Graphy Privacy Policy

Last updated: September 09, 2021

I.GENERAL PRIVACY TERMS

This Privacy Policy (the “Policy”) describes the policies and procedures of Sorting Hat Technologies Private Limited and Graphy Inc.  (collectively referred to as “Graphy”, also collectively referred to as “We” “Us” and “Our”) regarding the collection, use and disclosure of Your information when You use the Platform, the practices that We apply to Your information, and Your privacy rights and choices regarding Your information.

We are committed to protecting Your privacy. Only authorized representatives of Graphy and on a need-to-know basis use any information received from You and as consented by You. We constantly review our systems and data to secure Your Personal Information (defined below). In the event of any identified unauthorized use or disclosure of information or upon Your complaint, we will investigate any such complaint or such actions with a view to prosecuting and/or taking civil proceedings to recover damages against those responsible. If You do not agree with any provisions of this Policy, Terms of Use or any other rules, policies or guidelines published on the Platform as applicable to You, then, You should not access or use the Platform or engage in communications with Us and are required to leave the Platform immediately. By accessing and using the Platform, providing Your Personal Information, or by otherwise signalling Your agreement when the option is presented to You, You consent to the collection, use, and disclosure of information described in this Policy and Terms of Use and Graphy disclaims all the liabilities arising therefrom.

If any information You have provided or uploaded on the Platform violates the terms of this Policy or Terms of Use, Graphy may be required to delete such information upon informing You of the same and revoke Your access if required.

Capitalized terms used but not defined in this Privacy Policy can be found in our Terms of Use.

Please read this Privacy Policy carefully prior to accessing our Platform and using the Services. If you have any questions, please contact us at: privacy@graphy.com

A.      APPLICABILITY

This Policy applies to all Users of the Platform. For the purposes of this Policy, the terms “User”, “You”, or “Your” shall refer to any user of the Platform and includes all Creators and Learners.  

By submitting Personal Information, You are consenting to the collection, use and processing of such information in accordance with this Policy. If You have inadvertently submitted any Personal Information to Graphy prior to reading this Policy statements set out herein, or You do not agree with the manner in which the Personal Information is collected, stored or used, then You may access, modify and delete all information stored about You by deleting your account or by writing to us at support@graphy.com. Graphy is keeping Personal Information of the User, and every User is also entitled to require Graphy to delete and destroy all such information (but not that of other Users).

This Policy only applies to the Platform and any other services that are owned and operated by Graphy. Third party websites may place their own cookies or other files on the User’s computer or device, collect data or solicit Personal Information from the Users.  Any Personal Information provided by You or automatically collected from You by a third party will be governed by that third party’s privacy policy and terms of use, for which Graphy is not responsible or liable. Accordingly, Graphy does not make any representations concerning the privacy practices or policies of such third parties or terms of use of such websites, nor does Graphy guarantee the accuracy, integrity, or quality of the information, data, text, software, sound, photographs, graphics, videos, messages, or other materials available on such third-party websites. The inclusion or exclusion of any third-party website does not imply any endorsement by Graphy of such website, the website's provider, or the information on the website. Graphy encourages the User to read the privacy policies of each such website and the User understands that its solely such third party who is responsible to the User in this regard.

Graphy has taken reasonable precautions as per applicable laws and implemented industry standards to treat Personal Information as confidential and to protect it from unauthorized access, improper use or disclosure, deletion, modification and unlawful destruction or accidental loss of the Personal Information.  However, the safety and security of Your Personal Information also depends upon You.  Where You use a password for access to the required parts of the Platform, You are responsible for keeping Your password confidential.  Do not share Your password with anyone. 

B.     PROCESSORS AND CONTROLLERS

Graphy is the controller of Personal Information that it collects and processes in connection with the use of the Platform and the provision of the Services on the Platform. The kind of Personal Information we collect in connection with such use is detailed below.

When it comes to the Content that is uploaded, submitted, or otherwise provided to the Platform by the Creators, known as “Creator Data”, such Creators are the controllers with respect to any Personal Information included in the Creator Data. Graphy only acts as a processor in this case and processes the Creator Data on behalf of the Creator.

When a Learner enrols to purchase any Creator’s Content, Graphy will provide the Creator access to a limited set of Personal Information about such Learner to enable the Creator to provide their services to the Learner. We clarify that in respect of the Learners' Personal Information, Graphy shall remain the controller of the Personal Information collected, processed and stored on the Platform as stated hereunder, however, any Personal Information processed and stored by the Creator outside the purview of the Platform shall be the sole responsibility of the Creator.

