PRIVACY POLICY

1. PURPOSE & SCOPE

1.1 Purpose

This Privacy Policy explains how STCNET Private Limited collects, uses, stores,
shares, protects, retains, deletes, and manages personal data of individuals who
interact with STCNET through its official website, platform, products, services,
referral programme, grievance channels, customer support, payment systems,
delivery systems, and authorised communication channels.

This Policy is designed to:

• provide transparent disclosure of STCNET’s personal data practices;
• explain what personal data may be collected and why;
• protect personal data from unauthorised access, misuse, loss, alteration, or
  disclosure;
• explain the rights available to Data Principals under applicable law;
• describe how consent may be given, withdrawn, and managed;
• support lawful customer service, order processing, delivery, refund, KYC,
  commission, grievance, fraud-prevention, audit, and compliance activities;
• establish a practical privacy governance framework for STCNET’s e-
  commerce, direct-selling, and referral-commerce operations.

1.2 Legal Basis

This Policy is framed with reference to applicable Indian laws and regulatory
requirements, including:

1.3 Applicability

This Policy applies to personal data processed by STCNET in relation to:

• website visitors;
• registered users;
• customers;
• Promoters / Referrers;
• complainants;
• persons contacting customer support;
• persons participating in STCNET’s referral or direct-selling programme;
• persons whose information is provided to STCNET for order delivery,
  returns, refunds, grievance handling, KYC, fraud prevention, legal
  compliance, audit, payout processing, or platform security.

This Policy applies to personal data collected through:

• STCNET’s official website;
• account registration;
• order placement and checkout;
• payment and refund processes;
• delivery and logistics processes;
• KYC and Promoter / Referrer onboarding;
• commission and payout processing;
• grievance and support channels;
• cookies and similar technologies;
• official communication channels;
• legally permitted third-party service providers.

This Policy does not apply to:

• unrelated third-party websites, platforms, applications, payment apps,
  delivery apps, or social media platforms;
• websites linked from STCNET but not operated by STCNET;
• personal data collected independently by third parties under their own
  policies;
• communications, payments, or transactions conducted outside STCNET’s
  official channels.

2. DEFINITIONS

For the purpose of this Policy:

3. DATA FIDUCIARY STATUS

STCNET acts as a Data Fiduciary under applicable data protection law for
personal data processed for its business purposes.

STCNET shall comply with obligations applicable to it as a Data Fiduciary,
including notice, consent where required, security safeguards, grievance
handling, breach response, Data Principal rights, and lawful data processing.

STCNET does not represent that it has been notified as a Significant Data
Fiduciary unless expressly stated on the website or required under applicable
law.

STCNET shall undertake additional measures such as Data Protection Impact
Assessments, independent data audits, appointment of a formal Data Protection
Officer, or other Significant Data Fiduciary obligations only if:

• STCNET is notified as a Significant Data Fiduciary;
• such measure becomes legally required;
• such measure becomes reasonably necessary due to the nature, scale, or
  risk of processing; or
• STCNET voluntarily adopts such measure as part of its internal governance.

4. PERSONAL DATA WE MAY COLLECT

4.1 Categories of Personal Data

STCNET may collect the following categories of personal data, depending on the
user’s interaction with the platform:

STCNET shall not intentionally collect personal data that is unnecessary for the
disclosed purpose.

4.2 Personal Data of Promoters / Referrers

For Promoters / Referrers, STCNET may collect additional information required
for:

• account creation;
• KYC verification;
• referral attribution;
• commission computation;
• wallet ledger management;
• payout processing;
• TDS and tax compliance;
• fraud prevention;
• duplicate account checks;
• family-stacking / anti-abuse checks;
• grievance handling;
• compliance with direct-selling laws and Company policies.

This may include PAN, bank details, address proof, identity proof, date of birth,
nominee information, tax status, and transaction records.

