COOKIE & TRACKING CONSENT POLICY

1. PURPOSE & SCOPE

1.1 Purpose

This Cookie & Tracking Consent Policy explains how STCNET Private Limited
uses cookies, pixels, tags, scripts, device identifiers, local storage, analytics tools,
advertising tools, security tools, and similar technologies on its official website,
platform, and related digital interfaces.

This Policy is designed to:

• provide clear disclosure of cookies and tracking technologies used on the
  STCNET platform;
• explain the purpose of different categories of cookies;
• distinguish essential cookies from non-essential cookies;
• obtain consent for non-essential cookies where required;
• allow users to accept, reject, withdraw, or modify cookie preferences;
• protect user privacy and personal data;
• support compliance with applicable data protection, consumer protection,
  and electronic-record laws;
• link cookie-related personal data processing with STCNET’s Privacy Policy.

1.2 Legal Basis

This Policy is framed with reference to applicable Indian laws and regulatory
requirements, including:

1.3 Applicability

This Policy applies to:

• all users who visit, access, browse, register on, or use STCNET’s official
  website or authorised platform;
• all devices used to access the platform, including desktop, mobile, tablet,
  and browser-based devices;
• cookies and tracking technologies deployed directly by STCNET;
• cookies and tracking technologies deployed through authorised third-party
  service providers integrated with STCNET;
• analytics, security, payment, advertising, performance, preference, and
  platform-functionality tools used on STCNET.

This Policy does not apply to:

• unrelated third-party websites, apps, payment apps, delivery apps, social
  media platforms, or external links not controlled by STCNET;
• cookies or trackers deployed independently by third parties outside
  STCNET’s platform;
• offline data collection;
• unauthorised websites, fake links, phishing pages, or impersonation
  websites pretending to be STCNET.

2. DEFINITIONS

For the purpose of this Policy:

3. WHAT COOKIES AND TRACKING TECHNOLOGIES DO

3.1 Cookies

Cookies help websites work properly and improve user experience.

Cookies may be used to:

• keep users logged in;
• remember items in a shopping cart;
• secure the website;
• prevent fraud;
• remember cookie preferences;
• process checkout;
• support payment flow;
• improve website speed and reliability;
• understand how users interact with the platform;
• remember user preferences;
• measure marketing performance where enabled and consented to.

Cookies may not always directly identify a person. However, where cookies,
identifiers, or tracking data identify a user or relate to an identifiable user, such
data shall be treated as personal data and processed in accordance with STCNET’s
Privacy Policy and applicable law.

3.2 Other Tracking Technologies

STCNET may use similar technologies, including:

STCNET shall not knowingly use covert tracking technologies in a manner that
violates applicable law.

3.3 Device Fingerprinting and Session Replay

Device fingerprinting and session replay can be privacy-sensitive.

STCNET shall not use device fingerprinting, behavioural monitoring, or session
replay for advertising, profiling, or unnecessary behavioural tracking unless:

• the purpose is clearly disclosed;
• consent is obtained where required;
• the tool is configured with appropriate safeguards;
• sensitive fields such as passwords, OTPs, payment credentials, card details,
  CVV, UPI PINs, and personal documents are masked or excluded;
• the processing is lawful, proportionate, and necessary for the stated
  purpose.

STCNET may use limited technical fingerprinting, device identifiers, security
identifiers, or fraud-prevention signals without separate cookie consent only
where such processing is strictly necessary for fraud prevention, cybersecurity,
bot detection, payment security, account protection, platform integrity, or legal
compliance, and where such processing is permitted under applicable law as a
lawful basis, legitimate use, legal obligation, security requirement, or other
permitted processing ground.

Such processing shall be:

• proportionate;
• transparent through this Policy and the Privacy Policy;
• limited to what is strictly necessary;
• not used for unrelated advertising or profiling without consent where
  required;
• subject to appropriate security safeguards.

4. TYPES OF COOKIES USED

4.1 Essential / Strictly Necessary Cookies

Essential cookies are required for the platform to function properly.

These may include cookies used for:

Consent Position: Essential cookies are used without separate cookie consent
because they are necessary for the platform to operate.

Users may disable such cookies through browser settings, but doing so may
prevent login, cart, checkout, payment, security, or other essential features from
working properly.

4.2 Functional Cookies

Functional cookies support enhanced user experience.

These may include cookies used for:

Consent Position: Functional cookies that are strictly necessary for requested
features may be enabled as part of the service. Optional functional cookies shall
be enabled only where consent is obtained or where otherwise permitted under
applicable law.

4.3 Analytics / Performance Cookies

Analytics and performance cookies help STCNET understand platform usage and
improve service quality.

These may be used for:

• page-view measurement;
• traffic analysis;
• product-page performance;
• error detection;
• checkout-flow improvement;
• loading-speed improvement;
• platform design improvement;
• aggregate usage statistics.

Consent Position: Non-essential analytics cookies shall be deployed only after
user consent where consent is required.

Where STCNET uses privacy-preserving, aggregated, anonymous, or strictly
necessary technical analytics, consent treatment may depend on the tool
configuration and applicable law.

