Privacy Policy

01 Introduction

1.1 The Platform is owned and operated by WTF GLOBAL PRIVATE LIMITED, having Corporate Identification Number: U59112KA2024PTC192424 and having its registered office at The Museum No.1, 2nd Floor, Museum Road, Mahatma Gandhi Road, Bangalore, Karnataka, India, 560001 (“Data Fiduciary”). For any privacy questions or to exercise your rights, contact our Grievance Officer (as provided in Section 12).

1.2 This Policy outlines our practices and policies, the kind of information that we may collect from you when you access or use the Platform, the reasons for and methods for collection, how we use and disclose the information that we gather from you for your use of the Platform, as well as security practices and procedures for safeguarding your privacy in relation to the information shared with us.

1.3 This Policy must also be read in conjunction with and construed in accordance with the applicable laws of the country from which you access and use the Platform, including without limitation, the provisions of the Information Technology Act, 2000 of India read with other applicable rules, and DPDP Law.

1.4 We reserve the right to amend, change or update this Policy at our discretion. You agree to be bound by any updated policies with your continued access and/or use of our Platform after any such changes have been duly notified in any form to you. Any such changes to the Policy will be notified to your registered email address/ mobile number with us. We recommend that you shall update your details with your active and correct email address with us for smooth communication. We will not be liable in case the registered email is inactive, incorrect or not updated for any claims regarding and not limited to communication gaps, liabilities and legal claims with regards to this Policy.

02 Data we collect

2.1 We collect the following categories of personal data, only to the extent relevant to the feature you use:

2.2 Identity and contact data: Name, mobile number, professional email address, city, and photograph.

2.3 Verification data:

• (a) LinkedIn profile data (role, seniority, employment history) if you connect your LinkedIn account on the Platform. In such case you shall abide by the terms and conditions of LinkedIn;
• (b) Instagram profile data (username, account type, biography, website, follower and post counts, and the captions and images of your recent posts) if you connect your Instagram account on the Platform. In such case you shall abide by the terms and conditions of Instagram;
• (c) DigiLocker-issued education credentials, if you choose to verify your degree;
• (d) Corporate email domain verification;
• (e) Professional licence numbers (for example, Bar Council, Medical Council, ICAI), if you verify a licensed profession;
• (f) Credit bureau data, specifically a credit score band (for example, CIBIL 700+), obtained through a licensed credit information company with your specific consent, used only to gate eligibility for Group Buying and credit-linked offers — we do not receive or store your full credit report; or
• (g) The first six digits (BIN) of a payment card you choose to submit, used only to infer card tier for premium-tier signalling; we do not collect or store full card numbers.

2.4 Profile and preference data: Your declared persona (Founder/Executive/Creative), interest graph, utility preferences, and any other onboarding responses.

2.5 Community and engagement data: Vouch Codes issued and redeemed, Core Group participation and attendance, exchange posts and inline analyses, and poll and quiz responses.

2.6 Connection data: Bridge intents and categories you select, mutual-consent connection outcomes, and Digital Name Card exchange records (only between Members who mutually complete a QR exchange).

2.7 WTF Bot interaction data: Your queries to WTF Bot, voice notes you record in response to the Daily Challenge, and business context you choose to share for personalised responses.

2.8 Transactional data: Collective Orderbook pledges, event registrations and attendance, and perk redemptions. Full payment card and bank details are collected and processed directly by our RBI-authorised payment gateway partners, not stored by us.

2.9 Device and usage data: IP address, device identifiers, app version, log data, and analytics events, collected via cookies and SDKs as described in Section 8.

2.10 Data from others. If another Member vouches for you, shares your contact details via a Digital Name Card, or refers you, their referral generates a record linking their account to yours for the purposes described in Section 3.

03 How we use your data

3.1 We process personal data for the following purposes:

• (a) to verify your identity and eligibility for Membership, specific communities, and credit-linked features, and to prevent fraud;
• (b) to operate core features such as onboarding, community placement, Core Group matching, the Bridge’s dual-consent matching, the Exchange, the Collective Orderbook, events, and Premium Perks;
• (c) to personalise WTF Bot responses and Daily Challenge content using your business context and activity;
• (d) to communicate with you about your account, events, and Platform updates;
• (e) to detect, investigate, and prevent fraud, abuse of Vouch Codes, and violations of our Terms of Service;
• (f) to comply with legal obligations, including responding to lawful requests from government or regulatory authorities;
• (g) to improve the Platform through aggregated or de-identified analytics.