4.3 Data Not Requested by STCNET

STCNET will never ask users to share:

• OTP;
• UPI PIN;
• card PIN;
• CVV;
• internet-banking password;
• payment password;
• full card number through phone, WhatsApp, SMS, or email.

Users should not share such information with any person claiming to represent
STCNET, Promoter / Referrer, delivery partner, payment partner, or customer
support.

5. HOW PERSONAL DATA IS COLLECTED

STCNET may collect personal data when a user:

• visits the website;
• creates an account;
• places an order;
• makes payment;
• requests cancellation, return, refund, replacement, or exchange;
• registers as a Promoter / Referrer;
• submits KYC documents;
• uses a referral link or code;
• receives or shares referral attribution;
• raises a grievance or support ticket;
• contacts customer support;
• participates in surveys, feedback, campaigns, or promotions;
• interacts with cookies or tracking tools;
• communicates through email, SMS, WhatsApp, call, chat, post, or other
  authorised channels.

STCNET may also receive personal data from:

• payment gateways and payment service providers;
• banks and UPI systems;
• logistics and delivery partners;
• KYC verification service providers;
• fraud-prevention and risk-control service providers;
• customer-support tools;
• hosting and cloud service providers;
• Promoters / Referrers, where referral information is submitted lawfully;
• regulators, authorities, law enforcement, or courts, where applicable.

6. PURPOSES OF PROCESSING

STCNET may process personal data for the following purposes:

6.1 Account and Platform Operation

• creating and managing user accounts;
• enabling login and authentication;
• maintaining account preferences;
• preventing unauthorised access;
• managing customer and Promoter / Referrer dashboards.

6.2 Order, Payment and Delivery

• processing orders;
• accepting payments;
• issuing invoices and receipts;
• arranging delivery;
• tracking shipments;
• processing returns, refunds, cancellations, replacements, or exchanges;
• handling failed payments, duplicate payments, chargebacks, or payment
  disputes.

6.3 Promoter / Referrer Programme

• onboarding Promoters / Referrers;
• verifying identity and KYC;
• assigning referral ID / code;
• tracking referral sales;
• maintaining referral attribution;
• computing commission;
• processing wallet entries and payouts;
• applying TDS and statutory deductions;
• detecting duplicate accounts, fake accounts, proxy accounts, family-
  stacking, circular orders, and commission abuse.

6.4 Customer Support and Grievance Handling

• responding to queries;
• handling complaints;
• assigning ticket numbers;
• verifying order or account details;
• investigating grievances;
• maintaining records of complaint resolution;
• communicating decisions, delays, or remedies.

6.5 Legal and Regulatory Compliance

• complying with consumer protection laws;
• complying with direct-selling laws;
• complying with GST, income-tax, accounting, audit, and company-law
  requirements;
• maintaining statutory records;
• responding to regulators, authorities, courts, law enforcement, auditors,
  payment partners, banks, or professional advisors;
• preventing unfair trade practices, fraud, cybercrime, and misuse.

6.6 Security and Fraud Prevention

• securing accounts;
• detecting unauthorised transactions;
• preventing fake orders, duplicate accounts, misuse of offers, chargeback
  abuse, data misuse, referral abuse, and commission manipulation;
• monitoring suspicious activity;
• preserving evidence for legal, audit, or compliance purposes.

6.7 Communication and Service Updates

• sending order confirmations;
• sending payment updates;
• sending dispatch and delivery updates;
• sending refund and return updates;
• sending policy updates;
• sending grievance or support responses;
• sending essential service messages.

Marketing, promotional, or optional communication shall be sent only where
permitted by law and user preference.

6.8 Analytics and Improvement

• improving website functionality;
• understanding platform usage;
• improving product listings, delivery, support, and customer experience;
• testing security and performance;
• fixing bugs and technical issues;
• generating aggregated or anonymised insights.

Where feasible, STCNET may use aggregated, anonymised, or de-identified data
that does not identify a specific individual.