You as a Creator acknowledge and agree that You are responsible for complying with all applicable laws and regulations related to the protection of Personal Information for which You are the controller or the processor. If You are a Learner whose Personal Information has been processed or stored by a Creator, please contact the Creator directly and view the Creator’s privacy policy to understand how the Creator uses Your Personal Information.

C.ACCESS

Users are allowed to access and view the Platform as a guest and without creating an account on the Platform or providing any Personal Information, Graphy takes no responsibility or validate the information provided by the guest, except as otherwise required under any law, regulation or an order of competent authority. However, to have access to all the features and benefits on our Platform, a User is required to first create an account on our Platform. To create an account, a User is required to provide Personal Information as may be required during the time of registration. Other information requested on the registration page, including the ability to receive promotional offers from Graphy, is optional. Graphy may, in future, include other optional requests for information from the User to help Graphy to customize the Platform to deliver personalized information to the User. Graphy may keep records of telephone calls received and made for making enquiries, registered courses, feedback, or other purposes for the purpose of rendering services effectively and efficiently.

D.     PERSONAL INFORMATION

“Personal Information” shall mean the information which identifies the User i.e., first and last name, identification number, email address, age, gender, location, photograph and/or phone number provided to Graphy at the time of registration or any time thereafter. Personal Information may include “sensitive personal information or data” as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) and in context of this Policy, includes passwords provided by You during registration.

We request You to not provide us with any Personal Information unless specifically requested by Us. In the event You share with us any Personal Information without us having specifically requested for the same, then we bear no liability to such Personal Information provided by You.

E.Information we collect

We only collect information about You if we have a reason to do so — for example, to provide our Services on the Platform, to communicate with You, or to make our Services better.

We collect this information from the following three sources:

1. Information we collect from You:

(a). Basic account information: In order to access certain features of the Platform, You will need to create an account and register with Us.  We ask for basic information which may include Your name, an email address, country, and password, along with a username and mobile number (optional). 

(b). Public profile information: If You create an account with us, we also collect the information that You provide for Your public profile on the Platform viz., Your username is part of that public profile, along with any other information you may put into your public profile, like an “About Me” description; we may also give You an option to upload Your photo and include links of Your social media & YouTube channels, websites, blogs, etc. Your public profile information is, as the word suggests, ‘public’, so please keep that in mind when deciding what information You would like to include.

The above information is collected so You can personalize Your new account, provide You access to the Platform, and We can send You notifications, updates, or other essential information. We do not sell Your Personal Information to third parties, and we do not use Your name or name of Your company in marketing statements without Your consent. Further, if You are a Creator, we do not contact or solicit Your Learners/members directly and any correspondence with Your Learners will strictly be in relation to the Platform, its access or any issue they may want resolved in connection with the Platform.

(c).  Communication with us: When You write to Us with a question or to ask for help, We will keep that correspondence, and the email address, for future reference. When You browse pages on our Platform, we will track that for statistical purposes which may be to improve the Platform or offerings. You may also provide us with information when you respond to surveys or when you otherwise communicate with us via form, email, phone, or otherwise, we store a copy of our communications (including any call recordings, if any, as permitted by applicable law).

2. Information we collect automatically:

(a)Log information: We collect information that web browsers, mobile devices, and servers typically make available, including the browser type, IP address, unique device identifiers, language preference, referring site, the date and time of access, operating system, and mobile network information. We collect log information when You use our Platform — for example, when You create or make changes to Your profile page or account on the Platform.

(b)Usage information: We collect information about Your usage of our Platform. We also collect information about what happens when You use our Platform (e.g., page views, support document searches, features enabled for Your account, interactions with other parts of our Services) along with information about Your Supported Device (e.g., screen size, name of cellular network, and mobile device manufacturer). We use this information to provide our Platform to You, get insights on how people use our Platform so we can make our Platform better, and understand and make predictions about User retention.

(c)Location information: We may determine the approximate location of Your Supported Device from Your Internet Protocol (IP) address. We may collect and use this information to calculate how many people visit from certain geographic regions or to improve our Platform offerings.

(d)Information from cookies & other technologies: We may collect information about You through the use of cookies and other similar technologies. A cookie is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. For more information on our use of cookies and similar technologies, please refer to our Cookie Policy.

3. Information we collect from other sources:

We might receive information about You from other sources in course of their services to us.

F.       USE OF THE PLATFORM/SERVICES BY CHILDREN

As stated in our Terms of Use, You must be a major in accordance with the applicable laws of Your country of residence.  

