PRIVACY POLICY

Workiffy (“Workiffy”, “we”, “us” or “our”) respects the privacy of individuals who interact with us and is committed to handling personal information in accordance with applicable Indian law.

This Privacy Policy describes how Workiffy may collect, receive, use, process, store, retain, disclose, transfer and protect personal information through:

• www.workiffy.com and its associated webpages
• Enquiry, contact, booking and account facilities
• Email, telephone, WhatsApp and social-media communications
• Meetings, consultations, proposals and client onboarding
• Product-development, R&D, manufacturing-consultancy and project-management services
• Vendor, manufacturer, laboratory, consultant and business-partner coordination
• Payments, invoices and contractual administration
• Recruitment, internship and professional applications

By voluntarily providing information to Workiffy, you confirm that the information is lawfully provided and acknowledge the practices described in this Policy. Where consent is required by applicable law, Workiffy will obtain it through an appropriate written, electronic or affirmative mechanism. Mere continued use of the website will not be treated as consent where express or specific consent is legally required.

1. Scope and Contractual Priority

This Policy governs Workiffy’s handling of personal information. It does not by itself determine:

• Ownership of recipes, formulations, designs, documents or intellectual property
• Commercial confidentiality or exclusivity
• Non-circumvention obligations
• Scope, pricing or performance of professional services
• Commercial warranties, indemnities or limitations of liability

Those matters will be governed by the applicable quotation, proposal, engagement letter, non-disclosure agreement, terms and conditions or other written agreement.

Where a project-specific written agreement contains more specific provisions concerning project information or confidentiality, those provisions will apply to that project, subject to mandatory law.

2. Categories of Information We May Collect

Depending on your interaction with Workiffy, we may collect the following categories of information.

2.1 Identity and Contact Information

• Name
• Mobile or telephone number
• Email address
• Residential, postal or business address
• City, state and country
• Designation and professional role
• Preferred method of communication

2.2 Business and Professional Information

• Company, firm, brand or organisation name
• Nature of business and industry
• Business and manufacturing location
• GST, registration and invoicing information
• Product category, target capacity and proposed investment
• Project requirements and commercial objectives
• Information about authorised representatives and project stakeholders

2.3 Project and Service Information

• Product concepts and development requirements
• Technical questions and specifications
• Manufacturing, factory, machinery and supply-chain information
• Documents, files, reports, photographs, videos or samples provided to us
• Project correspondence, instructions, feedback and approvals
• Meeting notes and service records
• Complaints and quality-related communications
• Quotations, proposals, contracts and payment status

Technical information, recipes, formulations, processes, designs and commercial documents may not always constitute personal information. Their confidentiality and permitted use will be governed by applicable agreements and law.

2.4 Account, Booking and Transaction Information

• Account and profile information
• Login and authentication records
• Consultation or meeting bookings
• Selected services
• Billing, invoice and payment records
• Transaction references
• Communications relating to an account or transaction

Complete card credentials are generally processed by banks or payment-service providers. Workiffy does not ordinarily retain complete payment-card credentials.

2.5 Website and Technical Information

• Internet Protocol address
• Browser, device and operating-system information
• Approximate location derived from an IP address
• Referring source
• Pages visited and time spent on the website
• Website interactions and form activity
• Account-access and security logs
• Cookie and analytics identifiers

2.6 Recruitment Information

If you apply for employment, internship, consultancy or another professional association, Workiffy may collect your résumé, qualifications, work history, contact information, interview records, expected compensation and documents voluntarily submitted with the application.

2.7 Sensitive Personal Data or Information

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, certain information may be treated as sensitive, including passwords, financial information, health information, medical records, sexual orientation and biometric information.

Workiffy does not seek such sensitive information through general website enquiry forms unless it is reasonably necessary for a lawful and disclosed purpose. Where Workiffy collects sensitive personal data or information, it will seek the consent required by applicable law and apply appropriate safeguards.

Users should not submit passwords, complete payment credentials, biometric information, medical records or other highly sensitive information through general enquiry forms, ordinary social-media messages or unsecured channels.

3. How Information May Be Collected

Workiffy may collect information:

• Directly from you
• Through its website, forms, accounts or booking functions
• Through email, WhatsApp, telephone, meetings or social media
• From your authorised representative or organisation
• From referral partners or project stakeholders
• From vendors, laboratories, manufacturers or consultants involved in an authorised project
• From payment, booking, hosting and communication providers
• From publicly available business or professional sources, where collection and use are lawful

4. Responsibility for Information Provided

You are responsible for ensuring that information provided to Workiffy is accurate, complete, lawful, relevant and not misleading.

If you provide information relating to an employee, representative, customer, vendor, partner or another individual, you represent that you are authorised to provide it and have given any notice or obtained any consent required by law.

