PRIVACY POLICY AS UPDATED ON October 1, 2024

We respect your privacy and care about how your Personal Information is used. This Privacy Policy (the “Policy”) outlines how Hubeco Green Ventures Private Limited (“Company” or "us" or "we" or "our") and its affiliates collect, use, store, process, transfer, and disclose your information through our Platform https://www.hubeco.market (the “Website”), our Services and any of our other websites, mobile or digital applications, or any other services we offer from time to time by or in connection therewith (together “Platform”). It applies to your interactions with and usage of our Platform, involving the sale and purchase of sustainable building materials (the “Services”). By reviewing this Policy, you will gain a comprehensive understanding of your privacy rights and choices.

Your access to or utilization of our Platform and/or Services operated by the Company linked to this Policy implies your agreement to be governed by this Policy. By providing us with your Personal Information, you expressly consent to the use and disclosure of your Personal Information as outlined in this Policy. This Policy, along with the Terms of Use, Terms of Sale, Return, Refund and Cancellation, Delivery and Shipping Policy is applicable to your use of the Services and you explicitly agree and acknowledge to read the Privacy Policy in conjunction with the referenced policies.

The term “Personal Information” shall mean any information that relates to an identified or identifiable individual or entity, and can include information that you provide to us and that we collect about you, such as when you engage with our Services (e.g. device information, IP address).

By utilising the Services, engaging with the Company's Platform, or furnishing your Personal Information, you explicitly agree and acknowledge that you accept the terms delineated in this Policy. The terms 'you' or 'your' in the context of this Policy collectively pertain to any user of our Platform or any individual utilising our Services, whether for personal use or on behalf of others.

By visiting the Platform or providing your information, you expressly agree to be bound by this Privacy Policy and agree to be governed by the privacy laws of India including but not limited to the India Digital Personal Data Protection Act 2023 (DPDPA) and other relevant regulations governing data protection and privacy.

IF YOU DO NOT CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL INFORMATION AS SET FORTH IN THIS PRIVACY POLICY, PLEASE REFRAIN FROM ACCESSING AND/OR USING OUR PLATFORM.

1. TO WHOM DOES THIS POLICY APPLY?

1.1. This Policy is inclusive and applies to all users of our Platform, irrespective of browsing intent or their extent of utilising the Services offered on our Platform.
1.2. The applicability of this Policy extends to users regardless of the device type used for accessing our Platform, whether it be a laptop/desktop or a mobile/tablet device.
1.3. We do not knowingly collect or solicit Personal Information from anyone under the age of eighteen (18) or knowingly allow such persons to register for and/or utilise the Services. If you are under the age of eighteen (18), please do not attempt to register for the Services or send any information about yourself to us. No one under the age of eighteen (18) may provide any Personal Information to us.