We do not knowingly collect personally identifiable information from a child. If You are a parent or guardian and You are aware that Your child has provided us with any such Personal Information, please contact us at privacy@graphy.com. If We become aware that we have collected Personal Information from a child, we will take steps to remove that information from our servers.

Whenever we refer to a “child” or “children” in this Policy, we mean a child under the age of 13 years for Users from the United States of America (USA), under the age of 16 years for Users from the European Union (EU), and a child under the age of 18 years for Users from India and rest of the world (other than USA and EU).

G.      HOW WE USE and SHARE THE INFORMATION COLLECTED

•      We use/process Your information in the following manner:

1. To provide our Platform:  We use the Your information as collected by us to allow You to access the Platform and the services offered therein, including without limitation to set-up and maintain Your account, provide customer service, fulfil purchases through the Platform, verify User information and to resolve any glitches with our Platform. The legal basis for this processing is consent or, where applicable, our legitimate interests in the proper administration of our Platform, and/or the performance of a contract between You and us.
2. To improve our Platform and maintain safety: We use Your information to improve and customize the Platform and services offered by us, including providing automatic updates to newer versions of our Platform and creating new features based on the Platform usage analysis. Further, we also use Your information to prevent, detect, investigate, and take measures against criminal activity, fraud, misuse of or damage to our Platform or network, and other threats and violations to Graphy’s or a third party's rights and property, or the safety of Graphy, its users, or others.  The legal basis for this processing is consent or, where applicable, our legitimate interests in the proper administration of our Platform, and/or the performance of a contract between You and us.
3. To market our Platform and communicate with You: We will use Your information in order to develop a more targeted marketing of our Platform, to communicate with You about our offers, new products, services or even receive Your feedback on the Platform. The legal basis for this processing is consent or, where applicable, our legitimate interests in the proper administration of our Platform, and/or the performance of a contract between You and us.
4. To establish, exercise, or defend legal claims: We may process any of the Personal Information identified in this Policy when necessary for establishing, exercising, or defending legal claims, whether in court, administrative, or other proceedings.  The legal basis for this processing is our legitimate interest in the protection and assertion of our legal rights, your legal rights, and the legal rights of others.
5. To manage risk and obtain professional advice: We may process any of the Personal Information identified in this Policy to manage risk or obtain professional advice.  The legal basis for this processing is our legitimate interest in the proper protection of our business and Platform. 

Basis of Collection and Processing of your Personal Information: We collect and process Your Personal Information based on the following legal parameters depending upon the nature of Personal Information and the purposes for which it is processed:

•        Consent: We rely on your consent in order to process your Personal Information in certain situations. If we require your consent to collect and process certain Personal Information, as per the requirements under the applicable data protection laws, your consent is sought at the time of collection of your Personal Information and such processing will only be performed where consent is secured.

•Compliance with a legal obligation: Your Personal Information may be processed by us, to the extent that such processing is necessary to comply with a legal obligation.

We may process Your Personal Information in connection with any of the purposes and uses set out in this Policy on one or more of the following legal grounds:

·Because it is necessary to perform the services You have requested or to comply with Your instructions or other contractual obligations between You and us;

·To comply with our legal obligations as well as to keep records of our compliance processes;

·Because our legitimate interests, or those of a third-party recipient of Your Personal Information, make the processing necessary, provided those interests are not overridden by Your interests or fundamental rights and freedoms;

·Because You have chosen to publish or display Your Personal Information on a public area of the Platform, such as a comment area;

·Because it is necessary to protect Your vital interests;

·Because it is necessary in the public interest; or

·Because You have expressly given us Your consent to process Your Personal Information in a particular manner.

We do not use Personal Information for making any automated decisions affecting or creating profiles other than what is described in this Policy.

Where the processing of Your Personal Information is based on Your consent, You have the right to withdraw Your consent at any point in time. Please note that should the withdrawal of consent result in us not being able to continue offering our products and services to You, we reserve the right to withdraw or cease our products and services to You upon Your consent withdrawal. You may withdraw consent by contacting us with a written request to the contact details provided in the ‘Grievances’ section under the Country Specific Terms below. Upon receipt of Your request to withdraw Your consent, the consequences of withdrawal may be communicated to You. Upon Your agreement to the same, Your request for withdrawal will be processed.

•      We share the information collected as mentioned above only in the manner specified hereinbelow. We do not sell or otherwise disclose Personal Information we collect about You for monetary or other valuable consideration.

