Legal

Privacy Policy

BODHITREE MOVEMENT SERVICES PRIVATE LIMITED (including its affiliates)

This Privacy Policy outlines BODHITREE MOVEMENT SERVICES PRIVATE LIMITED's (including its affiliates') approach to privacy to fulfil its obligations under the applicable privacy laws.

Throughout this document, the terms “we”, “us”, “our” & “BodhiTree” refer to BODHITREE MOVEMENT SERVICES PRIVATE LIMITED (including its affiliates). The terms “you”, “your” & “you and/or your child” refer to you as the User of the Platform.

This Privacy Policy applies to all your PERSONAL DATA processed by us, whether in physical or electronic mode. It is meant to help you understand what information we collect, why we collect it, and how you can update, manage, export, and delete your information. Please read this together with our Terms and Conditions.

We are committed to keeping your and your child's Personal Data private and secure. By choosing to visit and/or avail any Services provided by us, you agree to this Privacy Policy. You must be at least 18 years old to register on our site. If you are under 18 years old, registration must be completed by a parent or legal guardian.

1. Personal Data

'Personal Data' means any information that may be used to identify an individual, directly or indirectly, in particular by reference to an identifier, including not limited to, a first and last name, physical address, email address, online identifier or other contact information and/or identity proof documents.

2. Children's Privacy

We need to collect your and your child's Personal Data to provide our services to you and your child. We are committed to protecting the privacy of children who use our sites and applications. Whenever we refer to a "child" in this privacy policy, we mean a child under the age of 13 for US, UK and Singapore users, under the age of 16 for EU users, under the age of 21 Hijri years for UAE users, and under the age of 18 for Malaysian users.

3. US Child Users

If your child is located in the United States of America, we handle their Personal Data in compliance with the Children's Online Privacy Protection Act ("COPPA"). COPPA applies to child users who are under the age of 13. COPPA requires that we receive verifiable parental consent from the child's parent or legal guardian before the collection, use, or disclosure of the child's Personal Data. If you are a parent or guardian and you believe that your child has provided us with Personal Data without your consent, please contact us at support@bodhitree.org.in. We will dispose of that data in accordance with applicable laws and regulations. Parents can always refuse to permit us to collect further Personal Data, request to review their child's Personal Data, or request that we delete from our records the personal data collected from or about their child. To exercise any of these options, please contact us at support@bodhitree.org.in.

4. EU Child Users

If your child is a resident of a Member State of the European Union, we will treat their Personal Data as a child's Personal Data if they are under 16 years of age, and receive consent of the holder of parental responsibility as required for the processing of Personal Data. All residents of the European Union further have certain specific rights granted by the General Data Protection Regulation ("EU-GDPR"). See Annexure A to this privacy policy.

5. UK Child Users

If your child is a resident of the United Kingdom, we will treat their Personal Data as a child's Personal Data if they are under 13 years of age, and receive consent of the holder of parental responsibility as required for the processing of Personal Data. All residents of the United Kingdom further have certain specific rights granted by the General Data Protection Regulation ("UK-GDPR") and Data Protection Act, 2018 ("DPA"). See Annexure B to this privacy policy.

6. Singapore Child Users

If your child is a resident of Singapore, we will treat their Personal Data as a minor's Personal Data if they are under 13 years of age, and require consent of the holder of parental responsibility as required for the processing of Personal Data. If you are a parent or guardian and you believe that your child has provided us with Personal Data without your consent, please contact us at info@bodhitree.org.in. All residents of Singapore further have certain specific rights granted by the Personal Data Protection Act. See Annexure D to this privacy policy.

7. UAE Child Users

If your child is resident in the UAE, we will receive consent of the holder of parental responsibility for obtaining, receiving, collecting, using, sharing, processing and storing the Personal Data of both the individual with parental responsibility and the child in accordance with this privacy policy as amended from time to time.

8. Malaysian Child Users

If your child is a resident of Malaysia, we will treat their Personal Data as a child's Personal Data if they are under 18 years of age, and receive consent of the holder of parental responsibility as required for the processing of Personal Data. Persons whose personal data are processed in Malaysia have certain specific rights granted by the Personal Data Protection Act 2010. See Annexure E to this privacy policy.

