Effective Date: 18 July 2026

BuyChance International ("BuyChance", "we", "us", "our") is the Data Fiduciary in respect of personal data processed through the BuyChance platform (the "Platform"), as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025. This Privacy Policy explains what personal data we collect, why, how it is used, and the rights available to you as a Data Principal.

1. Personal Data We Collect We collect: (a) identity and contact information such as name, email, phone number, and delivery address; (b) transaction data including order history, payment status, and wallet balance; (c) technical data including device identifiers, IP address, and browsing activity on the Platform; (d) information you voluntarily submit, such as product reviews or customer support communications.

2. Lawful Basis and Consent We process your personal data on the basis of your consent, obtained at the time of account creation or at the point of collection, or where necessary to perform our contract with you (such as processing an order), or to comply with a legal obligation. Consent for optional processing, including marketing communications, is separately obtained and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

3. Children's Data The Platform is intended for use by individuals aged 18 and above. Where we become aware that a user is under 18, we will seek verifiable consent from a parent or lawful guardian before processing that user's personal data, in accordance with the DPDP Act. We do not knowingly direct behavioural tracking or targeted advertising at users we know to be under 18.

4. How We Use Your Data We use your personal data to: process and deliver orders; operate your wallet and rewards account; provide customer support; detect and prevent fraud; comply with legal and tax obligations; and, where you have consented, to send you marketing communications and personalise your experience on the Platform.

5. Sharing of Personal Data We share personal data with: sellers, to the extent necessary to fulfil your order; logistics and delivery partners, to enable shipment; payment gateway providers, to process transactions; and government or regulatory authorities, where required by law. We require third parties who process personal data on our behalf to maintain equivalent safeguards. We do not sell personal data to third parties.

6. Data Retention We retain personal data only for as long as necessary for the purposes it was collected, or as required by applicable law (including tax and accounting record-keeping requirements), after which it is deleted or anonymised.

7. Your Rights as a Data Principal Under the DPDP Act, you have the right to: obtain a summary of the personal data we hold about you and the processing activities carried out; request correction or completion of inaccurate or incomplete data; request erasure of your personal data (see our User Data Deletion Instructions); nominate another individual to exercise your rights in the event of death or incapacity; and file a grievance with us, and thereafter with the Data Protection Board of India if unresolved.

8. Data Breach Notification In the event of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India in accordance with the timelines and manner prescribed under the DPDP Rules, 2025.

9. Security Safeguards We implement reasonable technical and organisational measures, including encryption of sensitive data in transit, access controls, and regular security review, to protect personal data against unauthorised access, alteration, or loss.

10. Cookies We use cookies and similar technologies as described in our Cookie Policy.

11. Cross-Border Transfer Where personal data is transferred outside India, such as to a cloud service provider, we ensure this occurs in a manner consistent with the DPDP Act and any restrictions notified by the Central Government from time to time.

12. Changes to this Policy We may revise this Privacy Policy from time to time. Material changes affecting your rights will be notified through the Platform or by email.

13. Grievance and Contact For any privacy-related grievance, or to exercise your rights as a Data Principal, contact our Grievance Officer as listed in our Grievance Redressal Policy, or email info@buychance.club. BuyChance International, Upper Tunwala Chowk, Dehradun, Uttarakhand — 248005, India.

14. Governing Law and Jurisdiction This Policy is governed by the laws of India. Courts at Dehradun, Uttarakhand shall have exclusive jurisdiction over any dispute arising in connection with this Policy, without prejudice to your right to approach the Data Protection Board of India.