1. Information shared with Creators:

(a)To allow the Creators to provide their services to their Learners, we share the following information of Learners (“Learner Information”) with Creators in a downloadable format:

(i).Account information on the Platform, including a Learner’s name, email address and mobile number (if provided by You on the Platform);

(ii).Information about a Learner’s enrolment and participation in the Content, course/session completion status, quiz results (if any) and certificates (if any and applicable) taught by the Creator;

(iii).Any messages a Learner exchanges with the Creator through the Platform.

Graphy will provide Learner Information to Creators only if a Learner has joined/subscribed to such Creators’ Page on the Platform.  Please note that, except as stated above, we do not share any other information about Learners with the Creators. Any additional information that is shared by a Learner with a Creator is done so at the discretion of the Learner. However, our Third-Party Service Providers, may share the information relating to purchases made by You on the Platform, including invoices, the amount paid, Your address, or other billing information regarding a Creator’s Content with the Creator or with others in accordance with their privacy policy.  Please review terms and conditions and privacy policy of relevant Third-Party Service Providers before availing their services to understand more about how they may collect, process, and use Personal Information provided by You to them.

(b)Creators are responsible for protecting Learner Information that they collect and for processing that information in accordance with applicable data protection laws. If You (as a Learner) have any questions about a Creator’s privacy practices, You should contact the Creator directly and ask to review such Creator’s privacy policies.

(c)Learner Consent: For the purposes stated hereinabove, You, as a Learner, hereby give consent to Graphy to share Your Learner Information with the Creator to whose Page You have joined/subscribed, and further consent to allow such Creators to download Your Learner Information as provided on the Platform.

2. Information shared with Learners and other users on the Platform:

When a Creator creates an account and makes available Content on the Platform, the information contained in a Creator’s public profile and Creator’s Content will be viewable to Users who are given access to Your profile and Content.

Please note that all information shared by a Creator, whether as part of a Creator’s public profile or Content, in Communities, or other public portions of the Platform, is deemed as public information. Since the same is publicly available, we cannot control how others treat it; so please keep that in mind when deciding what information You choose to include, and refrain from sharing Your sensitive personal information and those of others.

3. Other ways we may share Information:

(a)Affiliates and Subsidiaries: We may disclose information about You to our affiliates, subsidiaries and other businesses under the same control and ownership, and their respective officers, directors, employees, accountants, attorneys, or agents, who need the information to help us provide our Platform or process the information on our behalf. We require our subsidiaries to follow this Privacy Policy for any Personal Information that we share with them.

(b)Third-party vendors: We may share information about You with third-party vendors or service providers (including consultants, payment processors, and other service providers) who need the information in order to provide their support services to us, or to provide their services to You on our behalf. These services may include providing customer support, performing business and sales analysis, supporting our website functionality, facilitating payment processing, and supporting contests, surveys , and other features offered on our Platform. Such third-party vendors are not allowed to use the information for any purpose other than what it was provided for and they are required to process and use the information in accordance with this Privacy Policy.

(c)Legal Disclosures: We may disclose information about You in response to a court order, or other governmental request. Without limitation to the foregoing, we reserve the right to disclose such information where we believe in good faith that such disclosure is necessary to:

(i).comply with applicable laws, regulations, court orders, government and law enforcement agencies’ requests;

(ii).protect and defend Graphy’s or a third party's rights and property, or the safety of Graphy, our users, our employees, or others; or

(iii).prevent, detect, investigate and take measures against criminal activity, fraud and misuse or unauthorized use of our Platform and/or to enforce our Terms of Use or other agreements or policies.

To the extent permitted by law, we will attempt to give You prior notice before disclosing Your information in response to such a request.

(d)Business transfers: In the event Graphy undergoes any merger, acquisition, or sale of company assets, in part or in full, by another company, or in the unlikely event that Graphy goes out of business or enters bankruptcy, user information would likely be one of the assets that is transferred or acquired by a third party. If any of these events were to happen, this Privacy Policy would continue to apply to Your information and the party receiving Your information may continue to use Your information, but only consistent with this Privacy Policy.

(e)Advertising and Analytics Partners: We may share usage data with third-party advertisers, advertisement networks, and analytics providers through cookies and other similar technologies.

(f)With Your Consent: We may share and disclose information with Your consent or at Your direction.

Your information may be shared for reasons not described in this Policy, however, we will inform You before we do the same.

H.CROSS-BORDER DATA TRANSFER

Any Personal Information that we transfer will be protected in accordance with this Policy as well as with adequate protections in place in compliance with applicable laws and regulations.

