Privacy Policy

1. Information We Collect

Depending on how someone uses the website, we may collect the following categories of information:

• Identity and contact information, such as full name, business name, email address, phone number, city, and state.
• Business and application information, such as business type, territory scope, product interest, channel experience, territory notes, and other information shared through enquiry or distributor application forms.
• Communication records, such as messages sent through website forms or follow-up replies related to consultation, product guidance, or distributor review.
• Basic technical and usage information, such as browser type, device information, IP address, pages visited, timestamps, and other standard request or security data generated when the website is used.

2. How We Collect Information

We collect information in the following ways:

• Directly from the person submitting it through the contact route, distributor application route, email, or other business communication.
• Automatically through standard website operation, security logging, hosting infrastructure, and similar technical processes.
• From service providers who help us run the website, manage form submissions, or support related communication workflows.

3. Why We Use Information

We use personal and business information to:

• respond to consultation requests, product enquiries, and distributor applications;
• review business fit, territory fit, and onboarding readiness;
• manage follow-up communication related to the website and submitted forms;
• operate, secure, and improve the website and its enquiry flows;
• maintain internal records connected to business communication and review activity;
• comply with legal, regulatory, accounting, or operational obligations where applicable.

4. Legal Basis, Consent, and Communication

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDPA), XpoAura Ventures Pvt. Ltd. acts as the Data Fiduciary in respect of personal data collected through this website.

When someone submits information through this website, that information is processed for the stated business purpose of the form or communication route being used. Where consent is required under the DPDPA, submission of the relevant form accompanied by the explicit consent checkbox is treated as the Data Principal's free, specific, informed, and unambiguous consent for that stated purpose.

If consent is later withdrawn, XpoAura will stop future processing that depends on that consent, subject to any legal or operational record-keeping obligations that still apply.

5. How We Share Information

XpoAura does not sell personal data.

Information may be shared only where reasonably necessary with:

• internal team members handling consultation, portfolio review, distributor review, or operational follow-up;
• service providers supporting website hosting, form handling, communication, security, or technical operations;
• professional advisors or regulators where disclosure is required for legal, compliance, or dispute-handling purposes;
• parties involved in a business reorganisation, financing, merger, or asset transfer, where disclosure is reasonably necessary and appropriately controlled.

6. Retention

We keep information for as long as it is reasonably needed for the purpose for which it was collected, for follow-up communication, for internal record-keeping, or to meet legal and compliance obligations. Different categories of information may be retained for different periods depending on business and legal needs.

7. Security

XpoAura uses reasonable technical and organisational measures to protect submitted information against unauthorised access, misuse, disclosure, or loss. No internet transmission or digital storage method is completely risk-free, but we aim to handle submitted information with appropriate care and access control.

8. Rights and Choices (Data Principal Rights)

Under the Digital Personal Data Protection Act, 2023 and other applicable law, a Data Principal (the individual whose personal data is processed) may request:

• access to information about the personal data processed and the purposes of processing;
• correction or updating of inaccurate or outdated information;
• erasure of personal data where continued retention is not required by law or legitimate business need;
• withdrawal of consent for future processing where consent is the legal basis used;
• nomination of another individual to exercise these rights in the event of the Data Principal's death or incapacity;
• review of a grievance related to how personal data has been handled, and redressal within a reasonable time.

9. Contact for Privacy Requests

For privacy questions, correction requests, consent withdrawal, or data-related concerns, contact:

10. Updates to This Policy

XpoAura may update this Privacy Policy from time to time. When updates are made, the "Last updated" line on this page should be revised. Continued use of the website after an update means the revised policy will apply from that point forward.