PRIVACY POLICY

1INTRODUCTION

This Privacy policy is drafted to use of all products, software, services, websites, mobile applications, and related offerings provided by Vayak Private Limited and other group firms ("Vayak", "we", "our", or "us"). Vayak is committed to maintaining strong privacy protections for all data processed through its software products and related services ("Services"). This Privacy Policy is drafted for Vayak to reflect its role as a FinTech ERP provider. In the context of Co-operative Credit Societies, Vayak generally acts as a Data Processor, while the respective Credit Society acts as the Data Controller. This Privacy Policy explains the manner in which information is collected, processed, stored, protected, and handled when Co-operative Credit Societies use Vayak's Offline or Online software and associated financial services. By accessing or using the Services, the Credit Society agrees to this Privacy Policy and consents to the processing of data as described herein.

2INFORMATION PROCESSED

Vayak may process personal and non-personal information strictly on behalf of the Credit Society. As an software service provider, Vayak processes data entered or uploaded by the Society, which may include:

• ▪Member identity details such as name, address, date of birth, Aadhaar, PAN and other government-issued identification
• ▪Contact details including mobile numbers and email addresses
• ▪Financial information such as bank account details, deposits, loans, transactions, balances and share details
• ▪KYC documents required for statutory and regulatory compliance

Additionally, for system security, monitoring and performance optimization, Vayak may collect technical information such as IP address, browser type, access logs, device details and operating system information.

3DATA ROLE: CONTROLLER AND PROCESSOR

The Credit Society shall act as the Data Controller and shall determine the purpose, means, and legality of processing member data. Vayak shall act only as a Data Processor and shall process data strictly in accordance with the instructions of the Society and the applicable Service Agreement. The Credit Society shall be solely responsible for obtaining valid consent from its members prior to uploading, entering, or processing any personal or financial data through the software.

4USE AND SHARING OF INFORMATION

Data processed through the software is used by the Credit Society for operational activities including deposit and loan management, interest calculation, financial transactions, statutory and accounting reports, regulatory compliance, and for providing technical support and troubleshooting services. Vayak does not sell, rent, or trade data. Data may be disclosed only where:

• ▪Required by applicable law, court order, or government authority
• ▪Shared with infrastructure or technology service providers such as cloud hosting, SMS, or API service providers, strictly under confidentiality obligations

5DATA SECURITY MEASURES

Vayak implements reasonable technical and organizational safeguards to protect data from unauthorized access, as far as reasonably possible. The Credit Society acknowledges that the accuracy of data entry is the responsibility of its staff and management. The Society shall maintain regular backups of data stored on its local systems and shall periodically export or print important records for its own reference and safety.

API logs and mobile application data are stored by Vayak only for the duration for which the Society has paid for the service and as required for providing technical support and compliance purposes. After the expiry of the service period, such data may be deleted as per company data retention policy, and Vayak shall not be responsible for data retrieval thereafter.

6DATA RETENTION AND DELETION

Vayak shall retain Society data only for the period during which the Society continues to pay applicable server rent and maintains an active subscription. Upon discontinuation of services due to non-payment, data shall be retained for a maximum period of three (3) months solely to allow the Society to obtain a data export. After expiry of this retention period, all data shall be permanently deleted from Vayak's servers. Vayak shall not be responsible or liable for any data loss, business loss, or financial loss arising from deletion after the retention period, failure of the Society to take backups or exports, or due to technical or infrastructure-related issues.

7USER (MEMBER) RIGHTS

Members of the Credit Society may request access to their personal data or correction of inaccurate records. All such requests shall be made directly to the respective Credit Society. Vayak shall not entertain requests from individual members and shall act only upon instructions received from the Society.

8DATA DISPLAY, BACKUP AND RESPONSIBILITY

Vayak only stores and displays data for Head Office, Branch, Agents, and Members as entered, modified, or deleted by authorized staff of the Society. Vayak does not create, alter, or verify such data independently. Responsibility for correct data entry, regular backups, and maintaining printed or exported copies of important documents lies entirely with the Society. Vayak shall not be responsible for any loss arising due to software issues, hardware failure, web server problems, management decisions, or data entry errors.

9SERVER PERFORMANCE AND FORCE MAJEURE

Server performance and availability depend on various external factors beyond the control of Vayak, including internet connectivity, power supply, hosting infrastructure, and network conditions. Vayak shall not be liable for any loss or interruption caused by server failure, internet issues, technical errors, or force majeure events including fire, flood, earthquake, war, riot, or other unavoidable circumstances. No claim or dispute shall lie against Vayak in such cases.

10DATA ACCURACY, MISMANAGEMENT AND FRAUD

Vayak provides only software services and rent based server space. Accuracy, completeness, and legality of data depend entirely on entries made by the Society's staff as per society management's instructions. Vayak shall not be responsible for any fraud, negligence, internal mismanagement, or unauthorized activity carried out by the Society or its employees, and all legal responsibility shall remain with the Society.

11UNLAWFUL ACTIVITIES AND LEGAL DISCLOSURE

The Society shall not use the Services for any unlawful, fraudulent, or prohibited activities. In the event that any court, regulatory body, or government authority lawfully demands access to data stored on Vayak's servers, such data shall be disclosed as required by law. The Society shall remain solely responsible for compliance, explanations, and legal consequences arising from such disclosure. Vayak shall not be liable for unlawful acts committed by the Society.

12UPDATES TO THIS POLICY

Vayak reserves the right to amend this Privacy Policy from time to time. Any updated policy shall be published on the website or communicated to Credit Societies. Continued use of the Services after such updates shall constitute acceptance of the revised policy.

13GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any dispute, controversy, claim, or legal proceeding arising out of or relating to this Privacy Policy, the use of Vayak's software, applications, APIs, or services, including issues relating to data protection and privacy, shall be subject to the exclusive jurisdiction of the competent courts located in Ahmedabad, Gujarat, India only, and the parties hereby expressly submit to such jurisdiction.