PRIVACY POLICY

MyOoumph Networks Private Limited (“MyOoumph”, “Ooumph”, “Company”, “we”, “us” or “our”) publishes this Privacy Policy to explain how personal data is collected and used through www.ooumph.com and through Ooumph's website forms, programme registrations and related digital interactions.

This Policy describes Ooumph's stated website-level processing practices. The precise obligations applicable to a particular processing activity may depend on the nature of the data, purpose of processing, role of the parties, customer instructions, deployment architecture, applicable contract, and law applicable to that activity.

Accordingly, this Policy should not be interpreted as a general representation that every Ooumph product, customer deployment or institutional engagement satisfies every privacy, security or regulatory requirement applicable to every environment.

1. About the Company

2. Scope of this Policy

This Policy applies to personal data collected through Ooumph's corporate website and related online interactions, including:

• website enquiries and briefing requests;
• CoE and training applications;
• institutional partnership enquiries;
• resource or document requests;
• online programme registrations;
• payment-related transaction processing;
• customer communications; and
• technical information collected during website use.

Separate contractual or programme-specific privacy provisions may apply to a particular customer, institution or deployment.

3. Information We Actually Collect

The exact information collected depends on the particular form or service.

Website briefing requests

The current website briefing workflow collects information such as name, organisation, designation, email address, phone number, institution type and enquiry message. Submissions are checked with Google reCAPTCHA for anti-abuse verification before being accepted.

CoE and training interactions

The current CoE workflow may collect name, institution, phone/WhatsApp number, email address, branch or institution type, year of study, programme interest, career objective, designation, requested/downloaded material and supplementary information supplied through the applicable form.

Technical information

The website may process technical information necessary for operation, security, diagnostics and performance, such as IP address, browser/device characteristics, request information and security logs.

The actual categories retained may differ depending on the service and infrastructure in use.

4. Forms and Application Processing

Submitted form data is validated and sanitised on the server before relevant information is forwarded to the designated system used for lead and application tracking. The current implementation uses Google Sheets synchronisation for briefing and CoE workflows.

This disclosure is intended to describe the current website implementation and may be updated if the processing architecture changes.

5. Payment Information

For online payments, Ooumph may receive transaction information such as:

• amount;
• transaction/reference ID;
• payment status;
• date and time;
• order or registration information; and
• limited payment-related information returned by the payment provider.

Ooumph does not intend to collect or store complete card credentials through ordinary website applications.

Payment credentials may be entered directly into an authorised payment provider's interface. Such provider may process the information independently under its own terms and privacy documentation.

RBI's card-data framework restricts entities in the payment chain other than permitted issuers/networks from storing actual card-on-file data. Ooumph's operational implementation should therefore continue to use gateway/tokenisation mechanisms rather than maintaining raw card credentials.

6. How We Use Personal Data

Depending on the interaction, personal data may be used to:

• respond to enquiries and briefing requests;
• process programme and CoE applications;
• administer training and educational programmes;
• communicate administrative or service information;
• provide customer support;
• process and reconcile transactions;
• prepare proposals or commercial documentation;
• manage institutional relationships;
• maintain business and financial records;
• prevent fraud, abuse and security incidents;
• operate and secure the website;
• understand website usage and improve services;
• meet applicable contractual obligations; and
• comply with applicable legal requirements.

Ooumph does not state that every category of data is used for every purpose listed above.

7. Basis for Processing

Depending on the applicable legal framework and the nature of the processing, Ooumph may process personal data:

• at the individual's request;
• to perform or administer a service or transaction;
• where consent is obtained where required;
• for legitimate operational, security or business purposes where legally available;
• to comply with legal or regulatory obligations; or
• for other purposes permitted by applicable law.

Where consent is required, Ooumph will seek it through an appropriate mechanism.

The legal basis for a particular processing activity may depend on the circumstances and is not necessarily the same for every user or service.

8. Data Protection Law

Ooumph intends its personal-data practices to be operated with regard to privacy and data-protection requirements applicable to the relevant processing.

The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data, while the Digital Personal Data Protection Rules, 2025 were notified by the Government on 14 November 2025. The commencement notification provides for phased commencement of different provisions.

Accordingly, references in this Policy to the DPDP framework should not be read as a blanket certification that every provision has commenced, applies to every processing activity or has been fully implemented across every Ooumph customer deployment.

Where a particular engagement is subject to additional statutory, sectoral, contractual or institutional requirements, those requirements may be incorporated separately.

9. Data Sharing and Service Providers

Ooumph may disclose or provide access to personal data to service providers where necessary to operate the website or provide the requested service.

Depending on the service, these may include providers of:

• hosting and cloud infrastructure;
• email and communications;
• payment processing;
• anti-abuse and security services;
• analytics;
• form or CRM infrastructure;
• data storage and administrative systems; and
• programme or institutional administration.

The current website implementation specifically identifies Google reCAPTCHA and Google Sheets-based synchronisation in relevant workflows.

