers or operates learning and scholarship platforms in the EdTech vertical or community platforms where end-users may include individuals under eighteen (18) years of age (or persons with disability who have a lawful guardian):

• (a) Verifiable Parental Consent: Before processing any Personal Data of a Child or a person with disability, verifiable consent of the parent or lawful guardian shall be obtained in the manner prescribed under Section 9(1) of the DPDP Act, 2023 and the rules made thereunder;
• (b) No Detrimental Processing: Krispire shall not undertake any processing of Personal Data that is likely to cause any detrimental effect on the well-being of a Child (Section 9(2)); and
• (c) Strict Prohibition on Tracking & Targeted Advertising: Neither Krispire nor any platform engineered by Krispire shall undertake tracking or behavioral monitoring of children or targeted advertising directed at children (Section 9(3)).

If you are a parent or guardian and believe that a child under eighteen (18) years of age has submitted Personal Data to https://krispire.com without verifiable parental consent, please contact us immediately at admin@krispire.com so we can purge such data forthwith.

8. DATA SHARING, SUB-PROCESSORS, AND CROSS-BORDER TRANSFERS

8.1 Disclosure of Personal Data: We do not sell your Personal Data. We disclose Personal Data strictly on a need-to-know basis to the following categories of recipients under binding confidentiality and data protection obligations:

• Authorized Personnel & Designated Partners: Engineers, project managers, and Designated Partners of Krispire Solutions LLP bound by strict NDA and internal security controls.
• Trusted Cloud Infrastructure & SaaS Sub-Processors: Vetted third-party infrastructure and operational service providers that assist us in hosting and operating our business, including cloud hosting and edge deployment providers, source-code management systems, customer relationship management and productivity platforms, and RBI/PCI-DSS compliant payment processors.
• Professional Advisors & Auditors: Chartered Accountants, Company Secretaries, legal counsel, and security auditors bound by professional confidentiality.
• Government, Regulatory & Law Enforcement Authorities: Where disclosure is mandated by law, court order, arbitral tribunal direction, tax authority, sector regulator, or CERT-In pursuant to valid legal process under Indian law.

8.2 Cross-Border Transfers of Personal Data (Section 16, DPDP Act, 2023): In connection with global cloud infrastructure, international client engagements, or sub-processors located outside India, Personal Data may be transferred to and processed in jurisdictions outside the territory of India. In accordance with Section 16 of the DPDP Act, 2023 and Rule 7 of the SPDI Rules, 2011:

• (a) Krispire shall not transfer Personal Data to any country or territory outside India that has been restricted by notification of the Central Government of India under Section 16(1) of the DPDP Act, 2023;
• (b) Where Indian sector-specific laws (such as Reserve Bank of India (RBI) directives on Storage of Payment System Data for FinTech clients) mandate strict data localization within India, Krispire architectures and maintains such regulated datasets exclusively within Indian data centers in accordance with the Client's SOW; and
• (c) All international transfers to sub-processors are governed by binding Data Processing Agreements ensuring a level of data security commensurate with Indian statutory standards.

9. REASONABLE SECURITY SAFEGUARDS AND BREACH NOTIFICATION

9.1 Technical and Organizational Security (Section 8(5), DPDP Act & Rule 8, SPDI Rules): Krispire treats security and compliance as an architectural decision made upfront. We implement reasonable security safeguards aligned with ISO/IEC 27001 principles to prevent personal data breaches, including:

• Encryption of data in transit using TLS 1.2 / TLS 1.3 and encryption at rest (AES-256) across cloud databases;
• Strict Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), and protected long-lived version-control branch hierarchies (main and development restricted to Project Managers and higher authorities);
• Isolated staging and production environments with pre-verified rollback plans and named engineering owners; and
• Regular vulnerability assessments, dependency audits, and code reviews prior to deployment.

9.2 Personal Data Breach Notification (Section 8(6), DPDP Act & CERT-In Directions): In the event of any confirmed Personal Data Breach or reportable cybersecurity incident:

• (a) Krispire shall notify the Data Protection Board of India ("DPBI") and each affected Data Principal in the form and manner prescribed under Section 8(6) of the DPDP Act, 2023 and the rules framed thereunder;
• (b) Where the incident falls within the mandatory reporting categories under the CERT-In Directions dated April 28, 2022, Krispire shall report the cybersecurity incident to CERT-In within six (6) hours of noticing such incident or being brought to notice about such incident; and
• (c) Where Krispire acts as a Data Processor for an enterprise Client, Krispire shall notify the Client without undue delay in accordance with the executed MSA/DPA.

10. DATA RETENTION AND ERASURE SCHEDULE (SECTION 8(7), DPDP ACT)

Pursuant to Section 8(7) of the DPDP Act, 2023, Krispire retains Personal Data only for as long as it is reasonable to assume that the specified purpose for which such Personal Data was collected is being served, or as required for compliance with any law in force in India:

Upon expiration of the applicable retention period or upon valid withdrawal of consent, Krispire shall permanently erase or irreversibly anonymize the Personal Data (and cause its Data Processors to erase such data).

11. GRIEVANCE REDRESSAL MECHANISM AND DATA PROTECTION OFFICER CONTACT

11.1 Designated Grievance Officer (Section 8(10) & Section 13, DPDP Act, 2023; Rule 5(9), SPDI Rules, 2011): To exercise any of your statutory Data Principal rights (Access, Correction, Erasure, Consent Withdrawal, or Nomination), or to report a privacy question, concern, or grievance, please contact our designated Grievance address:

11.2 Statutory Response Timelines:

• Acknowledgement: Within twenty-four (24) hours of receipt of your written request or grievance.
• Resolution & Disposal: Within fifteen (15) days (under IT Rules, 2021) and in no event later than thirty (30) days (under SPDI Rules, 2011 and DPDP Act, 2023) from the date of receipt of the grievance.

11.3 Right to Approach the Data Protection Board of India (Section 13(3), DPDP Act, 2023): Pursuant to Section 13(3) of the DPDP Act, 2023, Data Principals shall exhaust the opportunity of redressing their grievance with Krispire's Grievance Officer under Section 13(1)-(2) before approaching the Data Protection Board of India ("DPBI"). If you are not satisfied with the resolution provided by our Grievance Officer, or if you do not receive a response within the prescribed statutory timeline, you have the statutory right to lodge a complaint with the Data Protection Board of India in accordance with the procedure prescribed under the DPDP Act, 2023.

12. UPDATES TO THIS PRIVACY POLICY

Krispire may periodically update this Privacy Policy to reflect changes in our engineering practices, product offerings (such as LumosCRM), or notifications issued by the Ministry of Electronics and Information Technology ("MeitY") under the DPDP Act, 2023. Any material updates will be published at https://krispire.com/privacy with an updated effective date, and where required by the DPDP Act, 2023, communicated to registered Data Principals via email notice.