3.2 We do not use your credit score or professional licence data for any purpose beyond the specific verification gate for which it was collected, and we do not sell this data to advertisers.

04 Legal basis for processing

4.1 Under Applicable Law, we process your personal data on the basis of your consent, given at the point you provide the data or connect a third-party account, except where processing falls under a “legitimate use” recognised by Applicable Law (for example, where you have voluntarily provided data for a specified purpose and have not indicated you do not consent, or where processing is necessary to comply with a legal obligation or to respond to a medical emergency). You may withdraw consent at any time as described in Section 11; withdrawal does not affect the lawfulness of processing carried out before withdrawal and may result in loss of access to the feature that required that data.

05 How we share your data

We share personal data only as needed and never sell it to third parties for their own marketing purposes. Categories of recipients of personal data includes but is not limited to:

5.1 Our affilifates, subsidiaries and group companies;

5.2 Verification partners: Licensed credit information companies (for CIBIL-band checks), LinkedIn and Instagram (each via its API, subject to your authorisation), and DigiLocker (via your authorisation).

5.3 Matching and personalisation vendors: Third-party matchmaking and recommendation providers (for example, Qloo) may receive limited profile and interest-graph data to power Bridge, Core Group, and Exchange matching; these vendors are contractually restricted from using your data for any purpose other than providing the matching service to us.

5.4 Partner brands: For Premium Perks, we share the minimum data needed (typically a verification token or unique digital signature) to confirm your eligibility for an offer; we do not share your full profile with partner brands unless you separately consent.

5.5 Payment processors: RBI-authorised payment gateways process transactions for Subscription Fees, and event payments.

5.6 Cloud and infrastructure providers: Hosting, storage, and analytics vendors process data on our behalf under data processing agreements, including reasonable security safeguards required under DPDP Law.

5.7 Other Members: Certain data is visible to other Members by design and by your own action — for example, your public profile, Exchange posts, and Digital Name Card details you choose to exchange. Contact details are shared with another Member only after mutual, dual consent through the Bridge or an in-person QR exchange you initiate.

5.8 Legal and regulatory disclosures: We may disclose personal data where required by law, court order, or a competent government or regulatory authority, including the Data Protection Board of India.

5.9 We do not currently transfer personal data outside India except where a vendor’s processing infrastructure requires it under a data processing agreement with contractual safeguards; we will update this Policy if the Central Government notifies country-specific transfer restrictions under DPDP Law and any such restriction applies to us.

06 Data retention

6.1 We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Indicative retention periods:

• (a) Account and verification data: For the duration of your Membership, plus a period after account closure to handle disputes, fraud investigation, and legal requirements.
• (b) Transaction records (Subscription Fees, event payments): As required under applicable financial and tax record-keeping law.
• (c) Traffic and log data: Retained for at least one year, for security and grievance-resolution purposes.
• (d) WTF Bot interaction data: Retained for the period needed to provide personalised responses, after which it may be aggregated or deleted.

6.2 Where you close your account, we will erase or anonymise personal data that is no longer needed for a specified purpose, subject to our legal retention obligations.

07 Your rights and consent

7.1 Subject to Applicable Law, as a data principal you have the right to:

• (a) Obtain a summary of the personal data we hold about you and the processing activities carried out on it. This includes the right to obtain the identities of other data fiduciaries and data processors with whom the personal data has been shared, along with a description of the categories of personal data so shared;
• (b) Request correction, completion, or updating of inaccurate or incomplete personal data;
• (c) Request erasure of personal data that is no longer necessary for the purpose it was collected, unless we are required to retain it by law;
• (d) Withdraw consent at any time for processing based on consent, with effect for future processing only. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal;
• (e) Nominate another individual to exercise your rights on your behalf in the event of death or incapacity;
• (f) In limited circumstances, that will be determined by us at our sole discretion, you may be able to direct us to restrict our processing of the your data; and
• (g) Register a grievance regarding the processing of your personal data with us in accordance with this Policy and, if unresolved, approach the Data Protection Board of India.

7.2 The exercise of the above rights is subject to limitations, conditions, and exceptions prescribed under the Applicable Law. By accepting the terms of this Policy, you hereby agree that your consent is free, specific, informed, unconditional and unambiguous and is with a clear affirmative action. Your consent shall signify an agreement to the processing of your information for the specified purpose and be limited to such information as is necessary for such specified purpose.