Ooumph does not sell personal data as a commercial data-broker product.

10. Government, Enterprise and Institutional Deployments

Ooumph provides technology to government departments, PSUs, educational institutions and enterprises.

In such engagements, Ooumph may process personal data supplied by or on behalf of the customer.

Depending on the arrangement, Ooumph may act as the party determining certain processing purposes, a service provider processing data on customer instructions, or in another role defined by the applicable legal and contractual framework.

The applicable SOW, data-processing terms, institutional agreement, security requirements and customer instructions will determine the responsibilities of the parties for the relevant deployment.

This Policy does not replace such contractual arrangements.

11. Sensitive, Regulated and Government Data

Customers and institutions should not submit classified, highly sensitive, regulated, confidential or special-category information through public website forms unless the relevant Ooumph process expressly permits it.

A production government or enterprise deployment may have separate controls for data residency, retention, access, encryption, audit logging, segregation, incident handling or other requirements.

Where such controls are contractually required, they should be documented in the relevant technical and contractual documentation rather than inferred solely from this public Privacy Policy.

12. International Processing

Some technology or service providers used by Ooumph may process information from locations outside India.

Where such processing occurs, Ooumph will consider applicable legal restrictions and contractual, technical or organisational safeguards relevant to that processing.

Customer-specific data-location requirements may be separately established through the relevant agreement.

13. Security Measures

Ooumph uses technical and organisational measures appropriate to the nature of the website and services in operation.

The current website is delivered over HTTPS with HSTS and security headers (including X-Content-Type-Options, X-Frame-Options and a referrer policy). Form submissions are processed by a server-side endpoint that performs input sanitisation, reCAPTCHA-based abuse prevention, and keeps non-public credentials server-side rather than in the browser.

These measures are controls in the current website implementation and should not be interpreted as a representation that every Ooumph product or customer deployment uses an identical security architecture.

Security controls for a particular enterprise, government or institutional deployment may be defined separately.

14. Data Retention

Ooumph retains personal data for as long as reasonably necessary for the applicable purpose or for contractual, accounting, legal, security, dispute-resolution or other legitimate retention requirements.

Retention periods can differ by information type.

Where personal data is no longer required and no applicable retention requirement exists, Ooumph may delete, anonymise or securely dispose of it.

Specific customer or government retention periods may be established under the applicable engagement.

15. Cookies and Similar Technologies

Ooumph may use cookies or comparable technologies necessary for website functionality, security, preferences, analytics or performance.

The categories and purposes of such technologies may change as the website evolves.

Where consent is required for a particular technology under applicable law, an appropriate mechanism will be used.

Users may also manage cookies through browser settings, although disabling certain functionality may affect the website experience.

16. Marketing Communications

Where permitted, Ooumph may send information relating to programmes, services, events or institutional activities.

Recipients may opt out of marketing communications using the available unsubscribe mechanism or by contacting info@ooumph.com.

Essential transactional, security and service communications are not marketing messages and may continue where necessary.

17. Children and Student Information

Certain Ooumph programmes involve educational institutions and students.

Where processing involves children or other persons for whom special legal protections apply, Ooumph will apply the procedures relevant to the applicable programme and legal requirements.

Programme-specific arrangements may define the role of parents, guardians, educational institutions and Ooumph in collecting and administering student information.

The public corporate website should not be used to submit unnecessary student information.

18. Rights and Requests

Subject to applicable law and the provisions in force for the relevant processing, individuals may have rights relating to their personal data, including rights concerning access to information, correction, deletion or withdrawal of consent where applicable, and grievance redressal.

Requests should be made to:

Ooumph may request reasonable information to verify the identity of a requester before acting on a request.

The precise rights, procedure and applicable timelines may depend on the legal framework applicable to the particular processing activity.

19. Grievance Redressal

Privacy and data-related concerns may be submitted to:

The Company will assess and respond to grievances according to the applicable legal and contractual framework.

20. Third-Party Websites

Ooumph may link to third-party websites and services.

This Policy applies to Ooumph's own processing and does not govern independent processing carried out by third parties.

Users should review the privacy practices of the relevant third party before submitting information to that service.

21. Changes to this Policy

Ooumph may update this Privacy Policy when its website, services, processing practices, technology or applicable legal requirements change.

The latest version will be published on this page together with its “Last Updated” date.

Where a change requires additional notice or consent under applicable law, Ooumph will follow the applicable process.

22. No Blanket Compliance Representation

This Policy describes Ooumph's stated privacy practices for the website and related services.

It does not constitute:

• a legal opinion;
• a certification of compliance;
• a representation that every Ooumph product or deployment complies with every applicable privacy or cybersecurity law;
• a representation that every customer receives the same technical or organisational controls; or
• a substitute for a customer-specific data-processing agreement, security schedule, SOW or other contractual document.

Government, enterprise, regulated-industry and institutional engagements may require additional controls or contractual provisions, which will be addressed separately where applicable.

23. Contact