PRIVACY POLICY

1.1 About this Policy. This Privacy Policy (“Policy”) is issued by Prudentbit, a company incorporated under the Companies Act, 2013, having its registered office at Ground Floor, B-1/28, Sector 18, Noida, Uttar Pradesh 201301 (“Prudentbit”, “we”, “us” or “our”). It explains how we collect, use, disclose, store and protect personal data in connection with the ImmuneFiles website at www.immunefiles.com, the ImmuneFiles web application, the Desktop App for Microsoft Windows, Mac OS, iOS and Android applications, our browser extensions and add-ins for Gmail, Outlook and Microsoft Teams, our integrations and related services (together, the “Services”), and the rights available to you.

1.2 A business service. ImmuneFiles is offered only to organisations (each, a “Customer”). Each Customer is provided with its own separate organisational account (a “Tenant”), which is managed by the Customer’s administrators. Our contract with each Customer is our Terms of Service, available at www.immunefiles.com/terms. This Policy is a notice to individuals and does not form part of that contract.

1.3 In brief. We collect only what is necessary to operate a secure file-sharing service for organisations. We do not sell personal data. We do not use files, or data received from Google, for advertising. Our AI masking feature runs on our own models on our own servers, and we never send files to third-party AI providers or use them to train our models. Customers may keep their files in their own storage, in which case we do not store the file contents. Persons who receive shared files do not need an account, and webcam images from proctored viewing are never stored. You may contact our Grievance Officer at any time (Section 19).

2.1 In this Policy:

• “Administrator” means a person designated by a Customer to manage its Tenant;
• “Customer Data” means the files and other content that a Customer and its users upload to, sync with or share through the Services;
• “DPDP Act” means the Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules, 2025;
• “IT Rules” means the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• “personal data” means any data about an individual who is identifiable by or in relation to such data;
• “Recipient” means a person, other than a user of a Customer’s Tenant, with whom a file is shared through the Services, or who uploads a file to a Customer through a file-request link; and
• “SPDI Rules” means the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

3.1 Where we decide. We act as the data fiduciary (or controller), and are responsible for personal data, when we handle: account and billing contact information of our Customers; information about visitors to our website; sales and support enquiries; and security, device and usage data needed to operate and protect the Services.

3.2 Where a Customer decides. When a Customer uses the Services, the files it uploads, and the data collected about its users and its Recipients, are processed on behalf of that Customer and in accordance with its instructions. The Customer is the data fiduciary (or controller) of such data, and its own privacy notice applies. We act as its data processor (or processor).

3.3 If your organisation gave you access. If your account was created by your employer or another organisation, that organisation controls your account. Its Administrators may manage your settings, view activity logs, and access, transfer or delete the files in your account. Requests relating to such data should be directed to your organisation, and we shall assist it in responding.

3.4 If a file was shared with you. If you are a Recipient, the Customer that shared the file determines what data is collected about your access. Before you open the file, we display a notice stating that your access is logged and may be monitored, with links to this Policy and our Terms of Service, and, where proctored viewing is enabled, a request for permission to use your webcam.

5.1 Applicable law. In India, until the substantive provisions of the DPDP Act come into force (expected in May 2027), we process personal data in accordance with Section 43A of the Information Technology Act, 2000 and the SPDI Rules. Thereafter, we shall process personal data on the basis of your consent or a legitimate use permitted under Section 7 of the DPDP Act. Where the EU or UK General Data Protection Regulation applies, we rely on the legal bases set out below, and where the laws of the United Arab Emirates or the Kingdom of Saudi Arabia apply, we rely on the corresponding bases under those laws.

5.2 Purposes. We process personal data for the following purposes:

5.3 Consent under the SPDI Rules. Where the SPDI Rules require consent in writing for the collection of sensitive personal data or information, such as your password, you provide such consent electronically when you create your account or accept this Policy. You may withdraw such consent, whereupon we shall be unable to provide you with an account.

5.4 New purposes. We shall not use personal data for any new purpose that is incompatible with those set out above without notice to you and, where required, your consent.

5.5 No advertising. We do not use personal data or Customer Data for behavioural or targeted advertising, and we do not sell or rent personal data.

5.6 Artificial intelligence and automated processing. Our AI masking feature runs on models that we operate on our own servers, in the hosting region of your organisation. We do not send files to third-party AI providers, and we do not use files to train our models. Outputs of proctoring and personal data detection flag events for the Customer’s review, and we do not take decisions producing legal or similarly significant effects concerning you solely by automated means.

6.1 Access. The Desktop App for Microsoft Windows accesses only the folders that you select for sync and the files that you open or share through it, and does not scan or upload any other file on your computer. Our mobile applications and browser extensions access only the content that you elect to share or protect through them. When you send a protected link through Gmail, Outlook, Microsoft Teams or WhatsApp, we send the link only and do not read your messages, mailbox or contacts.

6.2 Mobile permissions. Our mobile applications may request access to your camera (for proctored viewing), your location (for geo-fencing), your files and photos (to select files to upload) and notifications. Each permission is used solely for the feature it supports and may be withdrawn through your device settings, whereupon that feature may cease to function.