7.3 You also have the option of making a complaint to the Board in a manner as laid down under applicable law. For the purposes of this Policy, ‘Board’ shall mean the Data Protection Board established by the Central Government in accordance with the DPDP Act, 2023 and rules made thereunder.

7.4 To exercise these rights, contact our Grievance Officer, who will resolve grievances within a reasonable period and, in any case, no later than the timeline prescribed under Applicable Law.

08 Cookies and tracking

8.1 We use cookies and/or other similar technologies to collect and store certain information. These typically involve pieces of information or code that a website transfers to or accesses from your computer hard drive or mobile device to store and sometimes track information about you. Cookies and similar technologies enable you to be remembered when using that computer or device to interact with websites and online services and can be used to manage a range of features and content as well as storing searches and presenting personalised content. This also helps us to provide you with a good experience when you browse our website and also allows us to improve our website. We use strictly necessary cookies if they are necessary for the performance of a contract with you, or because using them is in our legitimate interests (where we have considered that these are not overridden by your rights). By consenting to our use of cookies, you consent to the storage of these files on your device.

You can manage cookie preferences through your browser or device settings; disabling certain cookies may affect Platform functionality.

09 Children’s data

9.1 The Platform is intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we learn that we have inadvertently collected data from a minor, we will delete it promptly.

10 Security

10.1 We implement reasonable technical and organisational safeguards appropriate to the sensitivity of the data involved, including encryption of data in transit, access controls limiting who within our organisation can view verification data (such as credit score bands), and contractual security obligations on our processors, consistent with the safeguards required under Applicable Law. No system is completely secure, and we cannot guarantee absolute security.

10.2 In the event of a personal data breach, we will notify the Data Protection Board of India and affected Members as required under Applicable Law.

11 Withdrawing consent

11.1 You may withdraw consent for a specific processing activity (for example, disconnecting your LinkedIn account) through your account settings, or by contacting us at support@allthingswtf.club. Withdrawing consent for a feature that requires certain data will result in loss of access to that feature but will not affect features that do not depend on it.

12 Rights Of Members

12.1 We value openness and are dedicated to upholding all our member’s privacy rights. Each member of our Platform has the following rights:

12.1.1 The Right to Access: You have the right to request copies and/or obtain access of your information to the extent as laid down below from WTF Global Private Limited: (a) A summary of the information which is being processed by WTF Global Private Limited and the processing activities undertaken by WTF Global Private Limited with respect to such information; (b) The identities of all other data fiduciaries (as defined under applicable laws) and data processors (as defined under applicable laws) with whom the information has been shared by WTF Global Private Limited, along with a description of the information so shared; and (c) Any other information related to your personal data and its processing, as prescribed under applicable laws.

12.1.2 The Right to Rectification: In the event of any inaccurate or incomplete information, you have the right to rectification, completion, or updating of the information, as the case may be.

12.1.3 The Right to Erasure: Subject to certain conditions or for compliance with any law for the time being in force, upon your request, we shall erase any information as provided by you.

12.1.4 The Right to Withdraw: You have the right to withdraw your consent to processing of your data at any time. Please be advised that the same may result in the restriction of the complete services and access to our Platform.

12.1.5 The Right to Notification: You have the right to be notified regarding any rectification or erasure of information or restriction of processing unless this proves impossible or involves disproportionate effort.

12.1.6 The Right to Opt-in: You have the right to give explicit consent for the processing of your information or the right to withdraw your consent at any time.

12.1.7 The Right to Nominate: You have the right to nominate, any other individual, who shall, in the event of your death or incapacity, exercise your rights in accordance with the law.

12.1.8 The Right to Grievance Redressal: You shall have the right to have readily available means of grievance redressal provided by WTF Global Private Limited regarding the performance of our obligations in relation to the Information or the exercise of your rights under applicable law.

12.2 You are recognized to exercise your rights as per the applicable law of your respective jurisdiction as well.

13 Grievance Officer and Grievance Redressal

13.1 You may submit a request for the exercise of your right(s), grievance, or query related to processing of your information/personal data by contacting the grievance officer days through the details provided below:

Grievance Officer: Deepa Bhatt

Email: support@allthingswtf.club

Postal Address: Plot No 65 A, 4th Floor and 5th Floor Ramee Emerald II, New Link Road CTS-G/571, Santacruz West, Mumbai 400054.