7. LEGAL BASIS / LAWFUL PROCESSING

STCNET processes personal data where permitted under applicable law,
including where:

• the Data Principal has given consent for a specified purpose;
• processing is necessary to provide products, services, accounts, payments,
  refunds, delivery, support, or Promoter / Referrer participation requested
  by the Data Principal;
• processing is required to comply with law;
• processing is necessary for responding to grievances, complaints, legal
  claims, regulatory requests, or statutory duties;
• processing is necessary for preventing fraud, cyber incidents, payment
  abuse, unauthorised transactions, platform misuse, or direct-selling
  compliance violations;
• processing is otherwise permitted as a legitimate use under applicable data
  protection law.

STCNET shall not process personal data for purposes that are unlawful or
unrelated to the disclosed purpose, except where permitted by applicable law.

8. CONSENT MANAGEMENT

8.1 Consent Collection

Where consent is required, STCNET shall obtain consent through clear and
affirmative action, such as:

• account registration;
• checkout confirmation;
• KYC submission;
• form submission;
• checkbox selection;
• cookie preference selection;
• marketing opt-in;
• acceptance of platform terms;
• other lawful digital consent mechanism.

Consent shall be linked to a specific purpose wherever required under applicable
law.

8.2 Notice

STCNET shall provide a privacy notice or disclosure explaining the personal data
being processed, purposes of processing, user rights, grievance contact, and other
required information.

Such notice may be provided through:

• this Privacy Policy;
• just-in-time notices;
• consent forms;
• KYC forms;
• checkout notices;
• cookie banner;
• account settings;
• campaign or communication-specific notices.

8.3 Withdrawal of Consent

A Data Principal may withdraw consent where processing is based on consent.

Consent may be withdrawn through:

• account settings, where available;
• unsubscribe link, where available;
• cookie preference centre, where available;
• email to privacy@stcnet.in;
• grievance mechanism.

Withdrawal of consent shall not affect processing already completed before
withdrawal.

After withdrawal, STCNET may stop the related service or feature where the
personal data is necessary to provide that service, and may continue processing
where required or permitted by law, including for tax, accounting, legal, fraud-
prevention, dispute-resolution, record-retention, direct-selling compliance, or
regulatory purposes.

8.4 Consent Records

STCNET may maintain records of consent, including:

• date and time of consent;
• purpose of consent;
• version of policy or notice accepted;
• user identifier;
• method of consent;
• withdrawal or modification of consent.

9. COOKIES AND TRACKING TECHNOLOGIES

STCNET may use cookies, pixels, tags, device identifiers, analytics tools, and
similar technologies for:

• website functionality;
• session management;
• login security;
• cart management;
• user preferences;
• analytics;
• performance monitoring;
• fraud prevention;
• marketing or remarketing, where enabled and consented to where
  required.

Non-essential cookies or tracking technologies shall be handled in accordance
with the Cookie & Tracking Consent Policy.

Users may manage cookie preferences through the cookie banner, browser
settings, or other tools made available by STCNET.

10. SHARING AND DISCLOSURE OF PERSONAL DATA

STCNET may share personal data only where necessary and lawful.

STCNET shall obtain consent before sharing personal data with third parties
where consent is required under applicable law.

Consent may not be separately required where sharing is necessary for:

• order fulfilment;
• payment processing;
• refund processing;
• delivery or return pickup;
• KYC verification;
• commission payout processing;
• customer support;
• grievance handling;
• fraud prevention;
• security;
• legal compliance;
• regulatory reporting;
• audit;
• tax or accounting purposes;
• processing by Data Processors acting on behalf of STCNET under
  appropriate safeguards.

STCNET may share personal data with the following categories of recipients:

STCNET shall not sell personal data.

STCNET shall not rent, trade, or commercially disclose personal data to unrelated
third parties for their independent marketing purposes without lawful basis.

11. THIRD-PARTY SERVICE PROVIDERS

STCNET may use third-party service providers to support its operations.

Such service providers may process personal data only for authorised purposes
and subject to appropriate contractual, technical, and organisational safeguards,
where applicable.