6.3 Screenshot deterrence. Where enabled by a Customer, our web viewer may detect or block screen-capture tools through browser and operating system interfaces. It does not record or transmit images of your screen. The Desktop App does not provide screenshot deterrence.

6.4 Local storage. Files that you sync or open in the Desktop App are cached on your computer in encrypted form to enable offline working.

6.5 Updates, crash reports and usage analytics. Our Applications check for updates by transmitting their version number and your operating system version to our servers and transmit crash reports and usage analytics (such as the features used), which do not include the contents of your files. We use such data solely to rectify faults and improve the Services.

6.6 Managed devices. Your organisation’s Administrator may control Application settings, view device and sign-in records, and remotely remove cached files from your device.

6.7 Uninstallation. Uninstalling the Desktop App removes the application and its local cache from your computer. Data in your ImmuneFiles account shall remain until it is deleted in accordance with Section 11.

7.1 We do not sell personal data. We disclose personal data only as follows:

• (a)to your organisation: activity logs, device records, Recipient access data and proctoring alerts are made available to the Customer that owns the Tenant or that shared the file;
• (b)to Recipients: when a file is shared, the Services display to the Recipient the name and email address of the sender and the name of the sending organisation;
• (c)to sub-processors: our hosting providers (presently Amazon Web Services and NeevCloud in India, and providers in the relevant region for other regions) and Google Analytics for our website, each bound by written contracts to process data only on our instructions and to protect it.
• (d)to resellers and partners: where your organisation purchases the Services through a reseller or partner, we share account and billing contact details with that partner to the extent required to manage the subscription;
• (e)to professional advisers: such as auditors, lawyers and insurers, under obligations of confidentiality;
• (f)to integrated services that you connect, to the extent required to perform the actions requested by you;
• (g)for legal reasons: where required by law, by an order of a court or by a lawful request of a government authority, or to protect the rights, property or safety of our users, the public or ourselves; and
• (h)in a business transfer: such as a merger, amalgamation or acquisition, subject to obligations of confidentiality and this Policy.

8.1 Google APIs. ImmuneFiles’ use and transfer of information received from Google APIs shall adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

8.2 Limited Use. We use data received from Google, Microsoft and Zoho solely to provide and improve user-facing features that are prominent in the Services. We do not: transfer such data to others save as necessary to provide such features, to comply with law, or in connection with a merger or acquisition; use it for advertising; permit humans to read it unless you consent, it is necessary for security or legal compliance, or it is aggregated and anonymised; or use it to train generalised artificial intelligence or machine learning models.

8.3 Revoking access. You may revoke our access at any time through the permissions page of your Google, Microsoft or Zoho account, or by disconnecting the integration in ImmuneFiles.

9.1 Use of Cookies. We use cookies, local storage and similar technologies on our website and in the Services, as follows:

9.2 No advertising cookies. We do not use advertising or cross-site tracking cookies, and we do not use tracking pixels in our emails.

9.3 Marketing newsletters. We send marketing newsletters only to business contacts who have agreed to receive them, or where the law otherwise permits, and each newsletter contains an unsubscribe link.

9.4 Cookie management. You may manage non-essential cookies through our cookie banner or your browser settings.

10.1 Hosting region. Each Tenant is hosted in the region agreed with the Customer. For Customers in India, we use data centres located in India and operated by Amazon Web Services and NeevCloud. For Customers in the United Arab Emirates and other regions, we host the Tenant in, and store Customer Data only in, that region. Where a Customer uses its own storage or operates ImmuneFiles within its own environment, file contents remain in that storage or environment.

10.2 Remote access. Our support and engineering personnel are in India and the United Arab Emirates and may access a Tenant remotely from outside its region where required to provide support, maintain security or comply with law. We handle support tickets and system emails in-house. Google Analytics, which we use on our website, may process website usage data outside your region.

10.3 Safeguards. Transfers outside India shall comply with the DPDP Act and any restriction notified by the Central Government. For personal data subject to the EU General Data Protection Regulation, we use the Standard Contractual Clauses adopted by the European Commission; for personal data subject to the UK General Data Protection Regulation, the UK International Data Transfer Addendum; and for personal data subject to the laws of the United Arab Emirates or the Kingdom of Saudi Arabia, the transfer mechanisms required by those laws.

11.1 Retention periods. We retain personal data only for so long as is necessary for the purposes set out in this Policy, or as required by law:

11.2 Notice before erasure. Where the law requires us to notify you before erasing data on the ground that its purpose has been fulfilled, we shall do so.

12.1 Security standards. We maintain an information security management system certified to ISO/IEC 27001, and implement reasonable security practices and procedures in accordance with Section 43A of the Information Technology Act, 2000 and the SPDI Rules. These include encryption of files at rest (AES-256) and in transit (Transport Layer Security), logical separation between Tenants, hashed passwords, multi-factor authentication, role-based access control, logging and monitoring, vulnerability management, and obligations of confidentiality on our personnel.