2. WHAT IS THE INFORMATION THAT WE COLLECT FROM YOU?

2.1. To use our Platform, you need to create an account and register with us ("Account") and for this purpose, we collect certain Personal Information. This may include but is not limited to the following:
- 2.1.1. Basic Information:
  - 2.1.1.1. B2C Users: You are required to provide basic information such as your name, email, address, and date of birth. Additionally, some of this information will depend on the features you use.
  - 2.1.1.2. B2B Users: You are required to provide basic information such as your name, email, address, date of birth, and company information such as business address, tax details, bank details, PAN number, and other such information based on the Platform’s functionality you use.
- 2.1.2. Professional Information: such as company name, interests related to sustainable construction and eco-friendly practices, and user role categories such as Architect, Manufacturer, Customer, Developer, Interior Designer, Sustainability Consultant, Educational Institution, Student, Contractor, and Others.
- 2.1.3. Transaction data: including without limitation the details of the payment method such as credit/debit card number details and bank account information.
- 2.1.4. Additional Information: includes without limitation, when you communicate with our support team, or provide your address and/or geolocation, or share your experience with us.
- 2.1.5. Communication with us: This can include any communication that you send to us, including communications for any inquiries, payments, technical support, etc.
- 2.1.6. Device Identification data: This includes information that may assist us in identifying your device, including browser type, version, operating system, etc.
- 2.1.7. Other Data: This can include the following, based on your interaction with the Platform and/or Services:
  - a. Number of times you access our Platform and/or Services.
  - b. The length of time you spent on the Platform.
  - c. The period of time from when you became active and have continued to be active on the Platform.
  - d. Your wishlists and preferences.
  - e. Other similar statistics we may collect with the intention to improve the user experience of the Platform.
2.2. You agree to provide us with your Personal Information whenever you use our Services by performing any of the following functions:
- 2.2.1. Accessing our Platform by means of any web browser or any device.
- 2.2.2. Joining our waitlist and expressing interest in our Services on the Platform.
- 2.2.3. Registering for our Services on the Platform.
- 2.2.4. Inquiring about our Services through our Platform.
- 2.2.5. Initiating and maintaining correspondence with us.
2.3. We take extra precautions to ensure that such Personal Information is kept secure and confidential, and we will only retain this data for as long as necessary for the purposes for which we collect it as per the permissible laws of the land.
2.4. This Policy will not apply to any unsolicited information provided by you through the Platform or through any other means. This includes but is not limited to, information posted on any public areas of the Platform. All such unsolicited information shall be deemed to be non-confidential, and we will be free to use and disclose such unsolicited information without limitation.
2.5. We shall not be liable for any loss or damage sustained by you as a result of any disclosure (inadvertent or otherwise) of any Personal Information concerning your credit cards, or debit cards in the course of any online transactions or payments made for any Services offered through the Platform. For this purpose, we recommend that you go through the terms of service of the payment service providers.
2.6. Access to your Personal Information is limited to our employees, agents, partners, and third parties, who we reasonably believe will need that information to enable us to provide Services to you. However, we are not responsible for the confidentiality, security, or distribution of your own Personal Information by our partners and third parties (who have their own privacy policies) outside the scope of our agreement with such partners and third parties.
2.7. When you use our Platform, we collect and store your information, which is provided by you from time to time. In general, you can browse the Platform without telling us who you are or revealing any Personal Information about yourself. Once you give us your Personal Information, you are not anonymous to us. Where possible, we indicate which fields are required and which fields are optional. You always have the option to not provide information by choosing not to use a particular service, product, or feature on the Platform.