Third-party service providers may have their own privacy policies where users
directly interact with them, such as payment gateways, UPI apps, banks, logistics
providers, or external portals.

Users are encouraged to review third-party privacy policies where they directly
use third-party services.

12. CROSS-BORDER TRANSFER

STCNET may store or process personal data in India and may use service
providers, systems, or infrastructure located in India or outside India, subject to
applicable law.

STCNET shall transfer personal data outside India only in accordance with
applicable law, Government notifications, permitted transfer conditions,
contractual safeguards, security measures, and lawful business requirements.

STCNET shall not knowingly transfer personal data to any country, territory,
person, or class of persons where such transfer is restricted or prohibited by the
Central Government under applicable law.

Where a specific law, contract, regulatory requirement, or direct-selling
compliance requirement requires data to be stored or maintained in India,
STCNET shall comply with such requirement.

13. DATA STORAGE, SECURITY AND SAFEGUARDS

13.1 Storage

Personal data may be stored on STCNET systems, cloud infrastructure, databases,
backups, service-provider systems, payment records, logistics systems, customer
support systems, KYC systems, compliance records, and legally required records.

STCNET shall take reasonable steps to store personal data in a secure and
controlled manner.

13.2 Security Safeguards

STCNET shall implement security safeguards appropriate to the nature, scale, and
sensitivity of the personal data processed.

Such safeguards may include:

• HTTPS / SSL / TLS encryption for data transmission;
• role-based access control;
• restricted access on a need-to-know basis;
• strong authentication for administrative access;
• password and account-security controls;
• network firewalls and hosting security controls;
• malware, intrusion, and suspicious-activity monitoring where feasible;
• audit logs for relevant access and administrative activity;
• data backup and recovery controls;
• internal confidentiality obligations;
• access-right review and deactivation of unnecessary access;
• employee, contractor, and vendor awareness measures;
• incident response procedures;
• secure disposal, deletion, anonymisation, or archival practices where
  applicable;
• other safeguards considered appropriate by STCNET based on risk, cost,
  technology, legal requirement, and operational feasibility.

No website, system, or transmission method can be guaranteed to be completely
secure. STCNET shall take appropriate safeguards but cannot guarantee absolute
security against every cyber risk, attack, unauthorised access, or technical failure.

13.3 Payment Security

STCNET does not intentionally store full card numbers, CVV, card PIN, UPI PIN,
banking passwords, or payment authentication credentials on its ordinary
platform servers.

Payments are processed through authorised payment service providers, banks,
card networks, UPI systems, or payment gateways, as applicable.

Users must not share OTP, UPI PIN, card PIN, CVV, password, or banking
credentials with any person.

14. DATA RETENTION AND DELETION

14.1 Retention Principle

STCNET shall retain personal data only for as long as necessary for the purpose
for which it was collected, or for such longer period as may be required or
permitted under applicable law, tax law, accounting requirements, consumer
protection requirements, direct-selling requirements, audit needs, fraud-
prevention needs, dispute resolution, regulatory requirements, or legal
proceedings.

14.2 Indicative Retention Periods

The following records may be retained for up to 8 years where commercially and
legally appropriate:

• transaction and invoice records for GST, tax, accounting, audit, and legal
  compliance;
• KYC records of Promoters / Referrers for regulatory, payout, tax, audit, and
  fraud-prevention purposes;
• commission, wallet, payout, TDS, and reversal records for audit, tax,
  accounting, and direct-selling compliance;
• grievance, complaint, return, refund, chargeback, and dispute records for
  legal, regulatory, audit, and consumer-protection purposes;
• delivery, fulfilment, and logistics records linked to orders, returns, refunds,
  or disputes;
• records required to defend legal claims, respond to regulators, or preserve
  evidence.

All other personal data shall be retained only for as long as necessary for the
relevant purpose or as required or permitted under applicable law or Company
policy.