12.2 Access by our personnel. Where files are stored in a Customer’s own storage or environment, our personnel have no access to their contents. Where files are stored in our cloud, we manage the encryption keys and our authorised personnel are therefore technically able to access file contents. They shall do so only where required by law or by an order of a court or government authority, or where the Customer expressly requests it in writing, and all such personnel are bound by written confidentiality obligations.

12.3 Customer-hosted storage. Where a Customer stores files in its own storage, or operates ImmuneFiles within its own environment, the Customer is responsible for the security of that storage or environment.

12.4 Residual risks. No system is completely secure. While we work continuously to prevent unauthorised access, disclosure or alteration of personal data, we cannot guarantee that it will never occur. You can assist by keeping your password and devices secure.

13.1 Data for which we are responsible. If a personal data breach affects data for which we are the data fiduciary, we shall notify the affected individuals, the Data Protection Board of India and any other authority, as required by law, and shall take steps to contain and remediate the breach.

13.2 Data processed for a Customer. If a breach affects data that we process for a Customer, we shall notify that Customer without undue delay, and shall report to CERT-In where required. The Customer, as data fiduciary, is responsible for notifying the Data Protection Board of India and the affected individuals where required, and we shall assist it in doing so.

13.3 CERT-In reporting. We report cyber security incidents to CERT-In within 6 (six) hours where so required.

13.4 Content of notices. Our notices shall describe the nature of the breach, its likely consequences, the measures taken, and the steps that you may take to protect yourself.

14.1 Your rights. Subject to applicable law, you have the right:

• (a)to access a summary of the personal data that we process about you and of the processing activities, and the identities of those with whom it has been shared;
• (b)to correct, complete or update inaccurate or incomplete personal data;
• (c)to erase personal data that is no longer necessary, or that was processed on the basis of consent that you have withdrawn;
• (d)to withdraw consent at any time, as easily as it was given. Withdrawal shall not affect processing already carried out, but some Services may thereafter be unavailable to you;
• (e)to nominate another individual to exercise your rights in the event of your death or incapacity, as provided under the DPDP Act;
• (f)to grievance redressal through our Grievance Officer and, if your grievance is not resolved, to complain to the Data Protection Board of India; and
• (g)where the EU or UK General Data Protection Regulation, or the laws of the United Arab Emirates or the Kingdom of Saudi Arabia, apply, to object to or restrict processing, to data portability, and to complain to the competent supervisory authority.

14.2 Exercise of rights. You may exercise your rights by writing to contact@prudentbit.com. We shall verify your identity before acting on a request, and shall respond within 30 (thirty) days, or such shorter period as the law may require.

14.3 Data held for a Customer. If your request concerns data that we process for a Customer, such as files within your organisation’s Tenant, a file shared with you, or your viewing records, we shall refer it to that Customer and assist it in responding.

14.4 Marketing. You may unsubscribe from marketing newsletters through the link contained in each of them. We shall continue to send essential service messages concerning your account, security and billing.

14.5 Your duties. Under Section 15 of the DPDP Act, you shall not furnish false particulars, suppress material information or impersonate another person when exercising your rights, and shall not register any false or frivolous grievance.

15.1 Age requirement. ImmuneFiles is a business service for organisations. It is not offered to, and shall not be used by, any person below 18 (eighteen) years of age, whether as a user or as a Recipient of shared files. Customers are contractually required not to create accounts for, share files with, or enable monitoring of, any such person. We do not knowingly collect personal data of children and, upon becoming aware that we have done so, shall delete it promptly. Please contact us if you believe that this has occurred.

16.1 EU/UK representatives. We do not presently have an establishment in the European Union or the United Kingdom. Where Article 27 of the EU or UK General Data Protection Regulation requires us to appoint a representative, we shall do so and publish their particulars in this Section.

17.1 External links and practices. The Services may contain links to, or integrate with, websites and services operated by others. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies.

18.1 Policy updates. We may amend this Policy to reflect changes in the Services or in law. We shall publish the amended Policy with a revised Effective Date, and shall notify account holders of any material amendment by email or in-product notice not less than 30 (thirty) days before it takes effect, save where an earlier effective date is required by law. Where an amendment requires fresh consent, we shall seek it.

19.1 Particulars. In accordance with the Information Technology Act, 2000, the rules framed thereunder and the DPDP Act, the particulars of our Grievance Officer are as follows:

19.2 Timelines. We shall acknowledge each complaint within 24 (twenty-four) hours and resolve it within 7 (seven) days, or within such shorter period as the law may require. Complaints concerning unlawful content shall be dealt with within the timelines set out in Clause 11.3 of our Terms of Service.

19.3 Appeals. If you are dissatisfied with the decision of our Grievance Officer on a complaint under the IT Rules, you may appeal to the Grievance Appellate Committee within 30 (thirty) days of receipt of such decision. In respect of privacy complaints, you may also approach the Data Protection Board of India once the relevant provisions of the DPDP Act come into force.

19.4 General queries. General privacy queries may be addressed to contact@prudentbit.com