3. HOW DO WE COLLECT THE INFORMATION?

3.1. The collection of Personal Information is facilitated through the following ways:
- 3.1.1. Information you give us: When you provide us with the information referred to in Clause 2.1 through the methods outlined in Clause 2.2.
- 3.1.2. Session Management: We study session metrics to understand how users interact with the Platform. This helps us learn the average time users spend on the Platform and when they prefer to engage. We use tools like Google Analytics (or alternatives) to collect anonymous data, including the number of views, how long users stay, and where they're visiting from. This data allows us to optimize the user experience, making informed enhancements to cater to user preferences and behaviours.
- 3.1.3. User analytics: We analyse user behaviour and preferences by collecting and analysing Personal Information and maintaining a track within the Platform to ensure accuracy, promptly identify any unusual behaviour, and detect fraudulent activities, allowing us to take immediate corrective action.
- 3.1.4. In addition to direct user interactions, we leverage cookies and similar technologies to enhance functionality and user experience on the Platform. These allow us to collect and process additional information for various purposes:
  - 3.1.4.1. Cookies: We utilize cookies, which are small text files stored on users' devices. These cookies assist in tracking user preferences, optimising the Platform's functionality, and providing a customised experience. Users have the option to manage cookie preferences through their browser settings. Below are the categories of cookies used on our Platform, along with a description of what they are used for:
    - 3.1.4.1.1. Strictly Necessary Cookies: These cookies are needed to run our Platform, to keep it secure when you are accessing the Platform, and to obey regulations that apply to us. They also help us keep your details safe and private.
    - 3.1.4.1.2. Functional Cookies: These cookies are used for remembering things such as your region or country, your preferred language, accessibility options like large font or high-contrast pages.
    - 3.1.4.1.3. Performance Cookies: These cookies tell us how you and our other users use our Platform. We combine all this data together and study it. This helps us to improve the performance of our Services and/or the Platform.
    - 3.1.4.1.4. Targeting/Advertising Cookies: These cookies are used to deliver content more relevant to you and your interests. They may also be used to limit the number of times you see an advertisement.
  - 3.1.4.2. Purpose of Cookies We Use: We utilise Personal Information obtained through cookies to enhance the speed and security of your interaction with us. These cookies serve various purposes:
    - 3.1.4.2.1. Preferences: Cookies enable the Platform to remember information that alters the site's behaviour or appearance, such as your preferred language or geographic region. By retaining your preferences, we can customise and present advertisements and other content tailored to you.
    - 3.1.4.2.2. Security/Optimization: Cookies play a crucial role in maintaining security by verifying users, preventing fraudulent use of Services, and safeguarding user data from unauthorised access. Specific types of cookies assist in blocking various types of attacks, such as attempts to pilfer content from Platform forms.
    - 3.1.4.2.3. Processing: Cookies contribute to the efficient functioning of the Platform, allowing us to deliver the Services expected by visitors and/or users. These cookies facilitate tasks like navigating web pages and accessing secure sections of the Platform.
    - 3.1.4.2.4. Advertising: We employ cookies to enhance the appeal of advertising to our users. Common uses include selecting advertisements based on relevance, improving campaign performance reporting, and avoiding the repetition of ads you may have already seen. Cookies capture information about your interactions with the Platform, including your most visited pages.
    - 3.1.4.2.5. Communication: Information collected through cookies may be utilised to communicate with you, including sending newsletters, seeking your opinions and feedback, and providing Services and promotional materials.
    - 3.1.4.2.6. Analytics and Research: Cookies aid in comprehending how individuals utilise our Services, enabling us to enhance them for a better user experience. This data-driven insight helps us refine and improve our offerings.
- 3.1.5. Web Beacons, Pixel Tags, and Trackers: We may employ web beacons, pixel tags, and tracking URLs, which are tiny graphic images and/or small blocks of code placed on Platform pages, ads, or in our emails that allow us to determine whether you performed a specific action. When you access these pages or when you open an email, you let us know that you have accessed the web page or opened the email. These tools help us measure responses to our communications and improve our web pages and promotions.
- 3.1.6. Log Files: Our servers automatically collect information sent by Users' devices, known as log files. This data may include IP addresses, device information, browser type, and timestamps. Log files are instrumental in analyzing trends, administering the Platform, and diagnosing technical issues.
- 3.1.7. Third-Party Analytics: We may integrate third-party analytics services to further understand user behaviour. These services utilise their own tracking technologies to compile reports on Platform activity, aiding us in improving our Services.
- 3.1.8. Location Data: As part of our Services, we may also collect precise geolocation data, including GPS signals, device sensors, Wi-Fi access points, and cell tower IDs. We collect this type of data if you grant us access to your location. You can withdraw your consent at any time by disabling the GPS or other location-tracking functions on your device.
- 3.1.9. Information from other sources: We may collect Personal Information from other sources, including but not limited to:
  - 3.1.9.1. If a user or any third party submits a complaint about you, we may receive information relating to the specific complaint made in order to understand and, where relevant, address the complaint.
  - 3.1.9.2. To the extent permitted by applicable law, we may receive additional information about you, such as references, demographic data, and information to help detect fraud and safety issues from (i) third-party service providers, other third parties, and/or partners, or (ii) users and any other individuals, entities, and authorities, and combine it with information we have about you. For example, we may receive background check results or fraud warnings from identity verification service providers for use in our fraud prevention, security investigation, and risk assessment efforts. We may receive information about you and your activities on and off the Platform, including from users, members of the public, or governmental, public, or tax authorities, or about your experiences and interactions with and/or from our partners.