4.4 Advertising / Targeting Cookies

Advertising or targeting cookies may be used only where such tools are enabled
by STCNET.

These may support:

• campaign attribution;
• retargeting;
• ad measurement;
• audience segmentation;
• promotional performance tracking;
• affiliate or referral campaign measurement.

Consent Position: Advertising, targeting, retargeting, behavioural advertising,
and marketing cookies shall be deployed only after user consent where consent is
required.

STCNET shall not knowingly use targeted advertising cookies for children in
violation of applicable law.

4.5 Security and Fraud-Prevention Cookies

Security cookies may be used to:

• detect suspicious login attempts;
• prevent bot activity;
• prevent fake accounts;
• detect payment abuse;
• identify account takeover attempts;
• prevent coupon abuse;
• detect COD abuse or circular ordering;
• protect the platform from cyberattacks.

Consent Position: Security and fraud-prevention cookies may be treated as
essential where necessary to protect the platform, users, transactions, and legal
compliance.

5. COOKIE CONSENT MECHANISM

5.1 Cookie Banner

STCNET shall display a cookie banner or cookie notice when a user first visits the
STCNET platform, where cookies or tracking technologies are used.

The cookie banner or notice shall explain that cookies and similar technologies
are used and shall provide clear options, which may include:

• Accept All;
• Reject All Non-Essential;
• Customise Preferences;
• Learn More / Cookie Policy link.

The banner shall not use confusing, misleading, or deceptive design to force
consent.

5.2 Consent Before Deployment

Non-essential cookies shall not be deployed before the user gives consent, where
consent is required under applicable law.

Essential cookies may be deployed without separate consent because they are
required for platform functionality, security, payment flow, fraud prevention, or
consent-record management.

5.3 Cookie Preference Tool

STCNET shall provide a Cookie Preference Tool or similar setting mechanism
allowing users to:

• view cookie categories;
• accept all cookies;
• reject non-essential cookies;
• customise preferences;
• withdraw consent;
• modify preferences later.

The Cookie Preference Tool may be accessible through:

• cookie banner;
• website footer;
• Cookie Settings page;
• account settings;
• Privacy Policy page;
• Cookie Policy page.

5.4 Withdrawal of Consent

Users may withdraw consent for non-essential cookies at any time through the
Cookie Preference Tool, where available.

Withdrawal of consent shall not affect processing that occurred before
withdrawal.

After withdrawal, STCNET shall stop deploying the relevant non-essential cookies
through its platform where technically feasible.

Users may also need to delete cookies already stored on their browser/device
through browser settings, especially where third-party cookies have already been
placed.

5.5 Consent Records and Retention

STCNET shall maintain records of cookie consent and preferences, including:

• consent status;
• cookie categories accepted or rejected;
• date and time of consent;
• policy version;
• browser/session identifier;
• withdrawal or modification of consent;
• consent banner interaction.

Such records shall be retained only for the period required for audit, legal,
security, consent-proof, dispute-resolution, and compliance purposes.

Unless a longer period is required under applicable law, legal proceedings,
regulatory process, security investigation, or Company policy, cookie consent
records shall ordinarily not be retained for longer than 8 years, after which they
shall be securely deleted, anonymised, de-identified, or archived in accordance
with STCNET’s Privacy Policy and retention practices.

6. THIRD-PARTY COOKIES AND TOOLS

6.1 Use of Third-Party Services

STCNET may use third-party service providers that deploy cookies, pixels, scripts,
tags, or similar technologies through the platform.

Such services may include:

STCNET shall not name or represent use of a specific third-party analytics,
advertising, or tracking provider unless such provider is actually integrated with
the platform.

6.2 Third-Party Policies

Third-party services may have their own privacy policies, cookie policies,
retention periods, and data processing practices.

Where users directly interact with third-party services, such as payment
gateways, UPI apps, banks, embedded content, social media platforms, or
external websites, their own terms and policies may apply.

Users are encouraged to review third-party policies where they directly use such
services.

6.3 Consent for Third-Party Cookies

Where third-party cookies are non-essential, STCNET shall seek consent through
the cookie banner, Cookie Preference Tool, or other appropriate mechanism.

Where third-party cookies are essential for payment, security, fraud prevention,
load balancing, or platform operation, they may be deployed as essential cookies
where permitted by law.

7. HOW USERS CAN MANAGE COOKIES

7.1 Cookie Preference Tool

Users may manage cookie preferences through STCNET’s Cookie Preference Tool,
where available.

Users may:

• accept all cookies;
• reject non-essential cookies;
• enable or disable specific categories;
• withdraw consent;
• update preferences.

7.2 Browser Settings

Most browsers allow users to block, delete, or manage cookies.

Common browser paths may include:

Browser paths may change depending on browser version, device type, and
operating system.

Blocking all cookies may affect login, cart, checkout, payment, security, and
platform functionality.

