BIO-GEN EXTRACTS PRIVATE LIMITED

PRIVACY POLICY

Effective Date: 27^th August 2026

This Privacy Policy is issued by Bio-gen Extracts Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at Bengaluru, Karnataka, India (“Company”), and sets out the manner in which the Company, acting as a Data Fiduciary, collects, processes, uses, discloses, transfers and protects Personal Data obtained through the website www.bio-gen.in and related digital channels operated by the Company.

1. DEFINITIONS AND INTERPRETATION

1.1 In this Policy, unless the context otherwise requires, the following expressions shall bear the meanings assigned to them below:

“Applicable Law” means all applicable statutes, enactments, rules, regulations, notifications, guidelines and circulars in force in India from time to time, including without limitation the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Digital Personal Data Protection Act, 2023, together with any rules framed thereunder (“DPDP Act”), each as amended, re-enacted or substituted from time to time, and any other law having application outside India to the extent applicable to the processing contemplated herein;
“Company / Bio-gen Extracts / we / our / us” means Bio-gen Extracts Private Limited, and, where the context so requires, its Affiliates;
“Affiliate” means, in relation to the Company, any entity that directly or indirectly controls, is controlled by, or is under common control with, the Company;
“Consent” means any freely given, specific, informed and unambiguous indication of a Data Principal’s agreement to the processing of their Personal Data, signified in the manner contemplated under Applicable Law;
“Data Fiduciary” has the meaning assigned to such term under the DPDP Act, and refers to the Company in relation to Personal Data processed through the Website;
“Data Principal” has the meaning assigned to such term under the DPDP Act, and refers to the individual to whom the Personal Data relates;
“Personal Data / Personal Information” means any data or information about an individual who is identifiable by or in relation to such data or information, and, for the avoidance of doubt, includes “personal information” and “sensitive personal data or information” as defined under the SPDI Rules, to the extent applicable;
“Policy” means this Privacy Policy, as amended from time to time in accordance with Clause 19;
“Processing” means any operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, combination, restriction, erasure or destruction;
“Terms” means the Website Terms & Conditions of the Company, as amended from time to time;
“Website” means the website located at www.bio-gen.in, together with all sub-domains, pages and digital properties operated by the Company in connection therewith;
“You / User” means any natural person who accesses, browses or otherwise interacts with the Website.

1.2 In this Policy, unless the context otherwise requires: (a) references to a statute or statutory provision include references to that statute or provision as amended, extended, consolidated or re-enacted from time to time, and to any subordinate legislation made thereunder; (b) the words “include”, “including” and “in particular” shall be construed as illustrative and shall not limit the generality of the preceding words; (c) headings are inserted for convenience of reference only and shall not affect the construction or interpretation of this Policy; and (d) words importing the singular shall include the plural and vice versa, and words importing a gender shall include every gender.

2. ACCEPTANCE OF THIS POLICY

2.1 By accessing or using the Website, or by voluntarily furnishing Personal Data to the Company, you acknowledge that you have read, understood and consented to the Processing of your Personal Data in the manner described in this Policy, save that, where Consent is required as a valid ground of Processing under Applicable Law, such Consent shall be obtained separately and specifically, and shall not be inferred merely from your continued use of the Website.

2.2 This Policy is incorporated by reference into, and forms an integral part of, the Terms. In the event of any conflict between this Policy and the Terms in relation to the Processing of Personal Data, the provisions of this Policy shall prevail to the extent of such conflict.

3. ABOUT THE COMPANY

3.1 The Company is engaged in the research, development, manufacture and global supply of scientifically substantiated branded nutraceutical ingredients, standardised extracts, generic natural ingredients and proprietary ingredient platforms, supplied to manufacturers of dietary supplements, foods, beverages, pharmaceuticals, cosmetics, personal care products, veterinary and other health and wellness products.

4. SCOPE AND APPLICATION

4.1 This Policy applies to Personal Data collected through the Website from visitors, customers, prospective customers, distributors, suppliers, business partners, researchers, healthcare professionals, job applicants and other individuals who interact with the Company through the Website.

4.2 The Website is directed at, and intended for use by, persons acting in a professional or business capacity, including manufacturers, distributors, formulators, brand owners, researchers, healthcare professionals, regulatory professionals and academic institutions, and is not directed at consumers.