Workiffy may rely on the information and authority represented by the person submitting it. To the extent permitted by law, Workiffy will not be responsible for the authenticity of personal information supplied by the provider of that information.

Workiffy may seek clarification, decline a submission or restrict further processing where information is irrelevant, excessive, unlawful, suspicious, misleading or not reasonably required for the requested service.

5. Unsolicited Confidential Information

Visitors should not submit recipes, formulations, trade secrets, complete financial credentials, government identification documents or other highly confidential information before an appropriate written confidentiality or service agreement is executed.

The unsolicited submission of business or technical information does not, by itself:

• Create a client, advisory, fiduciary, partnership or contractual relationship
• Require Workiffy to accept or undertake a project
• Establish exclusivity
• Transfer intellectual-property rights
• Prevent Workiffy from using its pre-existing or independently developed knowledge, methods, templates and experience

This clause does not permit Workiffy to misuse personal information or confidential information protected by an applicable written agreement or law.

6. Purposes of Collection and Processing

Workiffy may process information for lawful and reasonably necessary purposes, including:

• Responding to enquiries and assessing proposed projects
• Identifying or verifying a person or authorised representative
• Scheduling consultations, meetings, trials and site visits
• Preparing quotations, proposals, contracts and project plans
• Providing product-development, R&D, factory-setup, manufacturing-consultancy, machinery, supply-chain, compliance-coordination and project-management services
• Coordinating authorised work with laboratories, manufacturers, co-packers, vendors, technical consultants and logistics providers
• Managing client, vendor and business-partner relationships
• Maintaining accounts, bookings and project records
• Processing invoices, payments and commercial records
• Communicating instructions, approvals, deliverables, reminders and project updates
• Handling feedback, grievances, disputes and quality concerns
• Conducting internal administration, audit, training, quality control and risk management
• Improving our services, website, templates, processes and internal methodologies
• Producing aggregated or de-identified statistics and business insights
• Protecting Workiffy, its clients, personnel, systems, information and commercial interests
• Detecting or preventing fraud, misuse, unauthorised access or unlawful activity
• Enforcing contracts and recovering outstanding payments
• Establishing, exercising or defending legal claims
• Meeting tax, accounting, regulatory and legal obligations
• Evaluating candidates and administering recruitment
• Carrying out another purpose for which notice and consent are provided where required

Information collected for a stated purpose will not be used for an incompatible purpose unless such use is permitted by law or fresh notice and consent are provided where required.

7. Legal Basis and Consent

Workiffy may process personal information:

• With the individual’s valid consent
• To respond to a request voluntarily made by the individual
• To take requested steps before entering into a contract
• To perform, administer or enforce a contract
• For a lawful purpose connected with Workiffy’s functions or activities
• For certain legitimate uses expressly permitted by applicable law
• To comply with accounting, taxation, regulatory or legal obligations
• To protect legal rights, safety, property or information systems
• As otherwise permitted or required by law

Where consent is the basis of processing, the individual may withdraw that consent in writing. Withdrawal will apply prospectively and will not affect processing lawfully undertaken before withdrawal.

If information is necessary to provide a requested service, Workiffy may be unable to provide or continue that service if the information is not provided or consent is withdrawn. Workiffy may retain information where retention remains necessary under a contract or applicable law or for accounting, regulatory, dispute-resolution or legal purposes.

8. Business and Marketing Communications

Where you provide contact details in connection with an enquiry, booking or project, Workiffy may use those details to:

• Respond to the enquiry
• Schedule meetings
• Share proposals or requested information
• Seek instructions, approvals or clarification
• Send invoice, payment or project reminders
• Provide service, security and administrative updates
• Maintain evidence of business communications

Marketing or promotional communications will be sent subject to applicable consent, telecom and communication requirements. You may withdraw from promotional communications using the unsubscribe mechanism or by contacting Workiffy.

Opting out of marketing will not prevent necessary project, contractual, payment, legal or security communications.

9. Cookies and Website Analytics

The website may use cookies and similar technologies for:

• Essential website operation
• Account and booking functionality
• Security and fraud prevention
• Remembering preferences
• Measuring website traffic
• Understanding aggregated website use
• Assessing marketing performance

Where legally required, non-essential cookies will be activated only after an appropriate choice or consent. Users may manage cookies through the available cookie controls or browser settings.

Disabling essential or functional cookies may affect the availability or performance of parts of the website. Workiffy does not guarantee that every website function will remain available where required cookies are disabled.

