Privacy Policy

1. Information We Collect

Depending on how someone uses the website, we may collect the following categories of information:

• Identity and contact information, such as full name, business name, email address, phone number, city, and state.
• Business and application information, such as business type, product interest, channel experience, territory notes, and other information shared through enquiry or distributor application forms.
• Communication records, such as messages sent through website forms or follow-up replies related to consultation, product guidance, or distributor review.
• Basic technical and usage information, such as browser type, device information, IP address, pages visited, timestamps, and other standard request or security data generated when the website is used.

2. How We Collect Information

We collect information in the following ways:

• Directly from the person submitting it through the contact route, distributor application route, email, or other business communication.
• Automatically through standard website operation, security logging, hosting infrastructure, and similar technical processes.
• From service providers who help us run the website, manage form submissions, or support related communication workflows.

3. Why We Use Information

We use personal and business information to:

• respond to consultation requests, product enquiries, and distributor applications;
• review business fit, territory fit, and onboarding readiness;
• manage follow-up communication related to the website and submitted forms;
• operate, secure, and improve the website and its enquiry flows;
• maintain internal records connected to business communication and review activity;
• comply with legal, regulatory, accounting, or operational obligations where applicable.

4. Legal Basis, Consent, and Communication

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDPA), XpoAura Ventures Pvt. Ltd. acts as the Data Fiduciary in respect of personal data collected through this website.

When someone submits information through this website, that information is processed for the stated business purpose of the form or communication route being used. Where consent is required under the DPDPA, submission of the relevant form accompanied by the explicit consent checkbox is treated as the Data Principal's free, specific, informed, and unambiguous consent for that stated purpose.

If consent is later withdrawn, XpoAura will stop future processing that depends on that consent, subject to any legal or operational record-keeping obligations that still apply.

5. How We Share Information

XpoAura does not sell personal data.

Information may be shared only where reasonably necessary with:

• internal team members handling consultation, portfolio review, distributor review, or operational follow-up;
• service providers supporting website hosting, form handling, communication, security, or technical operations;
• professional advisors or regulators where disclosure is required for legal, compliance, or dispute-handling purposes;
• parties involved in a business reorganisation, financing, merger, or asset transfer, where disclosure is reasonably necessary and appropriately controlled.

6. Retention

We keep information for as long as it is reasonably needed for the purpose for which it was collected, for follow-up communication, for internal record-keeping, or to meet legal and compliance obligations. Different categories of information may be retained for different periods depending on business and legal needs.

7. Security

XpoAura uses reasonable technical and organisational measures to protect submitted information against unauthorised access, misuse, disclosure, or loss. No internet transmission or digital storage method is completely risk-free, but we aim to handle submitted information with appropriate care and access control.

8. Cookies, Analytics and Your Consent

Our server sets no cookies of its own. We use three analytics tools: Google Analytics, Vercel Web Analytics and Vercel Speed Insights. All three run only if you click Accept.

What runs without consent

• Your consent choice. We save Accept or Reject in your browser's local storage under xpoaura-cookie-consent. It is used only to remember your answer.

What needs your consent

• Google Analytics 4. Google Analytics is fully held back until you accept. After you accept, it sets the _ga cookie and _ga_<ID> session cookies (the ID varies), which last up to 2 years, so we can see which pages trade visitors use.
• Vercel Web Analytics and Speed Insights. These count page views and measure load speed. They load only after you accept. They are cookieless and store nothing in your browser.

If you reject, Google Analytics, Vercel Web Analytics and Vercel Speed Insights do not load. Google Analytics sets no cookies. If you accept first and then reject, the Vercel tools that have already loaded can keep running until you reload the page.

Forms

Our enquiry and distributor forms don't use cookies. Each submission carries its own consent checkbox, which covers the details you send, as described in Section 4.

Changing your choice

You can change your choice any time. Use the Cookie settings link in the site footer to reopen the banner. If you switch from Reject to Accept, Google Analytics, Vercel Web Analytics and Speed Insights load. If you switch from Accept to Reject, Google Analytics stops and its cookies are removed. Vercel Web Analytics and Speed Insights do not load again after you reload the page or come back later. The full list of cookies is in our Cookie Policy.

For questions, use the contact details in the Contact for Privacy Requests section.

9. Rights and Choices (Data Principal Rights)

Under the Digital Personal Data Protection Act, 2023 and other applicable law, a Data Principal (the individual whose personal data is processed) may request:

• access to information about the personal data processed and the purposes of processing;
• correction or updating of inaccurate or outdated information;
• erasure of personal data where continued retention is not required by law or legitimate business need;
• withdrawal of consent for future processing where consent is the legal basis used;
• nomination of another individual to exercise these rights in the event of the Data Principal's death or incapacity;
• review of a grievance related to how personal data has been handled, and redressal within a reasonable time.

10. Contact for Privacy Requests

For privacy questions, correction requests, consent withdrawal, or data-related concerns, contact:

11. Updates to This Policy

XpoAura may update this Privacy Policy from time to time. When updates are made, the "Last updated" line on this page should be revised. Continued use of the website after an update means the revised policy will apply from that point forward.