7.3 Mobile Device Controls

Users accessing STCNET through mobile browsers or mobile interfaces may
manage cookie, tracking, advertising, and app-level permissions through:

• mobile browser settings;
• device privacy settings;
• advertising ID settings;
• app permissions, where applicable;
• operating system privacy controls.

7.4 Analytics and Advertising Opt-Out

Where analytics or advertising tools are enabled, users may be able to opt out
through:

• STCNET’s Cookie Preference Tool;
• browser settings;
• device settings;
• third-party opt-out tools;
• advertising platform settings;
• privacy settings provided by the relevant provider.

Availability of third-party opt-out tools depends on the relevant provider.

8. COOKIES AND PERSONAL DATA

8.1 Personal Data Processing

Cookies and tracking technologies may process or be linked with personal data,
including:

• user ID;
• session ID;
• device ID;
• IP address;
• browser information;
• location approximation;
• account status;
• cart activity;
• product views;
• referral link usage;
• login activity;
• transaction flow;
• consent preferences;
• security signals.

Where such data identifies or relates to an identifiable individual, it shall be
processed in accordance with STCNET’s Privacy Policy and applicable law.

8.2 Purposes of Processing

Cookie-related personal data may be processed for:

• platform operation;
• account login;
• cart and checkout;
• payment flow;
• security and fraud prevention;
• consent management;
• analytics and performance improvement;
• user preferences;
• marketing and advertising, where enabled and consented to;
• referral attribution, where applicable;
• legal, audit, and compliance purposes.

8.3 Retention

Cookie duration depends on cookie category, purpose, and configuration.

Indicative retention may be:

STCNET shall not retain cookie-related personal data longer than necessary for
the relevant purpose or as required or permitted under applicable law.

8.4 User Rights

Users may have rights under applicable law to:

• access information about cookie-related personal data;
• withdraw consent for non-essential cookies;
• request correction or erasure of personal data, where applicable;
• raise privacy grievances;
• manage cookie preferences;
• object to or disable non-essential tracking where applicable.

Such rights may be exercised in accordance with STCNET’s Privacy Policy.

9. CHILDREN’S PRIVACY

STCNET’s platform is not intended for independent use by children below 18
years of age.

STCNET does not knowingly deploy advertising, targeting, behavioural
monitoring, or profiling cookies directed at children in violation of applicable
law.

Where STCNET becomes aware that cookie-related personal data of a child has
been processed in a manner requiring parental or guardian consent, STCNET
shall take appropriate steps in accordance with applicable law and the Privacy
Policy.

Parents or lawful guardians may contact privacy@stcnet.in for child-data
concerns.

10. DO NOT TRACK AND GLOBAL PRIVACY SIGNALS

Some browsers or devices may send “Do Not Track”, Global Privacy Control, or
similar privacy signals.

STCNET recommends that users use the Cookie Preference Tool and browser
settings to manage cookie preferences.

STCNET shall comply with legally recognised opt-out, consent, or privacy signals
where required under applicable law and where technically supported by the
platform.

Where no legally recognised standard applies, STCNET shall rely on the Cookie
Preference Tool, consent banner, browser settings, and applicable privacy
request channels to manage cookie preferences.

11. SECURITY OF COOKIE DATA

STCNET shall implement reasonable technical and organisational safeguards to
protect cookie-related data and consent records.

Such safeguards may include:

• HTTPS / SSL / TLS transmission;
• access control;
• security monitoring;
• limited retention;
• vendor controls;
• consent logs;
• masking or exclusion of sensitive fields in tracking tools;
• restriction of tracking on payment and credential fields;
• review of third-party scripts where feasible.

No online platform can guarantee absolute security against every cyber risk, but
STCNET shall take appropriate safeguards based on risk, technology, law, and
operational feasibility.

12. CHANGES TO THIS POLICY

STCNET may amend, revise, update, or replace this Policy from time to time to
reflect changes in law, regulatory requirements, technology, cookies used, third-
party tools, analytics tools, advertising practices, security tools, or business
operations.

Material changes may be notified through the platform, cookie banner, email,
dashboard notice, or other reasonable means where required.

The latest version published on the STCNET website shall prevail.

13. RELATED POLICIES

This Policy should be read together with:

1. Legal Entity & Statutory Disclosures

2. Consumer Protection (Direct Selling) Compliance Statement

3. Promoter / Referrer Code of Conduct

4. Compensation Structure & Commission Disclosure

5. Grievance Redressal & Consumer Complaints

6. Returns, Refunds & Cancellation

7. Pricing, Payments & Charges

8. Shipping, Delivery & Fulfilment

9. Privacy Policy

10. Terms & Conditions (Website Use)

11. Product / Service Regulatory Disclosures

12. No Income Guarantee Disclaimer

13. Compliance Index & Statutory Mapping

14. CONTACT AND PRIVACY GRIEVANCE

For questions, concerns, requests, or grievances relating to this Policy or cookie-
related personal data, please contact:

Cookie-related privacy grievances shall be handled in accordance with STCNET’s
Privacy Policy and Grievance Redressal & Consumer Complaints Policy.

End of Policy #12 – Cookie & Tracking Consent Policy