14.3 Deletion and Anonymisation

Upon valid request or expiry of retention requirement, STCNET may delete,
anonymise, de-identify, archive, or restrict personal data in accordance with
applicable law and Company policy.

Deletion may not be possible where retention is required for:

• tax compliance;
• GST compliance;
• accounting records;
• legal claims;
• regulatory obligations;
• fraud prevention;
• grievance records;
• direct-selling compliance;
• payment disputes;
• security investigations;
• audit requirements.

15. DATA PRINCIPAL RIGHTS

Subject to applicable law, Data Principals may have the following rights:

15.1 Right to Access Information

Data Principals may request information regarding personal data processed by
STCNET and the processing activities undertaken, subject to applicable legal
limitations.

15.2 Right to Correction, Completion and Updating

Data Principals may request correction of inaccurate personal data, completion
of incomplete personal data, or updating of outdated personal data.

STCNET may require verification before making such changes.

15.3 Right to Erasure

Data Principals may request erasure of personal data, subject to legal,
contractual, tax, accounting, fraud-prevention, regulatory, audit, grievance, and
dispute-resolution retention requirements.

15.4 Right to Withdraw Consent

Where processing is based on consent, Data Principals may withdraw consent in
accordance with Section 8.3 of this Policy.

15.5 Right to Grievance Redressal

Data Principals may raise privacy-related grievances through the contact details
provided in this Policy.

15.6 Right to Nominate

Where applicable under law, a Data Principal may nominate another individual
to exercise rights on their behalf in the event of death or incapacity.

15.7 How to Exercise Rights

To exercise privacy rights, contact:

STCNET may require identity verification before processing a request.

STCNET shall respond to Data Principal requests within a reasonable timeframe,
ordinarily within 30 days of receipt of a valid and complete request, subject to
identity verification, request complexity, legal restrictions, and operational
feasibility.

16. CHILDREN’S PRIVACY

STCNET’s products, platform, and Promoter / Referrer programme are not
intended for use by children below 18 years of age without lawful guardian
involvement where required.

STCNET does not knowingly process children’s personal data in a manner
prohibited by applicable law.

Where STCNET processes personal data of a child, it shall do so in accordance
with applicable law, including requirements relating to verifiable parental or
guardian consent where required.

STCNET shall not knowingly undertake tracking, behavioural monitoring, or
targeted advertising directed at children in violation of applicable law.

If a parent or lawful guardian believes that a child’s personal data has been
provided to STCNET without lawful authority, they may contact
privacy@stcnet.in for review and appropriate action.

17. DATA BREACH AND INCIDENT RESPONSE

17.1 Data Breach Handling

In the event of a personal data breach, security incident, unauthorised access,
unauthorised disclosure, accidental loss, alteration, or destruction of personal
data, STCNET shall take reasonable steps to:

• assess the nature and scope of the incident;
• contain the incident where feasible;
• investigate affected systems and data;
• take remedial measures;
• preserve relevant records;
• notify affected Data Principals where required under applicable law;
• notify the Data Protection Board of India or any other competent authority
  without undue delay, where required under applicable law;
• cooperate with lawful investigation, direction, or regulatory process.

17.2 Breach Records

STCNET may maintain records of:

• nature of breach;
• date and time of detection;
• categories of personal data involved;
• number or category of affected persons, where known;
• containment steps;
• remedial action;
• notifications issued;
• internal investigation;
• lessons learned and security improvements.

18. PRIVACY CONTACT / OFFICER

STCNET may designate a Privacy Officer, Data Protection Contact, or equivalent
responsible person for privacy governance and grievance handling where such

role becomes required under applicable law or where STCNET considers it
appropriate for operational effectiveness.

The Privacy Contact may:

• receive privacy-related requests;
• coordinate Data Principal rights requests;
• handle privacy grievances;
• coordinate with internal teams and service providers;
• support data protection compliance;
• coordinate with regulators or authorities where required;
• review and update this Policy.