Please note that these countries may have differing (and potentially less stringent) privacy laws and that Personal Information can become subject to the laws and disclosure requirements of such countries, including disclosure to governmental bodies, regulatory agencies, and private persons, as a result of applicable governmental or regulatory inquiry, court order or other similar process.

Please note that the Personal Information we hold about You may have to be transferred to other countries outside Your residential country. Same shall be done in accordance with the purposes described in this Privacy Policy.

I.DURATION FOR WHICH YOUR INFORMATION IS STORED ON THE PLATFORM

Mostly, when You delete any of the information provided by You or when You delete Your account, on the Platform, the same will be deleted from our servers too. However, in certain cases, we will retain Your information for as long as it is required for us to retain for the purposes stated hereinabove, including for the purpose of complying with legal obligation or business compliances.

Further, please note that we may not be able to delete all communications or photos, files, or other documents publicly made available by You on Your public profile or otherwise on the Platform, however, we shall anonymize Your Personal Information in such a way that You can no longer be identified as an individual in association with such information made available by You on the Platform. We will never disclose aggregated or de-identified information in a manner that could identify You as an individual.

Note: If You belong to a country where GDPR applies or if You are a Californian resident and if You wish to exercise any of Your rights (as specified hereinbelow) to access, modify and delete any or all information stored about You, then You may do so by writing to us at privacy@graphy.com.

J.YOUR CHOICES

1. Limit the information You provide: You always have an option to choose the information You provide to us, including the option to update or delete Your information. However, please note that lack of certain information may not allow You access to the Platform or any of its features, in part or in full. For example: information required for Your registration on the Platform.
2. Limit the communications You receive from us: Further, You will also have the option to choose what kind of communication You would like to receive from us. However, there may be certain communications that are required for legal or security purposes, including changes to various legal agreements, that you may not be able to limit.
3. Reject Cookies and other similar technologies: You may reject or remove cookies from Your web browser; You will always have the option to change the default settings on Your web browser if the same is set to ‘accept cookies’. However, please note that some of the Services offered on the Platform may not function or be available to You, when the cookies are rejected, removed, or disabled.

K.      YOUR RIGHTS:

Depending on where You are situated, You may have certain rights in respect of Your Personal Information accorded by the laws of the country You are situated in. To understand Your rights, please refer to the Country Specific Terms below.   

Please note, if You are a Learner who wishes to exercise his/her rights under the applicable data privacy laws in respect of Your  Data made available on the Platform , then You may write to us at privacy@graphy.com .

L.      INFORMATION SECURITY

●We work to protect the security of Your information during transmission by using Transport Layer Security (TLS) software, which encrypts information You input in addition to maintaining security of Your information as required under applicable laws.

●We maintain electronic, and procedural safeguards in connection with the collection, storage, and disclosure of Personal Information (including sensitive personal information). Our security procedures mean that we may occasionally request proof of identity before we disclose Personal Information to You that belongs to you.

However, no form or method of data storage or transmission system is fully secure, and we cannot guarantee that security provided by such system(s) is absolute and that Your information will not be accessed, disclosed, or destroyed in the event of a breach of any of our security measures.

●It is important for You to protect Your account against unauthorized access to or use of Your password and to Your computer and if You have any reason to believe that Your password has become known to anyone else, or if the password is being, or is likely to be, used in an unauthorized manner, You must immediately change Your password or inform us, so that we are able to help You stop or prevent such unauthorized access. Be sure to sign off when You finish using a shared computer.

●We try and ensure that the third parties who provide services to us under appropriate contracts take appropriate security measures to protect Personal Information in line with our policies.

M.   INTEREST-BASED ADS

On unaffiliated sites, Graphy may display interest-based advertising using information You make available to us when You interact with our Platform, content, or services. Interest-based ads, also sometimes referred to as personalised or targeted ads, are displayed to You based on information from activities such as registering with our Platform, visiting sites that contain Graphy content or ads. In providing interest-based ads, we follow applicable laws, as well as the Code for Self-Regulation in Advertising by the Advertising Standards Council of India and the Self-Regulatory Principles for Online Behavioural Advertising developed by the Digital Advertising Alliance (a coalition of marketing, online advertising, and consumer advocacy organizations) and other rules and guidelines issued by the Federal Trade Commission in respect of digital Advertising.

We do not provide any personal information to advertisers or to third party sites that display our interest-based ads. However, advertisers and other third-parties (including the ad networks, ad-serving companies, and other service providers they may use) may assume that users who interact with or click on a personalised ad or content are part of the group that the ad or content is directed towards . Also, some third-parties may provide us information about You (such as the sites where You have been shown ads or demographic information) from offline and online sources that we may use to provide You more relevant and useful advertising.

