Privacy Policy – Circle8

Circle8 Cleantech Private Limited ("Circle8", "we", "us", or "our") is committed to safeguarding the privacy and personal data of its users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our platform, including www.circle8.in (the "Portal") and any associated services (collectively, the "Services").

By using the Portal, you agree to the collection and use of information in accordance with this Privacy Policy and consent under applicable Indian data protection laws.

1. Information We Collect

We may collect the following types of information:

a. Personal Data

This includes information that can be used to identify you or your organization, such as:

• Full name, designation, and professional contact details (email address and phone number)
• Know Your Customer (KYC) documentation and government-issued identification (such as Aadhaar, PAN, or other valid ID proofs)
• Organization-specific information, including but not limited to:
  • PAN (Permanent Account Number)
  • GST (Goods and Services Tax) number
  • CIN (Corporate Identification Number)
• Payment-related documentation such as bank transaction proofs (uploaded by users as part of NEFT/RTGS remittances)

b. Non-Personal Data

This refers to information that does not directly identify a user but may be collected automatically when you interact with the Portal:

• Technical and usage-related data, including:
  • IP address
  • Browser type and version
  • Device identifiers
  • Session logs and access timestamps
• Platform activity and transaction metadata, including:
  • EPR credit listings, purchases, downloads, and matches
  • Status of bids, inquiries, and messages exchanged via the platform

We use this data to facilitate services, ensure compliance, enhance user experience, and fulfill legal and operational obligations.

2. How We Use Your Information

We use the personal and non-personal data collected through the Circle8 platform for the following purposes:

• Facilitate EPR Credit Transactions:
  To enable the listing, matching, and execution of transactions related to Extended Producer Responsibility (EPR) credits across eligible waste categories.
• Compliance Tracking and Documentation:
  To assist users in maintaining accurate records for CPCB and SPCB filings, and to ensure traceability of transactions in line with EPR rules.
• User Communication:
  To contact users regarding platform updates, credit matches, documentation needs, payment instructions, and important transaction-related notifications.
• Regulatory Reporting:
  To generate and provide transaction summaries and activity reports as required for regulatory submissions by PIBOs, recyclers, or other stakeholders.
• Platform Enhancement:
  To analyze usage patterns, address technical issues, and improve the functionality, security, and overall user experience of the platform.
• Fraud Prevention and Security:
  To detect and prevent fraudulent transactions, policy violations, and unauthorized access or misuse of platform features or data.

All use of your information is carried out in accordance with applicable Indian data protection laws, including the Digital Personal Data Protection Act (DPDP Act), and Circle8's internal data protection policies.

3. Data Confidentiality

At Circle8, we are committed to maintaining the confidentiality and integrity of all data shared on our platform. The following principles apply:

• Confidentiality of Transactions
  All data exchanged between buyers, sellers, recyclers, and other registered entities on the Portal is treated as strictly confidential. This includes transaction details, documentation, payment proofs, and compliance-related information.
• No Unauthorized Disclosure
  Circle8 does not share or disclose individual transaction details, business identifiers, or sensitive documentation with any third party without the explicit consent of the concerned user or entity— unless such disclosure is required by law, regulatory directive, or court order.
• Restricted Internal Access
  Access to user data within Circle8 is limited to authorized personnel who require it for operational, support, or regulatory purposes. We implement appropriate access controls and maintain logs to ensure accountability and data protection.

These practices reflect our commitment to protecting user trust, ensuring compliance with applicable Indian data protection laws, and maintaining the integrity of our EPR credit ecosystem.

4. Data Sharing & Disclosure

Circle8 respects your privacy and is committed to ensuring responsible data handling. We do not sell, rent, or commercially exploit your personal or organizational data.

However, we may share data under the following circumstances:

• With Government or Regulatory Authorities
  We may share relevant data with statutory bodies such as the Central Pollution Control Board (CPCB), State Pollution Control Boards (SPCBs), or other competent authorities, in compliance with EPR regulations and applicable legal requirements.
• With Compliance Partners or Auditors
  In cases where regulatory or third-party audits are conducted, we may share necessary information under strict confidentiality agreements to ensure the integrity of compliance and reporting processes.
• In Legal Disputes or Proceedings
  Data may be disclosed if required by law, legal processes, or to respond to valid court orders, subpoenas, or regulatory investigations. In such cases, disclosures will be limited to the extent legally necessary.

All such sharing is done with appropriate safeguards to ensure that your data is handled securely, lawfully, and with due regard to your confidentiality.