4.3 This Policy does not extend to Personal Data collected by the Company otherwise than through the Website, or to the practices of any third party not under the control of the Company, including any third party whose website may be linked to or from the Website.

5. PERSONAL DATA COLLECTED

5.1 The Company may, depending upon the nature of your interaction with it, collect the following categories of Personal Data:

(a) identification and contact information, comprising your name, company name, job title, business address, email address, telephone number, country and industry sector;
(b) business information, comprising your areas of interest, ingredient enquiries, product requirements, technical requests, scientific interests, regulatory enquiries, meeting requests and purchase enquiries; and
(c) technical information relating to your use of the Website, comprising your IP address, browser type, operating system, device information, pages visited, date and time of access, referral source, approximate geographic location and website usage information, which may be collected through cookies and similar technologies as further described in Clause 16 and in the Company’s Cookie Policy.

5.2 For the avoidance of doubt, the Company does not knowingly or intentionally solicit or collect sensitive Personal Data (including health data, financial information or biometric data, as such terms are understood under the SPDI Rules) through the Website. Where any such information is inadvertently furnished by a User, the User shall promptly notify the Company in accordance with Clause 20, and the Company shall take reasonable steps to delete the same.

6. MANNER OF COLLECTION

6.1 Personal Data may be collected by the Company directly from you, including through website enquiry forms, newsletter subscriptions, event or webinar or exhibition registrations, scientific publication downloads, technical information requests, business meetings, electronic mail, telephonic conversations and social media interactions, and, in certain circumstances, from publicly available professional sources and authorised third-party business databases.

7. PURPOSES OF PROCESSING

7.1 The Company processes Personal Data for legitimate business purposes, which purposes include, without limitation:

(a) responding to enquiries and providing scientific, technical and regulatory information relating to the Company’s ingredients;
(b) processing sample requests, arranging meetings and facilitating business development;
(c) quality management, customer relationship management and improvement of the Website’s functionality;
(d) the dissemination of newsletters, scientific publications and invitations to conferences, webinars and exhibitions, subject to Clause 9;
(e) conducting surveys and market research;
(f) compliance with Applicable Law and the protection of the Company’s legal rights and interests.

8. LEGAL BASIS FOR PROCESSING

8.1 The Company processes Personal Data on one or more of the following lawful bases, as applicable in the relevant jurisdiction: (a) the Consent of the Data Principal; (b) the performance of a contract to which the Data Principal is party or steps taken at the Data Principal’s request prior to entering into a contract; (c) compliance with a legal obligation to which the Company is subject; (d) the legitimate interests pursued by the Company, including for certain “legitimate uses” recognised under Section 7 of the DPDP Act; or (e) such other lawful ground as may be available under Applicable Law.

9. MARKETING COMMUNICATIONS

9.1 Subject to Applicable Law and, where required, your Consent, the Company may transmit communications relating to ingredient innovations, scientific publications, technical updates, product launches, webinars, conferences, exhibitions, newsletters, research developments and business opportunities that may be relevant to your professional interests.

9.2 You may withdraw your Consent to receive marketing communications, or unsubscribe therefrom, at any time by following the unsubscribe mechanism contained in the relevant communication or by notifying the Company in accordance with Clause 20. Such withdrawal shall not affect communications necessary for the performance of an existing business relationship or the discharge of a legal obligation, nor the lawfulness of Processing carried out prior to withdrawal.

10. DISCLOSURE OF PERSONAL DATA

10.1 The Company does not sell Personal Data. The Company may, on a strictly need-to-know basis and subject to appropriate confidentiality obligations, disclose Personal Data to: (a) its Affiliates; (b) authorised distributors; (c) service providers, including information technology, logistics and marketing service providers; (d) professional advisers and auditors; and (e) regulatory authorities, government agencies, courts and law enforcement authorities, or other persons, where required or permitted under Applicable Law.

10.2 Any disclosure made pursuant to Clause 10.1 shall be limited to what is reasonably necessary for the purpose for which such disclosure is made. In the event the Company or substantially all of its assets are acquired, merged or restructured, Personal Data may, subject to Applicable Law, be transferred to the successor or acquiring entity, which shall continue to be bound by the terms of this Policy in respect of such Personal Data.