Advertisers or ad companies working on their behalf sometimes use technology to serve the ads that appear on our sites directly to Your browser. They automatically receive Your IP address when this happens. They may also use cookies to measure the effectiveness of their ads and to personalise ad content. We do not have access to or control over cookies or other features that advertisers and third-party sites may use, and the information practices of these advertisers and third-party websites are not covered by our Policy. Please contact them directly for more information about their privacy practices.

N.    MODIFICATION TO PRIVACY POLICY

Our business changes constantly and our Policy may change from time to time. We may emailperiodic reminders of our notices and conditions, unless you have instructed us not to, but we encourage You to check our Platform frequently to see the recent changes. Unless stated otherwise, our current Policy applies to all information that we have about You and Your account. We stand behind the promises we make, however, and will not materially change our policies and practices to make them less protective of customer information collected in the past without Your consent.

II.COUNTRY SPECIFIC PRIVACY TERMS

A.TERMS APPLICABLE IF YOU ARE AN INDIAN RESIDENT

1.Your Rights: If you are located in India, you have the following rights under the Personal Data Protection Bill (PDPB).  All requests should be sent to the address noted in the “Grievances” section below and we will fulfil requests to the extent required by law.

(i).Right to Confirmation and Access: You have the right to get confirmation and access to Your Personal Information that is with us along with other supporting information.

(ii).Right to Correction: You have the right to ask us to rectify Your Personal Information that is with us that you think is inaccurate. You also have the right to ask us to update your Personal Information that you think is incomplete or out-of-date.

(iii).Right to Data Portability: You have the right to ask that we transfer the Personal Information You gave us to another organisation, or to You, under certain circumstances.

(iv).Right to be Forgotten: You have the right to restrict or prevent the continuing disclosure of your Personal Information under certain circumstances.

(v).Right to Erasure: If You wish to withdraw/remove Your personal Information from our Platform, You have the right to request erasure of Your Personal Information from our Platform by writing to us to the contact details provided in the ‘Grievances’ section below. However, please note that such erasure will remove all Your Personal Information from our Platform and may result in deletion of Your account on the Platform permanently, and the same will not be retrievable.

2.Grievances: If you have any questions about this Policy, wish to exercise your rights, concerns about privacy or grievances at Platform, please register your complaint with a thorough description via email to privacy@graphy.comaddressed to our grievance officer Ms. Brahmi Chandrasekaran (Manager-Legal) or via a registered post to:

Sorting Hat Technologies Pvt Ltd

Maruti Infotech Centre, 3rd Floor,

A-Block, Domlur, Koramangala Inner Ring Road,

Bangalore- 560 071, Karnataka, India.

B.TERMS APPLICABLE IF YOU ARE A RESIDENT OF A EUROPEAN UNION (EU) COUNTRY OR EUROPEAN ECONOMIC AREA (EEA)

3.Your Rights: If you are located in the European Union (EU) or European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR).  All requests should be sent to the address noted in the “Grievances” section below and we will fulfil requests to the extent required by applicable law.

(i).Right to access Your Personal Information– You have the right to receive confirmation as to whether or not Personal Information concerning You is being processed and, where that is the case, access to the Personal Information can be sought;

(ii).Right to Rectification – Our goal is to keep Your Personal Information accurate, current and complete.  Please contact us if You believe Your information is inaccurate or incomplete;

(iii).Right to Erasure – In some cases, You have a legal right to request that we erase Your Personal Information;

(iv).Right to object to Processing - You have the right to object to our processing of Your Personal Information under certain conditions;

(v).Right to restrict processing- You have the right to request that we restrict the processing of Your Personal Information, under certain conditions;

(vi).Right to Data Portability– You have the right to request that we transfer the data that we have collected to another organization, or directly to You, under certain conditions;

(vii).Right to make a complaint to a government supervisory authority – If You believe we have not processed Your Personal Information in accordance with applicable provisions of the GDPR, we encourage You to contact us at privacy@graphy.com.  You also have the right to make a GDPR complaint to the relevant Supervisory Authority or seek a remedy through the courts. A list of Supervisory Authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en. If You need further assistance regarding Your rights, please contact us using the contact information provided below and we will consider Your request in accordance with applicable law. You can identify the supervising authority of Your concern by visiting https://edpb.europa.eu/about-edpb/board/members_en.

(viii).Right to not be subject to Automated decision-making, including profiling - You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning You.