13.2 Grievance Redressal.

13.2.1 You or a person acting on your behalf may submit a complaint through the grievance mechanism available on the Platform or by email to the Grievance Officer. To enable us to investigate and resolve a complaint, please provide your name, registered contact details, a clear description of the grievance, and, where relevant, the URL, communication link, screenshot, or other details necessary to identify the relevant content. We may request reasonable information or documentation to verify the complainant’s identity, authority, and the complaint, and to prevent misuse of the grievance mechanism.

13.2.2 We will acknowledge a complaint within 24 hours of receipt and endeavour to resolve it within 7 days of receipt. Complaints seeking removal or disabling of access to unlawful information will be acted upon as expeditiously as possible and, where applicable law requires, resolved within 24 hours of reporting.

14 Changes to this Policy

14.1 We may update this Policy from time to time to reflect changes in our practices or in applicable law, including as further provisions of DPDP Law come into force. We will notify you of material changes in-app or by email at least 30 days before they take effect. You agree to be bound by any updated policies with your continued access and/or use of the Platform after any such changes have been duly notified in any form to you. We recommend that you shall update your details with your active and correct email address with us for smooth communication. We will not be liable in case the registered email is inactive, incorrect or not updated for any claims regarding and not limited to communication gaps, liabilities and legal claims with regards to this Policy.

15 Third-party verification and enrichment

15.1 When you connect your LinkedIn account or your Instagram account, we engage a third-party verification partner — a specialist verification and background-check vendor — to help us assess your eligibility for Membership. Connecting either account triggers the same processing, described below; connecting both does not repeat checks that have already completed. This section describes that processing in more detail; see also Section 2.2 for the verification data we collect generally, and Section 5.1 for how we work with verification partners.

15.2 Categories processed. Connecting either account allows our verification partner to process the following categories of data about you:

• (a) identity and contact details;
• (b) mobile-intelligence data, including phone numbers, email addresses, and physical addresses associated with you, and your address history;
• (c) employment and professional history;
• (d) social and professional profile analysis; and
• (e) public-record and data-breach-exposure information.

15.3 Purpose. We use this data solely to vet and review your eligibility for Membership — to confirm your identity and professional background before you are admitted. We do not use it for advertising, and we do not use it for any purpose beyond Membership review.

15.4 Legal basis. We rely on your consent, given when you choose to connect LinkedIn or Instagram and see the on-screen disclosure at that step. Each connection is a separate consent, recorded separately. Consistent with the consent basis described in Section 4.

15.5 Who sees it. Access to this data is restricted to authorised administrators involved in membership review. We do not sell this data, and we do not share it for marketing.

15.6 Retention and your rights. We retain this data only for as long as needed to vet and review your Membership. You may withdraw consent or request deletion at any time by contacting us, as described in Section 11, and you have the rights set out in Section 7.

16 Duties of Members

16.1 You are required to observe the following duties while exercising your rights under the Applicable Law:

• (a) Compliance with applicable law: You shall comply with the provisions of all Applicable Laws while exercising your rights thereunder.
• (b) No impersonation: You shall not impersonate another person while providing personal data for any specified purpose.
• (c) No suppression of material information: You shall not suppress any material information while providing personal data for any document, unique identifier, proof of identity, or proof of address issued by the State or any of its instrumentalities.
• (d) No false or frivolous grievances: You shall not register a false or frivolous grievance or complaint to us; Grievance Officer; or with the Data Protection Board of India.
• (e) Furnishing verifiably authentic information: While exercising the right to correction or erasure of personal data, you shall furnish only such information as is verifiably authentic.
• (f) You shall not use the Platform to upload, post, publish, transmit, store, share or otherwise make available any information which is unlawful, harmful, defamatory, obscene, invasive of another person’s privacy, abusive, harassing, threatening, hateful, discriminatory, misleading, fraudulent or otherwise prohibited under applicable law.
• (g) Without prejudice to the generality of the foregoing, you shall not make available through the Platform or upload any content which:

i. belongs to another person and to which you do not have any right;

ii. is obscene, pornographic, paedophilic, invasive of another person’s privacy, including bodily privacy, insulting or harassing on the basis of gender, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or an online game that causes user harm, or promoting enmity between different groups on the grounds of religion or caste with the intent to incite violence;

iii. is harmful to children;

iv. infringes any patent, trademark, copyright or other proprietary rights;

v. violates any law for the time being in force;

vi. is patently false and untrue and is written or published with the intent to mislead or harass a person, entity or agency for financial gain or with the intent to cause injury to any person;

vii. is threatening to the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, public order, or causes incitement to the commission of any cognisable offence;

viii. contains malicious code, viruses, worms, spyware or other harmful or disruptive software;

ix. is in the nature of an online game that is not verified as a permissible online game;

x. is in the nature of advertisement or surrogate advertisement or promotion of an online game that is not a permissible online game, or of any online gaming intermediary offering such an online game;

xi. violates any law for the time being in force;