11. CROSS-BORDER TRANSFER OF PERSONAL DATA

11.1 As the Company conducts business on an international basis, Personal Data may be transferred to, stored in, or processed within, jurisdictions outside the country of the Data Principal’s residence, including jurisdictions that may not offer an equivalent level of data protection. Any such transfer shall be effected subject to appropriate contractual, technical or organisational safeguards, consistent with the requirements of Applicable Law, including any restrictions on cross-border transfer as may be notified by the Central Government under the DPDP Act.

12. DATA SECURITY

12.1 The Company shall implement and maintain reasonable security practices and procedures, comprising administrative, technical and organisational safeguards, that are commensurate with the nature and sensitivity of the Personal Data processed, designed to protect such Personal Data against unauthorised access, accidental or unlawful disclosure, alteration, misuse, loss or destruction, consistent with the requirements of the SPDI Rules and the DPDP Act.

12.2 No method of electronic transmission or storage is, or can be represented to be, wholly secure. Accordingly, while the Company shall exercise reasonable care and diligence, it does not warrant or guarantee the absolute security of Personal Data transmitted to or stored by it.

12.3 In the event of a Personal Data breach that is reasonably likely to result in harm to a Data Principal, the Company shall take reasonable steps to contain and remediate such breach and shall, without undue delay, notify affected Data Principals and/or the competent Data Protection Board or other regulatory authority, in each case to the extent, and in the manner, required under Applicable Law.

13. DATA RETENTION

13.1 Personal Data shall be retained only for so long as is reasonably necessary to fulfil the purpose for which it was collected, having regard to the nature and sensitivity of the Personal Data, the Company’s contractual and legal obligations, and any applicable limitation period for the initiation of legal proceedings. Upon the expiry of the applicable retention period, Personal Data shall be securely deleted, anonymised or otherwise disposed of in accordance with Applicable Law.

14. RIGHTS OF THE DATA PRINCIPAL

14.1 Subject to Applicable Law and any exemptions available thereunder, you may be entitled to: (a) obtain confirmation and access to your Personal Data processed by the Company; (b) seek correction, completion or updating of your Personal Data; (c) request erasure of your Personal Data; (d) withdraw Consent previously granted, without prejudice to the lawfulness of Processing carried out prior to such withdrawal; (e) object to, or seek restriction of, certain Processing; (f) seek grievance redressal by contacting the Company using the contact details set out in Clause 20; and (g) nominate another individual to exercise these rights on your behalf in the event of death or incapacity, to the extent such right is recognised under the DPDP Act.

14.2 A request to exercise any right under Clause 14.1 shall be addressed to the Company using the contact details set out in Clause 20. The Company shall endeavour to acknowledge and respond to any such request within thirty (30) days of receipt, or within such other period as may be prescribed under Applicable Law, and reserves the right to verify the identity of the person making the request prior to acting upon it.

15. PROCESSING OF CHILDREN'S DATA

15.1 The Website is intended for use by persons acting in a professional or business capacity and is not directed at children. The Company does not knowingly collect Personal Data relating to a child, or to any person not legally competent to furnish valid Consent, and shall, upon becoming aware of any such inadvertent collection, take reasonable steps to delete such Personal Data without undue delay.

16. COOKIES

16.1 The Website employs cookies and similar tracking technologies for the purposes, and in the manner, described in the Company’s Cookie Policy, which is incorporated herein by reference and forms an integral part of this Policy.

17. THIRD-PARTY WEBSITES

17.1 The Website may contain hyperlinks to websites operated by third parties. The Company exercises no control over, and accepts no responsibility or liability for, the privacy practices or content of such third-party websites, and recommends that Users independently review the privacy policies of any third-party website they visit.

18. AMENDMENT OF THIS POLICY

18.1 The Company reserves the right to revise or amend this Policy at any time, in its sole discretion. The revised Policy shall take effect upon publication on the Website, and, where such revision is material, the Company shall provide reasonable notice by means of a notification on the Website or such other appropriate means. Continued use of the Website following the publication of a revised Policy shall constitute acceptance of such revisions.

19. GOVERNING LAW AND JURISDICTION

19.1 This Policy shall be governed by, and construed in accordance with, the laws of India, without regard to conflict of laws principles, and shall be read in conjunction with the dispute resolution, governing law and jurisdiction provisions contained in the Terms.

20. NOTICES AND CONTACT

20.1 All notices, requests or communications in relation to this Policy, including any request to exercise a right under Clause 14, shall be addressed in writing to: