1. Introduction & Scope

Tosset (operated by Trishara Ventures LLP) is committed to high standards of legal and regulatory compliance across jurisdictions. This combined policy explains how we approach data protection laws (including the EU General Data Protection Regulation – GDPR) and India’s Digital Personal Data Protection Act (DPDP Act), 2023, plus international cross-border transfer safeguards and other global compliance obligations.

Company: Trishara Ventures LLP · Address: Office No. 201, Lane 218/3, N Vihar, Newforest, Dehradun, Uttarakhand, India 248006 · Email: support@tosset.com

2. Legal Frameworks We Observe

• India – DPDP Act 2023, Information Technology laws, and applicable Indian statutes governing electronic services, taxation, and consumer protection.
• European Union – GDPR provisions where we process or offer services to EU/EEA residents (legal bases, data subject rights, DPIAs, breach notification rules).
• Other jurisdictions – We follow relevant national data privacy or consumer protection norms when processing personal data of residents in those countries (e.g., data subject rights, transparency, and lawful basis requirements).

3. Governance & Accountability

• Data Protection Officer / Compliance Contact: For privacy, compliance, and legal enquiries contact support@tosset.com. We will route complex matters to our designated compliance lead or external counsel.
• Records of Processing: Tosset maintains internal records of processing activities (RoPA) documenting categories of personal data, processing purposes, recipients, transfers, retention, and security measures.
• Data Protection Impact Assessments (DPIAs): We perform DPIAs for high-risk processing (e.g., large scale profiling, facial recognition features, or extensive cross-border transfers).
• Policies & Training: Regular internal training, vendor reviews, and audits support compliance and awareness across the organisation.

4. Lawful Bases & Consent

We rely on appropriate lawful bases depending on jurisdiction and context:

• Consent: For optional features (marketing emails, non-essential cookies, certain profiling) we obtain freely given, specific and documented consent.
• Contractual Necessity: Processing required to provide services, manage accounts, subscriptions and fulfil user requests.
• Legal Obligation: Processing necessary to comply with Indian or applicable laws (taxation, KYC, law enforcement requests).
• Legitimate Interests: For fraud prevention, platform security, system integrity, and platform improvement — after balancing user rights and interests.

5. Data Subject Rights (Overview)

We respect and facilitate data subject rights in applicable jurisdictions, including but not limited to:

• Right of access (confirm whether we process personal data and obtain a copy).
• Right to rectification (correct inaccurate data).
• Right to erasure / right to be forgotten (subject to legal exceptions and retention obligations).
• Right to restriction of processing and objection to processing (including profiling/marketing).
• Right to data portability where applicable.
• Right to withdraw consent at any time (without affecting prior lawful processing).

To exercise rights, contact support@tosset.com. We will verify identity and respond within applicable statutory timelines (e.g., GDPR: one month; DPDP: timelines as mandated).

6. Cross-Border Transfers & International Safeguards

Tosset may transfer personal data internationally (for hosting, backups, analytics, third-party processors). We adopt appropriate safeguards:

• Adequacy: Transfers to countries with an adequacy decision (where available) are preferred.
• Standard Contractual Clauses (SCCs) / DPDP Compliant Clauses: Where adequacy is not available, we rely on SCCs or equivalent contractual safeguards and additional technical/organisational measures.
• Transfer Impact Assessments: For high-risk transfers we perform impact assessments and implement layered protections (encryption at rest/in transit, access minimization, pseudonymization).
• Subprocessors: We list and manage subprocessors contractually; they are required to maintain equivalent privacy/security commitments.

7. Security & Technical Measures

Tosset implements reasonable technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS) and at rest for sensitive data.
• Role-based access control and least privilege.
• Network firewalls, secure hosting, regular patching and vulnerability management.
• Logging, SIEM alerts, and incident detection processes.
• Periodic security testing (internal/external pen tests) and third-party audits where required.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to individuals’ rights or freedoms we will:

• Contain and remediate the breach promptly.
• Notify the relevant supervisory authority / DPDP regulator or competent authority in accordance with applicable law (e.g., GDPR: within 72 hours where feasible; DPDP timelines as mandated).
• Notify affected individuals without undue delay where required by law, providing information about nature of breach, likely consequences and mitigation steps.

9. Law Enforcement & Legal Requests

We may receive lawful requests from law enforcement or regulatory authorities. When we receive valid legal process we will:

• Review requests for legal sufficiency and where permitted, challenge requests that are overly broad.
• Disclose only the minimum data necessary to satisfy lawful obligations.
• Notify the user unless prohibited by law or court order — where permitted we will require the authority to request a legal disclosure.

10. Subprocessors & Third-Party Services

We use trusted third-party processors for hosting, payment processing, analytics, email and media delivery. All subprocessors are bound by written contracts requiring adequate protections.

If you require a current list of subprocessors, please contact support@tosset.com. We will provide reasonable notification of material changes.

11. DPIAs, Risk Management & High-Risk Processing

For new systems or processing that pose high privacy risk we perform Data Protection Impact Assessments (DPIAs), document mitigations and, where applicable, consult with relevant authorities.

12. Children & Minors

Tosset is intended for users aged 18 or older. Where we collect data for minors in jurisdictions that permit younger ages with parental consent, we obtain verifiable parental consent and limit processing in accordance with local law.

13. Data Localization & Regional Requirements

Where local laws require data localization or in-country processing (e.g., specific financial, biometric or government mandated requirements), Tosset will comply as required and implement appropriate local measures.

14. Consumer Protection & E-commerce Rules

For paid services and subscriptions we comply with applicable consumer protection and e-commerce rules (disclosure of pricing, refunds, billing cycles, transactional records retention and grievance redressal mechanisms).

15. Sanctions, Export Controls & Compliance Screening

Tosset adheres to applicable sanctions and export control laws. We screen users, partners and transactions against sanctioned parties lists and will restrict services where required by law.

16. Accessibility, Non-Discrimination & Ethical Standards

Tosset is committed to non-discrimination and improving accessibility. We adopt inclusive practices and reasonable accessibility measures to ensure equitable participation across backgrounds and abilities.

17. Recordkeeping, Audits & Cooperation

We maintain records of processing, audits, DPIAs, security assessments and regulatory correspondence. We cooperate with supervisory authorities and provide information as required under applicable laws.

18. Remedies, Complaints & Dispute Resolution

Users may raise compliance complaints via support@tosset.com. We aim to resolve complaints promptly. Where unresolved, data subjects may refer matters to applicable supervisory authorities (for example the DPDP regulatory authority in India or relevant EU Data Protection Authorities) or pursue remedies under law. Our Terms & Conditions set forth governing law and dispute jurisdiction (Dehradun, Uttarakhand, India) unless otherwise required by local mandatory provisions.

19. Changes to this Policy

Tosset may update this combined compliance policy periodically to reflect legal or operational changes. We will post a revised effective date. Continued use of our services after updates constitutes acceptance of the current policy.

20. Contact & Compliance Office

For compliance-related questions, data subject requests, subprocessors list or legal enquiries contact:

Trishara Ventures LLP
Office No. 201, Lane 218/3, N Vihar, Newforest,
Dehradun, Uttarakhand, India — 248006
Email: support@tosset.com