17 Disclaimer

17.1 We shall not be liable for any loss or damage sustained by reason of any disclosure (inadvertent or otherwise) of any information concerning the Account and / omission or inaccuracy with respect to any information so disclosed and used whether or not in pursuance of a legal process or otherwise.

17.2 You expressly understand and agree that the use of the Platform is at your sole risk. We shall under no circumstances be responsible or liable for any information leak, data loss, data theft, data corruption or the illegal or wrongful usage of any data stored on our servers or third-party servers and/or data available on either of our Platform, as the case may be.

18 Non-compliance with the Policy

18.1 If you do not comply with platform rules, we may immediately, at our sole discretion, suspend or terminate your access to or use of the Platform, remove or disable access to non-compliant information, or take both actions, as appropriate.

18.2 If your non-compliance involves creating, generating, modifying, altering, hosting, displaying, uploading, publishing, transmitting, storing, updating, sharing, or otherwise disseminating information in contravention of Applicable Law, you may be liable to penalties or punishment under the Information Technology Act, 2000 or any other applicable law.

18.3 If your violation concerns the commission of an offence that is required to be mandatorily reported under applicable law, including under the Bharatiya Nyaya Sanhita, 2023 read with the Bharatiya Nagarik Suraksha Sanhita, 2023, or the Protection of Children from Sexual Offences Act, 2012, we will report the offence to the appropriate authority in accordance with applicable law.

19 Information generated through WTF Bot

19.1 WTF Bot may enable you to create, generate, modify, alter, publish, transmit, share, or otherwise disseminate synthetically generated information. You must not direct, instruct, or otherwise cause WTF Bot to create, generate, modify, alter, publish, transmit, share, or disseminate any information that is unlawful or otherwise prohibited under these terms, the Privacy Policy, or applicable law.

19.2 Any such contravention may attract penalties or punishment under applicable law, including the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, the Protection of Children from Sexual Offences Act, 2012, the Representation of the People Act, 1951, the Indecent Representation of Women (Prohibition) Act, 1986, the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, and the Immoral Traffic (Prevention) Act, 1956 or any amendments of the aforementioned laws.

19.3 Where we identify or receive notice of such contravention, we may, without prior notice and without prejudice to any other rights or remedies available to us: (a) immediately remove, disable access to, or restrict the relevant input, output, or other information; (b) suspend or terminate the your account, while taking reasonable steps to preserve evidence; (c) identify the relevant user and, where required or permitted by applicable law, disclose that user’s identity to a complainant who is a victim of, or is acting on behalf of a victim of, the contravention; and (d) report the matter to the appropriate authority where the conduct relates to an offence that must be mandatorily reported under applicable law, including under the Bharatiya Nyaya Sanhita, 2023 read with the Bharatiya Nagarik Suraksha Sanhita, 2023, or the Protection of Children from Sexual Offences Act, 2012.

20 GOVERNING LAW AND DISPUTE RESOLUTION

Any dispute arising out of or in connection with or relating to this Policy (a “Dispute”), shall be resolved by arbitration governed by the Arbitration and Conciliation Act, 1996 and in accordance with the Rules of Arbitration of the Mumbai Centre for International Arbitration, as amended from time to time. The language of the arbitration shall be English. The seat and venue of arbitration shall be Mumbai, India, and the courts at Mumbai shall have exclusive jurisdiction. The arbitral tribunal shall consist of three (3) arbitrators: the party referring the Dispute shall appoint one (1) arbitrator, the other party shall appoint one (1) arbitrator, and the presiding arbitrator shall be appointed by the two (2) appointed arbitrators; failing which appointment shall be made in accordance with the Arbitration and Conciliation Act, 1996. The award shall be final and binding on the parties. Subject to arbitration above, this Policy shall be governed in all respects by the laws of India and the parties hereby submit to the exclusive jurisdiction of the courts at Mumbai, India.