4. WHY DO WE COLLECT YOUR INFORMATION?

4.1. We shall collect your information only for lawful and legally permissible purposes which are as follows:
- 4.1.1. Contractual Necessity: We process your Personal Information to fulfil our contractual obligations to you. This includes actions such as managing orders and delivering Services.
- 4.1.2. User Authentication: We collect your information to help us identify you as and when you access the Platform, when you register an Account with us or log in, or when you utilise our Services.
- 4.1.3. Transactions and Payments: To facilitate secure and efficient payment processing, as well as handle transactions related to Services on the Platform. Personal information is utilised to enable or authorise payment services, including detecting and preventing money laundering, fraud, abuse, and security incidents, complying with legal obligations, enforcing payment policies, and improving payment services.
- 4.1.4. Communicate with you: We use your Personal Information to communicate with you concerning Services via different channels (e.g., by phone, e-mail, chat), including fulfilling your requests or providing you with notices about your Account, or updating you with any news or updates related to the Platform.
- 4.1.5. Fraud Prevention and Credit Risks: We use Personal Information to prevent and detect fraud and abuse to protect the security of our users.
- 4.1.6. Troubleshoot Problems: We use your Personal Information to provide functionality, analyse performance, fix errors, and improve the usability and effectiveness of the Platform and/or Services.
- 4.1.7. Compliance with law: To be able to perform any contractual and legal obligations.
- 4.1.8. Enhancing User Experience: To analyse user behaviour and preferences for improving our Services and user experience and to be able to provide location-specific services.
- 4.1.9. Recommendations and Personalizations: We use your Personal Information to recommend features, products, and Services that might be of interest to you, identify your preferences, and personalise your experience with the Platform and/or Services.
- 4.1.10. Enhanced Advertising and Marketing Efforts: In our efforts to provide, personalise, measure, and enhance our advertising and marketing endeavours, we engage in several key activities. We utilise user information to send promotional and marketing messages, tailoring them to suit individual preferences and interests. We strive to customise and optimise advertising on various platforms to ensure relevance and effectiveness. We also administer referral programs, rewards, surveys, sweepstakes, contests, and other promotional activities to engage users and foster community participation. Through the analysis of user characteristics and preferences, we aim to send targeted promotional messages that resonate with each user segment. Finally, we extend invitations to users for events and relevant opportunities, enriching their overall experience with our Platform.
- 4.1.11. Providing alerts/notifications: To effectively communicate with you through SMS alerts and emails to notify both buyers and vendors about all transactional statuses. Additionally, we will inform you about any new services that we may develop from time to time through notifications on the Platform.

5. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH AND WHY?