9. What Personal Data do we Collect & Process?

Categories of Personal Data that we collect and process are as follows: • From you/your child, we collect demographic & identity data (name, email address, contact number, photograph, location), gender, school name, birth date and year of the child to validate age. • Your child may also choose to provide Personal Data about themselves in the content they post on our website. • From you/your child, we collect financial data (e.g., account, payment details, invoice details). • Online Identifiers and other technical data (e.g. IP address, transaction logs, device details). • Online training sessions are recorded and used for quality audits and Instructor teacher training. • Projects, quizzes, activities, apps developed, performance completed as part of our programs. • If you are an Applicant on the Platform, we collect your name, mobile number, and email address. If you are selected as Instructor, we also collect your demographic data, government identifications, financial data, and educational qualifications.

10. Where do we obtain your Personal Data from?

Most of the Personal Data we process is provided by you directly to us when you (i) register to use our products and/or services including the registration for a free trial; or (ii) when you apply to teach as an Instructor. This also includes Personal Data collected automatically when you use our website and applications. Certain information might be collected automatically as you or the child navigate through the Platform (which may include usage details, IP address, device ID and type, your browser type and language, the operating system, access times, and information collected through cookies, web beacons and other tracking technologies). We do not collect Personal Data from children for the purposes of behavioral advertising. We do not allow third-party behavioral trackers in areas intended to be used by children. We may also receive Personal Data about you from publicly available sources of information.

11. How do we use your Personal Data?

• To verify your identity • To deliver our products and services • To improve our products and services • If you are an Applicant, to evaluate your application to teach on the Platform • If you are onboarded as an Instructor, for background checks and making payments • To perform quality audits and Instructor training • To communicate with you regarding existing products and services • To evaluate, develop and improve our products and services • For market and product analysis and market research • To send you information about our products or services which may be of interest (you may opt out by clicking an "Unsubscribe" link in the footer of each email) • To handle enquiries and complaints • To comply with legal or regulatory requirements • To investigate, prevent, or take action regarding illegal activities or suspected fraud • To publicize, post and display the projects, achievements, and/or apps created by your child on our website or related pages or social media platforms

12. Recording

We reserve the right and you expressly consent to us recording the classes, discussions, processes, events, conversations, feedback, pertaining to our courses, offered online or any other format. Please visit our Terms and Conditions at https://bodhitree.org.in/terms-conditions for more details.

13. Lawful Bases of processing your Personal Data

We process your Personal Data by relying on one or more of the following lawful bases: • You have explicitly agreed to/consented to us processing your Personal Data for a specific reason. • The processing is necessary for the performance of the contract we have with you. • The processing is necessary for compliance with a legal obligation we have. • Where we are able to rely on specific legal provisions. Where the processing is based on your consent, you have the right to withdraw your consent at any point in time. You may withdraw consent by contacting us at the details specified in the 'Contact Us' section below.

14. When do we share your Personal Data with third parties?

We may use third parties in the provision of our products and services to you. You consent to us sharing your Personal Data with such third parties. We have appropriate contracts in place with all such third parties. Reasons for sharing your Personal Data: • To provide you with products or services • Where we have asked for your consent and you have agreed • Where we have a legal obligation to do so • In connection with regulatory reporting, litigation or asserting legal rights With whom your Personal Data may be shared: • Service providers who work for us • Law enforcement authorities, government authorities, courts, regulators • Statutory and regulatory bodies and investigating agencies Online training sessions are recorded and used for quality audits and teacher training. We maintain complete confidentiality of the recordings and under no circumstances will they be accessible to or shared with any third party.

15. Use of Cookies and other Tracking Mechanisms

We may use cookies and other tracking mechanisms on our website. Cookies are small text files placed on your computer by websites that you visit. For EU, UK and Singapore users, cookies are not set until the user specifically opts-in. You may opt-out of cookies at a later date by mailing us at info@bodhitree.org.in. Categories of cookies: • Strictly Necessary Cookies — Needed to run our website, keep it secure and comply with regulations. • Functional Cookies — Allow us to remember information you enter or choices you make. • Performance/Analytics Cookies — Collect information about how visitors use our website. • Marketing Cookies — Help us decide which products, services and offers may be relevant for you. We do not use behavioral advertising cookies in areas intended to be used by child users.

16. How do we secure your and your child's Personal Data?

We are committed to protecting your and your child's Personal Data in our custody. We take reasonable steps to ensure appropriate physical, technical and managerial safeguards are in place to protect Personal Data from unauthorized access, alteration, transmission and deletion. We ensure that third parties who provide services to us take appropriate security measures in line with our policies.