5. User Rights

As a registered user of Circle8, you are entitled to certain rights concerning your personal data, in line with the provisions of applicable Indian data protection laws in force, including the Digital Personal Data Protection (DPDP) Act:

• Right to Access
  You may request a copy of the personal data we hold about you, along with details on how it is being used.
• Right to Correction
  You can request correction or updating of your personal information if you believe it to be inaccurate, incomplete, or outdated.
• Right to Withdraw Consent
  Where processing is based on your consent, you may withdraw it at any time. Please note that this may impact our ability to continue providing certain services.
• Right to Account Deletion
  You may request the deletion or deactivation of your Circle8 account and associated data. However, certain records may need to be retained as per regulatory and audit requirements under EPR guidelines.

To exercise any of these rights, please contact us at support@circle8.in. We will process your request in accordance with applicable laws and respond within the legally defined timelines.

6. Data Retention

• Minimum Retention Period
  Circle8 retains all user and transaction data for a minimum period of five (5) years.
• Post-Termination Retention
  In the event a user account is terminated—either voluntarily or due to non-compliance—all associated data will be securely archived and retained for record-keeping, legal compliance, or audit purposes as mandated by regulatory authorities.
• Data Security During Retention
  Archived data is stored in a secure environment with restricted access to authorized personnel only, and it will not be used for any commercial purposes.

This policy ensures that Circle8 fulfills its legal and compliance obligations while maintaining user trust and data integrity.

7. Security Measures

7.1

Circle8 may use secure third-party cloud infrastructure providers for data hosting and processing. All such vendors are contractually bound to maintain confidentiality and comply with Indian data protection norms.

7.2

Circle8 takes the security of your information seriously. We implement a range of administrative, technical, and organizational safeguards to protect your data from unauthorized access, misuse, or breach. These include:

• Access Control
  Platform access is strictly role- and permission-based, ensuring that only authorized personnel can view or manage sensitive data.
• Data Encryption
  All user and transaction data is protected using industry-standard encryption protocols, both at rest and during transmission, to maintain data confidentiality and integrity.
• Unauthorized Access Prevention
  Robust firewall policies, access logs, and authentication mechanisms are employed to prevent unauthorized access, alteration, or disclosure of any data stored or processed on the Circle8 platform.

These measures are regularly reviewed and updated to comply with evolving regulatory standards and industry best practices.

7.3

In case of any data breach affecting user information, Circle8 shall notify affected users and the relevant authorities within 72 hours as per applicable Indian laws, and shall take remedial steps to mitigate the impact.

8. Cookies and Analytics

We may use cookies and third-party analytics tools to improve your experience and optimize the performance of our platform. You have the option to disable cookies through your browser settings at any time.

9. Third-Party Links

The Circle8 Portal may contain links to third-party websites or services that are not operated or controlled by us. Please note:

• These third-party sites have their own privacy policies and terms of use.
• Circle8 does not take responsibility for the content, data practices, or security of any external websites.
• We encourage users to review the privacy policies of any third-party sites they visit through links on our platform.

Your interaction with these third-party sites is solely at your own risk.

10. Consent

By accessing or using the Circle8 platform, you expressly acknowledge and consent to the following:

• Data Collection and Use
  You agree to the collection, processing, and usage of your personal and organizational data as outlined in this Privacy Policy and our Terms & Conditions.
• Data Transfer and Storage
  You consent to the transfer of your data within or outside India, if required for secure data storage, processing, or regulatory compliance purposes, in accordance with applicable Indian data protection laws.
• Regulatory Disclosures
  You authorize Circle8 to use your data, including transaction and documentation records, for compliance reporting to the Central Pollution Control Board (CPCB), State Pollution Control Boards (SPCBs), and other relevant statutory bodies as mandated under EPR regulations.

Your continued use of the platform constitutes your acceptance of these practices.

11. Modifications

Circle8 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in legal requirements, platform features, or data practices.

• User Notification
  In the event of any material changes, users will be informed through:
  • Email notifications sent to the registered email address
  • In-platform alerts or banners displayed upon login
• Deemed Acceptance
  Your continued use of the Circle8 Portal after the effective date of any updated policy shall be deemed as your acceptance of the revised Privacy Policy.

We encourage you to review this page periodically to stay informed about how we protect and handle your data.

12. Contact Information

For any queries, concerns, or requests under this Privacy Policy, please contact:

Email: legal@circle8.in
Registered Office Address: Circle8 Cleantech Private Limited
WeWork, Vaswani Chambers, Dr. Annie Besant Road, Worli, Mumbai – 400030, Maharashtra, India

13. Grievance Officer

If you have any concerns, questions or require modifications in your personal information in relation to this Privacy Policy and your data, you may address them to our Grievance Officer whose name and address are as follows:

Name: Mr. Ashish Kumar Ranjan
Email Id: ashish@circle8.in
Phone: +91 96202 20013