10. Disclosure to Third Parties

Workiffy may disclose information where reasonably necessary to:

• Website hosting, cloud, cybersecurity and technology providers
• Email, communication, CRM, analytics and booking-service providers
• Banks, payment gateways, accountants and financial-service providers
• Laboratories, manufacturers, co-packers and packaging partners
• Machinery suppliers, logistics providers and technical consultants
• Employees, contractors and representatives who require authorised access
• Legal advisers, auditors, insurers and compliance professionals
• Government, judicial, regulatory or law-enforcement authorities
• A successor, purchaser or investor in connection with a lawful restructuring, merger or transfer
• Other parties authorised by the information provider

Sensitive personal data or information will be disclosed to a third party only with prior permission, where the disclosure has been agreed in the applicable contract, where necessary for compliance with a legal obligation or where otherwise permitted or required by law.

Where a project requires laboratory testing, vendor quotation, manufacturing, procurement, packaging, logistics, compliance or technical evaluation, information reasonably necessary for that authorised purpose may be shared with relevant project participants in accordance with consent, the applicable contract and law.

Workiffy does not ordinarily sell or rent personal information as an independent commercial product.

11. Service Providers and Project Partners

Third-party service providers may process information on behalf of Workiffy. Workiffy will take reasonable steps appropriate to the nature of the service to require confidentiality, security and purpose-limited processing.

Some project participants, professional advisers or third-party platforms may independently determine how they process information. Their independent activities may be governed by their own legal obligations and privacy policies.

Nothing in this Policy excludes Workiffy’s responsibility for processing undertaken on its behalf where such responsibility is imposed by applicable law.

12. International Transfer or Processing

Certain hosting, cloud, communication, analytics or technology providers may process information outside India.

While the SPDI Rules, 2011 remain applicable, sensitive personal data or information will be transferred only where the recipient provides the level of protection required by those Rules and the transfer is necessary for performance of a lawful contract or the information provider has consented to the transfer.

When the relevant provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 become applicable, transfers will also be subject to restrictions or requirements notified by the Central Government.

13. Retention

Workiffy will retain identifiable personal information only for as long as reasonably necessary for the purpose for which it was collected or as required or permitted under applicable law.

Information may be retained for purposes including:

• Evaluating, performing or completing a project
• Maintaining contractual, technical and quality records
• Providing follow-up or related services
• Maintaining invoice, tax, accounting and payment records
• Preserving instructions, approvals and project communications
• Recovering outstanding amounts
• Handling complaints, claims or disputes
• Preventing fraud, circumvention or misuse
• Establishing, exercising or defending legal rights

When identifiable information is no longer required, Workiffy may delete it, securely destroy it or convert it into aggregated or de-identified information.

Aggregated or irreversibly de-identified information may be retained and used for internal analysis, statistics, service improvement and business planning because it no longer identifies an individual.

A deletion request will not require Workiffy to erase information that must or may lawfully be retained for an ongoing service, contractual obligation, statutory record, claim, dispute, fraud-prevention measure or other lawful purpose.

14. Information Security

Workiffy will use reasonable managerial, technical, operational and physical security measures appropriate to the nature of the information and its business.

Measures may include access restrictions, authentication controls, confidentiality obligations, backups, secure storage, vendor controls, device protection, system monitoring and incident-response practices.

No internet transmission, device, website or electronic-storage system can be guaranteed to be completely secure. Users are responsible for protecting their own devices, accounts, passwords and communication channels and should not transmit highly sensitive information through unsecured or public channels.

The occurrence of an attempted intrusion, cyberattack, service-provider failure or security incident does not by itself determine legal liability. Any liability will be assessed according to the facts, causation, applicable law and relevant contractual terms.

Nothing in this Policy excludes Workiffy’s obligation to implement reasonable security practices or any liability that cannot lawfully be excluded.

15. Personal Data or Security Breach

If Workiffy becomes aware of a personal-data or information-security breach affecting information under its control, it will take reasonable steps to investigate, contain and mitigate the incident.

Workiffy will notify affected individuals, the Data Protection Board of India, CERT-In or another competent authority where and within the period required by the law applicable to the incident.

Nothing in this section constitutes a representation that every attempted intrusion, vulnerability or third-party incident can be prevented or immediately detected.

16. Review, Correction, Consent Withdrawal and Other Rights

Subject to the law applicable at the relevant time, an individual may request:

• Review of personal information supplied by that individual
• Correction or completion of inaccurate or deficient information, where feasible
• A summary of personal data being processed, when the DPDP provisions apply
• Erasure of personal data where no lawful reason for continued retention exists
• Withdrawal of consent for future consent-based processing
• Discontinuation of promotional communications
• Grievance redressal
• Nomination of another individual to exercise applicable DPDP rights in the event of death or incapacity, when that right becomes applicable

To process a request, Workiffy may require:

• Full name
• Registered email address or telephone number
• Company, project or booking reference
• A clear description of the request
• Reasonable proof of identity or authority

Workiffy may seek clarification or decline to act where a request cannot be verified or where refusal or continued retention is authorised or required by law. Rights will be handled subject to applicable exemptions and legal limitations.