Appointment of a Privacy Officer / Data Protection Contact does not mean STCNET
is a Significant Data Fiduciary unless STCNET is specifically notified or legally
required to comply as such.

19. PRIVACY GRIEVANCE REDRESSAL

19.1 Filing a Privacy Grievance

A Data Principal may file a privacy grievance relating to:

• access to personal data;
• correction or erasure request;
• withdrawal of consent;
• unauthorised data processing;
• suspected data breach;
• marketing communication;
• data sharing;
• data retention;
• misuse of personal data;
• child data concerns.

Privacy grievances may be submitted to:

Email: privacy@stcnet.in
General Grievance: grievance@stcnet.in
Website: www.stcnet.in/grievance

19.2 Grievance Handling

Privacy grievances shall be handled in accordance with the applicable grievance
redressal provisions under the DPDP Act, this Privacy Policy, and STCNET’s
Grievance Redressal & Consumer Complaints Policy.

STCNET may require identity verification and supporting documents before
acting on a request.

19.3 External Escalation

Where permitted under applicable law, and after exhausting STCNET’s internal
grievance mechanism, a Data Principal may approach the Data Protection
Board of India or any other competent authority/forum available under
applicable law.

20. DATA PRINCIPAL DUTIES

Users and Data Principals are expected to:

• provide accurate and complete information;
• keep account credentials confidential;
• not impersonate another person;
• not submit false, forged, misleading, or third-party personal data without
  authority;
• update information when it changes;
• cooperate with verification requests;
• not misuse privacy rights or grievance channels;
• report unauthorised access or suspected breach promptly.

Liability limitations arising from user negligence, credential sharing,
unauthorised third-party data submission, payment outside official channels, or
misuse shall be governed by STCNET’s Terms & Conditions, applicable law, and
the facts of the case.

21. RECORDS, AUDIT AND GOVERNANCE

21.1 Records

STCNET may maintain records relating to:

• personal data processing;
• consent;
• notice;
• withdrawal of consent;
• Data Principal requests;
• privacy grievances;
• KYC;
• security measures;
• breach incidents;
• third-party sharing;
• data retention;
• deletion/anonymisation;
• audits and compliance reviews.

21.2 DPIA, Audit and Enhanced Measures

STCNET shall conduct Data Protection Impact Assessments, independent data
audits, enhanced reporting, or similar Significant Data Fiduciary-level measures
only if:

• STCNET is notified as a Significant Data Fiduciary;
• such measure becomes required under applicable law;
• such assessment is otherwise legally required; or
• STCNET voluntarily determines that a specific processing activity involves
  significant risk and such assessment is appropriate.

21.3 Audit Readiness

Records may be maintained in a manner reasonably designed to support:

• internal audit;
• regulatory inspection;
• grievance resolution;
• breach investigation;
• legal proceedings;
• vendor review;
• tax and accounting compliance;
• direct-selling compliance;
• consumer protection compliance.

22. CHANGES TO THIS POLICY

STCNET may amend, revise, update, or replace this Policy from time to time to
reflect changes in law, regulatory requirements, business operations, technology
systems, data practices, vendor arrangements, security controls, or internal
compliance practices.

Where required by law, STCNET may provide notice of material changes or seek
fresh consent.

The latest version published on STCNET’s website shall prevail.

23. RELATED POLICIES

This Policy should be read together with:

1. Legal Entity & Statutory Disclosures

2. Consumer Protection (Direct Selling) Compliance Statement

3. Promoter / Referrer Code of Conduct

4. Compensation Structure & Commission Disclosure

5. Grievance Redressal & Consumer Complaints

6. Returns, Refunds & Cancellation

7. Pricing, Payments & Charges

8. Shipping, Delivery & Fulfilment

9. Terms & Conditions (Website Use)

10. Product / Service Regulatory Disclosures

11. Cookie & Tracking Consent Policy

12. No Income Guarantee Disclaimer

13. Compliance Index & Statutory Mapping

End of Policy #9 – Privacy Policy