17. How long do we keep your and your child's Personal Data?

We keep the Personal Data we collect about you and your child for as long as it is required for the purposes set out in this Privacy Notice and for legal or regulatory reasons. We will delete your personal information in accordance with applicable laws and no later than 3 (three) years from when we no longer require it for offering our services to you. Please note that we may, from time to time, engage an overseas recipient to provide services to us, such as cloud-based storage solutions.

18. No Sale of Personal Data

We shall not sell any Personal Data of yours and/or the children for the purpose of marketing, advertising, or any other third-party use, except in accordance with express consent obtained from you.

19. Data Security

We always strive to keep your and your child's Personal Data safe. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security as no method of transmission over the Internet is 100% secure. We store your Personal Data in a safe operating environment and it can only be accessed by employees, representatives and service providers on a need-to-use basis. We comply with industry standards and the law to protect your and your child's Personal Data. Payment information adheres to confidentiality and security according to industry standards.

20. Links to other Websites

Our website may contain links to websites of other organizations. This privacy notice does not cover how those organizations process your Personal Data. We encourage you to read the privacy notices on the other websites you visit. During classes or curriculum, the child might be required to access third-party websites. The information the third-party site collects is subject to the third-party site's privacy practices. We encourage you to read the privacy policies of other sites that may collect your personal data.

21. Your Rights

Depending on the jurisdiction in which you are resident, you may enjoy certain rights regarding Personal Data that we process about you: • Access: You have a right to know what personal data we hold about you and to obtain a copy. • Data portability: You have a right to obtain your personal data in machine readable format. • Rectification and erasure: You have a right to have incorrect, unnecessary or outdated personal data deleted or updated. Contact us at info@bodhitree.org.in. • Withdraw your consent: You have a right to withdraw your consent to process your and your child's personal data. • The right to object: You have the right to object to our processing of your Personal Data. • The right of restriction: You have the right to request that we restrict the processing of your Personal Data.

22. Third Party Permission

We disclose Personal Data to third party service providers to enable us to offer our services to you and while accepting these terms, you explicitly grant permission to these service providers to use your Personal Data. We do not disclose Personal Data to third parties for the purpose of allowing them to send marketing material to you. However, we may share non-personal, de-identified or aggregated information with select third parties for research, development, analytics or promotional purposes. In the event of any dispute between the third party and you, the company shall not be held liable in any matter whatsoever.

23. User Communication

You hereby explicitly consent to receive email, telephone, WhatsApp or text messages from us, our subsidiaries, associates, or affiliates, for the purpose of providing alerts and information related to services. Reply 'STOP' on the same number to stop receiving any further SMS. Reply 'HELP' to get help. Standard data charges are applicable for SMS. Please note that this section is not applicable to EU, UK, Australian and Singapore residents.

24. Additional Rights Applicable to EU Residents

Additional rights are applicable to EU residents, which are provided in Annexure A.

25. Additional Rights Applicable to UK Residents

Additional rights are applicable to UK residents, which are provided in Annexure B.

26. Additional Matters for Australian Residents

Additional matters for Australian Residents are provided in Annexure C.

27. Additional Matters for Singapore Residents

Additional matters for Singapore Residents are provided in Annexure D.

28. Additional Matters for Persons Whose Personal Data are Processed in Malaysia

Additional matters for persons whose personal data are processed in Malaysia are provided in Annexure E.

29. Contact Us

For any further queries and complaints related to privacy, or exercising your rights, you could reach us at: Email: info@bodhitree.org.in Organisation: BODHITREE MOVEMENT SERVICES PRIVATE LIMITED Address: Runwal Seagull, Handewadi Road, Hadapsar, Pune 411028 Phone: +91 9370534988

30. Notification of Changes

We regularly review and update our Privacy Notice to ensure it is up-to-date and accurate. Any changes we may make will be in effect immediately after being posted on this page. Your continued use of the Service after any modifications constitutes your acknowledgment of the modifications and your consent to be bound by the modified Privacy Policy.

Annexures

Annexure A — Additional Rights for EU Residents

1. Right of Access

Upon request, You have the right to get confirmation as to whether or not We are processing Your Personal Data, a copy of Your Personal Data and any other additional information as specified by EU-GDPR.

2. Right to Rectification

Upon request, You have the right to get Your inaccurate Personal Data rectified and Your incomplete Personal Data completed.

3. Right to Erasure

Upon request, You have the right to obtain erasure or deletion of Your Personal Data on the grounds specified by EU-GDPR unless an exception applies.