5.1. To facilitate our Services and enhance User experience, we may share Personal Information with the following entities:
- 5.1.1. Transactions: We may share payment gateway links with you for making payments for our Services, and to facilitate secure and efficient transaction processing, we may share your Personal Information necessary for transaction processing with such payment gateway service providers.
- 5.1.2. Third-party Service Providers: We engage third parties to carry out various functions on our behalf, such as payment processing, data analysis, postal and email communications, hosting services, customer service, and marketing assistance. These service providers may access the necessary Personal Information to fulfil their functions. They are bound to process Personal Information in compliance with applicable laws. When you interact with these providers, you consent to share your information directly with them, and your use of their services is governed by their respective privacy policies.
- 5.1.3. Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honour this Privacy Policy. Affiliates may include our parent company, subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
- 5.1.4. Business Transfers: If we reorganise or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer your information to the successor entity. You acknowledge that such transfers may occur and that the transferee may decline to honour commitments we made in this Privacy Policy.
- 5.1.5. Legal Compliance:
  - 5.1.5.1.We may disclose your information to courts, law enforcement, governmental or public authorities, tax authorities, authorised third parties, or other users, if and to the extent we are required or permitted to do so by law or where disclosure is reasonably necessary to: (i) comply with our legal obligations, (ii) comply with a valid legal request, such as a subpoena or court order, or to respond to claims asserted against us, (iii) respond to a valid legal request relating to a criminal investigation to address alleged or suspected illegal activity, or to respond to or address any other activity that may expose us, you, or any other of our users to legal or regulatory liability, (iv) enforce and administer our agreements with users, including our Terms of Service, additional legal terms, and policies, (v) respond to requests for or in connection with current or prospective legal claims or legal proceedings concerning the Company and/or third parties, in accordance with applicable law, or (vi) protect the rights, property or personal safety of the Company, its employees, its user, or users of the public
  - 5.1.5.2. Where legally required or permissible, we may disclose user information to relevant tax authorities or governmental agencies for the purpose of compliance with tax obligations.
  - 5.1.5.3. Where appropriate, we may notify the user about legal requests unless providing notice is prohibited or deemed ineffective.
- 5.1.6. Service Improvement: We may share certain aggregated, anonymized information with third parties (e.g., Google Analytics) to assess Platform usage and ease of navigation.
- 5.1.7. Advertisements: We use third-party advertising companies to serve ads when you visit our Platform. These companies may use information about your visits to provide personalised advertisements.
- 5.1.8. Collaborations: We may share your Personal Information with reputable partners to facilitate joint initiatives, promotions, or integrated services.
- 5.1.9. Growth and Expansion: As our business evolves, sharing Personal Information with new entities may be necessary. Any such sharing will be conducted with consideration for user privacy and legal frameworks.
5.2. We do not sell or rent your Personal Information without your express approval.
5.3. We are not responsible for the actions of third parties with whom you share personal or sensitive data, and we have no authority to manage or control third-party solicitations. If you no longer wish to receive communications from third parties, you are responsible for contacting them directly.

6. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

In compliance with applicable laws, we retain your Personal Information for a duration no longer than necessary for the purpose for which it was collected or as mandated by relevant laws. However, certain data may be retained beyond this period if we reasonably believe it is necessary to prevent fraud, mitigate potential abuse, allow us to exercise our legal rights, defend against legal claims, or fulfil other legitimate purposes required by law or for analytical and research purposes. Additionally, we may continue to retain your Personal Information for the following purposes including but not limited to:

Legitimate Business Interest: We may retain your Personal Information as necessary for our legitimate business interests, such as the prevention of money laundering, fraud detection and prevention, and enhancing safety.
Legal, Tax, Reporting, and Auditing Obligations: We may retain and use your Personal Information to comply with our legal, tax, reporting, and auditing obligations.
Shared Information: Information you have shared with others, such as reviews and forum postings, may continue to be publicly visible on the Platform, even after your account is cancelled.
Residual Copies: Because we take measures to protect data from accidental or malicious loss and destruction, residual copies of your Personal Information may not be removed from our backup systems for a limited time.

7. HOW DO WE PROVIDE FOR THE SECURITY OF YOUR PERSONAL INFORMATION WITH US?

7.1. We prioritise the security of your data by utilising secure cloud servers where your Personal Information is encrypted at rest, providing an extra layer of protection against unauthorised access. We adhere to industry best practices by using SSL (Secure Sockets Layer) for all data transfers, ensuring your information remains secure during transmission. Data is also encrypted at rest within our database. We implement reasonable physical, electronic, and procedural safeguards to ensure the confidentiality and integrity of your information. Access to your Account information is facilitated through a secure server, and once in our possession, your data is subject to strict security guidelines to prevent unauthorised access. Further, access to your information is restricted to our internal team members only to maintain confidentiality and security.
7.2. The safety and security of your information also depend on you. If we have given you (or you have chosen) a password for access to certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone and urge you to be careful about giving out information in public areas of the Platform, such as message boards, as this information may be viewed by any user.
7.3. While we take comprehensive measures to safeguard your information, users acknowledge the inherent security implications of data transmission over the Internet. Despite our efforts, complete security cannot be guaranteed, and risks persist. Users are responsible for safeguarding their login and password records. Any transmission of Personal Information is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures on the Platform. While acknowledging these risks, we remain committed to continually enhancing our security protocols to address emerging threats and maintain user trust.

8. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

8.1. You, as a data subject, have certain rights regarding your Personal Information with us, which include:
- 8.1.1. Right to access: You can access the information that you have provided to us, provided that such information has been retained by us on the Platform.
- 8.1.2. Right to withdraw consent: The consent you provide for the collection, use, and disclosure of your Personal Information remains valid until you withdraw it in writing. If you withdraw your consent, we will stop processing the relevant Personal Information, except to the extent that we have other grounds for processing such information under applicable laws. We will respond to your request within a reasonable timeframe. You may withdraw your consent at any time by contacting us.
- 8.1.3. Right to correction: You are responsible for maintaining the accuracy of the information you submit to us, including your contact information provided when filling out forms. If you wish to correct or update any of your Personal Information that we hold, you may contact us at info@hubeco.market. For necessary updates or corrections, users can easily modify details using the provided dashboard functionalities.
- 8.1.4. Right to Nominate: You have the right to nominate another individual to exercise your rights under this Policy on your behalf in the event of your death or incapacity.

10. WHO IS THE DATA CONTROLLER AND DATA PROCESSOR OF YOUR PERSONAL INFORMATION?

10.1. Hubeco Green Ventures Private Limited will act as the data controller where we make decisions on how your Personal Information is used in connection with the Platform or our Services. We will act as the data processor where we only use your Personal Information as authorized and instructed by a third party in connection with the website, or our applications or services.
10.2. Where we are acting as the data controller, we are responsible for the obligations of a data controller under data protection laws in connection with the processing of your Personal Information and we use this Privacy Policy to provide you with information about our use of your Personal Information.
10.3. Where we are acting as a data processor, the relevant third party will be acting as a data controller and will be responsible for the obligations of a data controller under data protection laws in connection with the processing of your Personal Information. If you are accessing the Platform, or our Services through a third party, you should contact them with queries regarding the processing of your Personal Information or compliance with data protection law.
10.4. You understand and acknowledge that Hubeco Green Ventures Private Limited is the controller for the processing of your Personal Information. Our contact information is:

Address: H NO: 8-2-293/F-II/A/20A, Filmnagar, Jubilee Hills, Shaikpet, Hyderabad, Telangana, India, 500033

Email: info@hubeco.market

11. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

11.1. You, as a data subject, may have certain rights to your Personal Information with us, as under:
- 11.1.1. Request access to your Personal Information: This allows you to receive a copy of the Personal Information we hold about you, and to check that we are lawfully processing it.
- 11.1.2. Request the correction of your Personal Information: This allows you to ask for any incomplete or inaccurate information we hold about you to be corrected.
- 11.1.3. Request the erasure of your Personal Information: This allows you to ask us to delete or remove your Personal Information from our systems where there is no good reason for us to continue processing it.
- 11.1.4. Object to the processing of your Personal Information: This allows you to object to our processing of your Personal Information for a specific purpose (for example, for marketing purposes).
- 11.1.5. Request the transfer (data portability) of your Personal Information: This allows you to request the transfer of your Personal Information in a structured, commonly used, machine-readable format, either to you or to a third party designated by you and, if technically feasible, have it transmitted to another controller without any hindrance. This provision is applicable provided that your information is processed by automated means and that the processing is based on your consent, on a contract of which you are part of, or on pre-contractual obligations thereof.
- 11.1.6. Request the restriction: You have the right to request the restriction of processing of your Personal Information. This means we will store your Personal Information but not further process it, except in limited circumstances (e.g., with your consent or for legal claims).
- 11.1.7. Request further information on the processing of your Personal Information: You have the right to obtain further information on how we process your Personal Information. This includes details about the purposes of the processing, the categories of Personal Information involved, the recipients or categories of recipients with whom the Personal Information has been or will be shared, and the envisaged retention period of the Personal Information.
- 11.1.8. Withdraw your Consent: This right only exists where we are relying on your consent to process your Personal Information. If you withdraw your consent, we may not be able to provide you with access to certain features of our Platform. We will advise you if this is the case at the time you withdraw your Consent.