We collect and process Personal Information about You only where we have a legal rationale to do so. Specific legal rationale applied for the same will depend on the type of Personal Information collected and the context in which the same is being processed, including the services involved.

4.Grievances: If you have any questions about this Policy, wish to exercise your rights, concerns about privacy or grievances at Platform, please register your complaint with a thorough description via email to privacy@graphy.com addressed to our grievance officer Ms. Brahmi Chandrasekaran (Manager-Legal) or via a registered post to:

Graphy INC

Vistra (Delaware) Ltd

3500 South Dupont HWY

Dover, Kent, DE 19901

C.            TERMS APPLICABLE IF YOU ARE A CALIFORNIA STATE RESIDENT

1.             If You are a California State Resident, then You have the following rights-

The above rights, the manner in which You can exercise the same and the category of and the manner in which we collect Your information, are detailed below.

(a).CCPA NOTICE AT COLLECTION:

For purposes of the CCPA, in collecting the information described above, we collect the categories of Personal Information listed below from you:

(i).Identifiers: We may collect Your name, email address, mobile number, username, unique personal identifier, and Internet Protocol (IP) address.   We use Identifiers as set forth in the “How We Use and Share the Information Collected” section of this Policy, like Your name, contact information, and device and online identifiers.

(ii).Characteristics of Personal Information described in the California Customer Records statute: We may collect Your name, email address, username, unique personal identifier, and gender.  We use Categories of Personal Information described in the California Consumer Records statute as set forth in the “How We Use and Share the Information Collected” section of this Policy. 

(iii).Internet or other electronic network activity information: We collect cookies as described in our Cookies Policy, we will automatically receive information from Your browser and Your device, which includes the date and time of Your visit to the Platform as well as your location, Internet Protocol (IP) address, domain server, browser type, access time, and data about which pages You visit on the Platform.  We use Internet or other electronic network activity information as set forth in the “How We Use and Share the Information Collected” section of this Policy.

(iv).Geolocation data: We may collect your IP address.   We use Geolocation Data as set forth in the “How We Use and Share the Information Collected” section of this Policy.  (such as your location based on your IP address);

(v).Audio, electronic, visual or similar information: We may collect your profile picture or other audio or visual information uploaded as content to the Platform. We use Audio, electronic, visual or similar information as set forth in the “How We Use and Share the Information Collected” section of this Policy. 

(vi).Inferences: We may make inferences based upon the Personal Information collected (such as likelihood of retention or attrition).  We use Inference information as set forth in the “How We Use and Share the Information Collected” section of this Policy. 

(b).        CCPA DATA PRACTICES DURING THE LAST 12 MONTHS:

1.Personal Information Collected: As described in this Policy, we have collected the categories of Personal Information listed below during the preceding 12 months:

(i)Identifiers

(ii)Characteristics of Personal Information described in the California Customer Records statute

(iii)Internet or other electronic network activity information

(iv)Geolocation data

(v)Commercial information

(vi)Audio, electronic, visual, thermal, olfactory, or similar information

(vii)Inferences

2.Categories of Sources: We have collected the Personal Information identified in this Policy from You and our payment processors.

3.Business and Commercial Purposes for Collecting:We have collected the categories of Personal Information listed above for the following purposes:

(i).Operate the Platform;

(ii).Provide our services to you;

(iii).Honor our Terms of Use and contracts;

(iv).Ensure the privacy and security of our Platform and services;

(v).Manage our relationships with you;

(vi).Communicate with you;

(vii).Analyze use of the Platform and our services;

(viii).Enhance your experience;

(ix).Track visits to the Platform;

(x).Provide you with a more personal and interactive experience on the Platform; and

(xi).Usage analytics purposes.

4.Personal Information Sold: We have not sold categories of Personal Information during the preceding 12 months.

5.Personal Information Disclosed for a Business Purpose: We have disclosed for a business purpose the categories of Personal Information listed below during the preceding 12 months:

(i).Identifiers

(ii).Characteristics of Personal Information described in the California Customer Records statute

(iii).Internet or other electronic network activity information

(iv).Geolocation data

(v).Commercial information

(vi).Audio, electronic, visual, thermal, olfactory, or similar information

(vii).Inferences

We have disclosed each category of Personal Information to the following categories of third parties: (1) corporate parents, subsidiaries, and affiliates; (2) advisors (accountants, attorneys); (3) service providers (Creators, data analytics, data storage, mailing, marketing, website and platform administration, technical support); and (4) operating systems and platforms.