17. Grievance Redressal

As of the Effective Date of this Policy, grievances covered by the SPDI Rules, 2011 will be addressed expeditiously and within one month from the date of receipt, as required by those Rules.

When the relevant DPDP provisions and Rules become applicable, requests and grievances covered by that framework will be handled within the period required by that framework, which will not exceed the applicable statutory maximum.

Before approaching the Data Protection Board of India in a matter governed by the DPDP framework, the individual should first exhaust the grievance-redressal mechanism provided by Workiffy to the extent required by applicable law.

18. Children’s Information

Workiffy’s website and professional services are intended primarily for adult business users.

Workiffy does not knowingly solicit personal information from persons under 18 years of age through general website facilities. Where processing of a child’s personal data is necessary and the relevant DPDP provisions apply, Workiffy will obtain verifiable consent from the parent or lawful guardian and observe applicable restrictions.

Workiffy may restrict or delete information where age or parental authority cannot reasonably be verified.

19. Third-Party Websites and Platforms

The website may contain links to or functions provided by WhatsApp, social-media platforms, payment gateways, booking providers and other third parties.

Independent third parties operate under their own terms and privacy policies. Workiffy does not control and is not responsible for their independent privacy, security, availability or data-processing practices.

To the extent permitted by law, Workiffy will not be responsible for:

• Independent acts or omissions of third-party platforms
• Interruptions or failures outside Workiffy’s reasonable control
• Compromise of a user’s own device, password, email or account
• Information voluntarily posted by a user on a public platform
• Loss caused by a user’s failure to follow reasonable security precautions

This clause does not exclude any responsibility that applicable law places on Workiffy for its selection, instruction or use of a processor acting on its behalf.

20. Limitation of Liability

To the maximum extent permitted by applicable law:

• Workiffy will not be liable for indirect, incidental, special, exemplary, punitive or consequential loss arising solely from use of the website or an independent third-party platform
• Workiffy will not be responsible for loss caused by inaccurate, unlawful or unauthorised information supplied by a user
• Workiffy will not be responsible for disclosure caused by a user sending information through a public, incorrect or unauthorised channel
• Commercial liability connected with a client project will be determined by the applicable proposal, agreement and terms and conditions

Where liability cannot lawfully be excluded, responsibility will be determined according to applicable law, proven breach, causation and legally recoverable loss.

Nothing in this Policy:

• Waives a statutory privacy right
• Excludes Workiffy’s liability for its own negligence where such liability cannot be excluded
• Limits the powers of a competent statutory authority
• Overrides a mandatory remedy available under Indian law

21. Changes to This Policy

Workiffy may update this Policy to reflect changes in law, website features, technology, security practices, services or processing activities.

The updated Policy will be published on the website with a revised “Last Updated” date. Material changes affecting the purpose of processing or requiring fresh consent will be notified, and consent will be obtained where required.

Continued use of the website after publication may constitute acknowledgement of the updated Policy, but it will not substitute for consent where consent is legally required.

22. Grievance Redressal Authority and Privacy Contact

Privacy enquiries, correction requests, consent withdrawals and grievances may be submitted to:

Grievance Redressal Authority: Workiffy Management Team and Founder

Designated Individual Contact: Gaurav Kumar, Founder, acting on behalf of the Workiffy Management Team

Business: Workiffy

Address: alt.f, Altf Tower, Noida Expressway, Sector 142, Noida, Uttar Pradesh, India

Telephone/WhatsApp: +91 87503 51947

Website: www.workiffy.com

Submission Channel: Website “Contact Us” form or the contact number stated above

The communication should clearly state “Privacy Request” or “Data Grievance” and include sufficient information to identify the requester and relevant records.

Workiffy may require reasonable verification before disclosing, correcting or deleting personal information.

23. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the SPDI Rules, 2011 while applicable, and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 as and when their relevant provisions become applicable.

Subject to mandatory statutory forums, consumer forums and jurisdictional requirements that cannot lawfully be excluded, disputes relating to this Policy will be subject to the exclusive jurisdiction of courts of competent jurisdiction at New Delhi, India.

24. Severability, No Waiver and Statutory Savings

If a provision of this Policy is held invalid or unenforceable, it will be modified or severed only to the minimum extent necessary, and the remaining provisions will continue to apply.

Failure by Workiffy to enforce a provision on one occasion will not constitute a continuing waiver of that provision.

Nothing in this Policy will be interpreted to reduce a mandatory obligation or statutory right under applicable Indian law.