4. Right to Restriction of Processing

Upon request, You have the right to request restriction of processing of Your Personal Data on the grounds specified by EU-GDPR.

5. Right to Data Portability

Upon request, You have the right to receive Your Personal Data in a structured, commonly used and machine-readable format.

6. Right to Object

Upon request, You have the right to object to the processing of Your Personal Data on the grounds specified by EU-GDPR.

7. Right to not be subject to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning You.

8. Right to lodge a complaint with the Supervisory Authority

You have the right to lodge a complaint with a supervisory authority in the Member State of Your habitual residence, place of work or place of an alleged infringement. See https://edpb.europa.eu/about-edpb/board/members_en EU Representative: ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg, Germany. www.eprivacy.eu/en/legal

Annexure B — Additional Rights for UK Residents

1. Right of Access

2. Right to Rectification

Upon request, You have the right to get Your inaccurate Personal Data rectified and Your incomplete Personal Data completed.

3. Right to Erasure

Upon request, You have the right to obtain erasure or deletion of Your Personal Data on the grounds specified by UK-GDPR unless an exception applies.

4. Right to Restriction of Processing

Upon request, You have the right to request restriction of processing of Your Personal Data on the grounds specified by UK-GDPR.

5. Right to Data Portability

Upon request, You have the right to receive Your Personal Data in a structured, commonly used and machine-readable format.

6. Right to Object

Upon request, You have the right to object to the processing of Your Personal Data on the grounds specified by UK-GDPR.

7. Right to not be subject to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling.

8. Right to lodge a complaint with the Supervisory Authority

You have the right to lodge a complaint with the UK Information Commissioner's Office. See https://ico.org.uk/ UK Representative: UK Representative Service for GDPR Ltd., 7 Savoy Court, London WC2R 0EX, United Kingdom. www.eprivacy.eu/en/legal

Annexure C — Additional Matters for Australian Residents

Our Privacy Policy complies with the Australian Privacy Principles ("APPs") under the Privacy Act 1988 (Cth). For users under 15 years of age, parental consent is required to sign up and use our services. We collect and hold your Personal Information in a fair and lawful manner, and not in an intrusive way. We will collect your Personal Information directly from you where reasonably practical. We maintain appropriate physical, procedural and technical security for our offices and information storage facilities so as to prevent any loss, misuse, unauthorised access, disclosure, or modification of Personal Information. We will not disclose your Personal Information to third parties for marketing purposes without your consent. If you do not wish to receive marketing information, you may decline by telephoning us on +91 2248933955 or writing to us at: BODHITREE MOVEMENT SERVICES PRIVATE LIMITED, Runwal Seagull, Handewadi Road, Hadapsar, Pune 411028, Maharashtra, India. For concerns or complaints, contact our Privacy Officer: Telephone: +91 9370534988 Email: info@bodhitree.org.in If dissatisfied, you may contact the Office of the Australian Information Commissioner: GPO Box 5218, Sydney NSW 2001 Telephone: 1300 363 992 Email: enquiries@oaic.gov.au

Annexure D — Additional Matters for Singapore Residents

When you sign up for our services, you will be asked to provide your consent (or parental consent if you are under 13 years of age) to our collection, use and disclosure of your Personal Data. If you have provided us with your consent, we may use your personal data for the purposes of marketing our products and services and those of our strategic partners. You fully understand and unambiguously consent that we may transfer your personal data to any country for the purposes set out in this Privacy Policy. Rights under Singapore's Personal Data Protection Act: • Access: you may ask us if we hold your personal data and request a copy. • Correction: you may request that any incomplete or inaccurate personal data is corrected. • Withdrawal: you may withdraw consent for our use of your personal data. • Portability: you may request the transfer of certain personal data to another party. Contact us at info@bodhitree.org.in to exercise any of your rights.

Annexure E — Additional Matters for Malaysia Residents

When you sign up for our services, you will be asked to provide your consent (or parental consent if you are under 18 years of age) to our collection, use and disclosure of your personal data. You have the right to withdraw your consent for the processing of your personal data at any point in time by contacting us with a written request to the contact details specified in the 'Contact Us' section. You hereby consent that we may transfer your personal data to any country outside of Malaysia for the purposes set out in this Privacy Policy. Where we transfer your personal data outside of Malaysia, we will take all reasonable precautions to ensure the personal data will be processed in accordance with this Privacy Policy and applicable data protection laws.

Last updated: 2024. BodhiTree reserves the right to update this policy at any time.