(c).         CONSUMER RIGHTS AND REQUESTS UNDER THE CCPA

The CCPA gives consumers the right to request that we (1) disclose what Personal Information we collect, use, disclose, and sell, and (2) delete certain Personal Information that we have collected or maintained. You may submit these requests to us as described below, and we honor these rights where they apply.

If a request is submitted in a manner that is not one of the designated methods for submission, or if the request is deficient in some manner unrelated to our verification process, we will either (1) treat the request as if it had been submitted in accordance with the designated manner, or (2) provide You with specific directions on how to submit the request or remedy any deficiencies with the request, as applicable.

(a)Request to Know: As a California resident, You have the right to request: (1) the specific pieces of Personal Information we have collected about You; (2) the categories of Personal Information we have collected about You; (3) the categories of sources from which the Personal Information is collected; (4) the categories of Personal Information about You that we have sold and the categories of third parties to whom the Personal Information was sold; (5) the categories of Personal Information about You that we disclosed for a business purpose and the categories of third parties to whom the Personal Information was disclosed for a business purpose; (6) the business or commercial purpose for collecting, disclosing, or selling Personal Information; and (7) the categories of third parties with whom we share Personal Information. Our response will cover the 12-month period preceding our receipt of a verifiable request.

(b)Request to Delete: As a California resident, You have a right to request the erasure/deletion of certain Personal Information collected or maintained by us. As described herein, we will delete your Personal Information from our records and direct any service providers (as defined under applicable law) to delete Your Personal Information from their records. However, we are not required to honor a deletion request if an exemption applies under the law.

(c)Submitting a Request:

(i)Submission of Instructions: You may submit a request to know or to delete by email to privacy@graphy.com or by submitting a request via mail to Graphy Inc., Vistra (Delaware) Ltd, 3500 South Dupont Hwy, Dover, Kent, DE 19901. Regarding requests to delete, we may present you with the choice to delete select portions of Your Personal Information, but a global option to delete all Personal Information will be offered and more prominently presented.

(i)Verification Process: We are required by law to verify the identities of those who submit requests to know or to delete. To determine whether the individual making the request is the consumer about whom we have collected information, we will verify Your identity by matching the identifying information provided by You in the request to the Personal Information that we already maintain about You. As a part of this process, you will be required to provide Your name and email address, and mobile number (if the same have been voluntarily provided by You at the time of registering on the Platform or otherwise while using the Platform). We will inform you if we cannot verify Your identity. Please note-

·     If we cannot verify the identity of the person making a request for categories of Personal Information, we may deny the request. If the request is denied in whole or in part for this reason, we will provide a copy of, or direct You to, our Privacy Policy.

·     If we cannot verify the identity of the person making the request for specific pieces of Personal Information, we are prohibited from disclosing any specific pieces of Personal Information to the requestor. However, if denied in whole or in part for this reason, we will evaluate the request as if it is seeking the disclosure of categories of Personal Information about the consumer.

·     If we cannot verify the identity of the person making a request to delete, we may deny the request.  If there is no reasonable method by which we can verify the identity of the requestor to the degree of certainty required, we will state this in our response and explain why we have no reasonable method by which we can verify the identity of the requestor.

(i)Authorized Agents: Authorized agents may submit requests via the methods identified in this Policy. If You use an authorized agent to submit a request to know or a request to delete, we may require You to: (1) provide the authorized agent with signed permission to do so; (2) verify Your identity directly with us; and (3) directly confirm with us that You provided the authorized agent permission to submit the request. However, we will not require these actions if You have provided the authorized agent with power of attorney pursuant to the California Probate Code.

(i)Excessive Requests: If requests from a User are manifestly unfounded or excessive, in particular because of their repetitive character, we may either (1) charge a reasonable fee, or (2) refuse to act on the request and notify the User of the reason for refusing the request. If we charge a fee, the amount will be based upon the administrative costs of providing the information or communication or taking the action requested.

(v)CCPA Non-Discrimination: You have the right not to receive discriminatory treatment by us due to Your exercise of the rights provided by the CCPA. We do not offer financial incentives and price or service differences, and we do not discriminate against Users/consumers for exercising their rights under the CCPA.

2.Grievances: If you have any questions about this Policy, wish to exercise your rights, concerns about privacy or grievances at Platform, please register your complaint with a thorough description via email to privacy@graphy.com addressed to our grievance officer Ms. Brahmi Chandrasekaran (Manager-Legal) or via a registered post to:

Graphy INC

Vistra (Delaware) Ltd

3500 South Dupont HWY

Dover, Kent, DE 19901