Privacy Notice

Summary of Key Points

This summary provides key points from our privacy notice. You can find out more details about any of these topics in the sections below.

Special Provision for WhatsApp Business and Messaging Services

Varnet Solutions Private Limited operates as an Independent Tech Provider for Meta platforms. We provide software solutions that allow businesses to manage their communication channels using the WhatsApp Business API.

A. Information Processed on Behalf of Our Users

When your business connects a WhatsApp Business Account (WABA) to our messaging platform, we process incoming and outgoing communications as a Data Processor. This includes:

• Customer phone numbers, WhatsApp User IDs, and profile display names.
• We do not access or review message content except where necessary to provide platform functionality, troubleshooting, security monitoring, or customer-requested support services.
• Message delivery metrics (sent timestamps, delivery statuses, and read receipts).
• Meta account identifiers and authentication configuration required for WhatsApp Business API connectivity.
• End users communicating with businesses through WhatsApp may contact the respective business directly regarding access, correction, or deletion of their messaging data.

B. Purpose of Data Processing

We process this data exclusively to power your customer support dashboards, execute automated chatbot workflows, trigger notification alerts, and manage message templates. We do not sell, monetize, or use your end-customers' communication data for our own marketing purposes.

C. Data Security and Meta Infrastructure

All messaging traffic is routed directly through secure servers to Meta Platforms, Inc. via official Cloud APIs. API tokens and access keys are stored using industry-standard database encryption protocols to prevent unauthorized access.

D. Data Deletion Instructions

If you wish to delete your account, authentication tokens, or any associated messaging platform data from our systems, please follow these steps:

• Submit a Request: Send an email directly to our support team at [email protected] with the subject line "Data Deletion Request".
• Provide Details: Include your registered business name, contact number, and your Meta WhatsApp Business Account (WABA) ID.
• Verification & Processing: Our data compliance team will verify your ownership credentials within 2 business days.
• Permanent Deletion: Upon verification, all database records, access tokens, webhook message payloads, and active caches associated with your account will be permanently deleted from our secure infrastructure. A confirmation receipt will be sent to your registered email address once the process is complete.

Varnet Solutions Private Limited is an independent software provider and is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc.

Table of Contents

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. When and With Whom Do We Share Your Personal Information?
4. How Long Do We Keep Your Information?
5. How Do We Keep Your Information Safe?
6. Do We Collect Information From Minors?
7. What Are Your Privacy Rights?
8. Controls For Do-Not-Track Features
9. Do California Residents Have Specific Privacy Rights?
10. Do Virginia Residents Have Specific Privacy Rights?
11. Do We Make Updates To This Notice?
12. How Can You Contact Us About This Notice?

1. What Information Do We Collect?

Personal Information You Disclose to Us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You

The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names
• Phone numbers
• Email addresses
• Mailing addresses
• Job titles
• Contact preferences
• Usernames
• Passwords
• Contact or authentication data
• Billing addresses
• Meta Business Account IDs and WhatsApp Business Account (WABA) IDs
• Authentication credentials and API configuration information required to connect Meta and WhatsApp Business services
• WhatsApp message templates submitted for approval

Sensitive Information

We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process personal information based on legitimate business interests, contractual necessity, legal obligations, and user consent where applicable, including:

• To facilitate account creation and authentication and otherwise manage user accounts, so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user, so we can provide you with the requested service.
• To respond to user inquiries / offer support to users, to solve any potential issues you might have with the requested service.
• To send administrative information to you, such as details about our products and services, changes to our terms and policies, and other similar information.
• To fulfil and manage your orders, payments, returns, and exchanges made through the Services.
• To request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications, in accordance with your marketing preferences. You can opt out of our marketing emails at any time (see "What Are Your Privacy Rights?" below).
• To post testimonials on our Services that may contain personal information.
• To protect our Services, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing, and your experience, including identifying usage trends and determining the effectiveness of our promotional campaigns.
• To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

3. When and With Whom Do We Share Your Personal Information?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• When we use Google Maps Platform APIs. We may share your information with certain Google Maps Platform APIs (e.g. Google Maps API, Places API) to retrieve certain information when you make location-specific requests, such as the location of our business office. If you are located in the EEA, Iceland, Liechtenstein, Norway, or the UK, additional data protection rights may apply to you.
• Meta Platforms, Inc. We share and route data with Meta Platforms, Inc. to transmit messages via the WhatsApp Cloud API ecosystem on behalf of our platform users.
• Our Services may integrate with third-party providers including Meta Platforms, Inc., hosting providers, analytics providers, and cloud infrastructure partners solely for delivering platform functionality.

4. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than thirty-six (36) months past the termination of the user's account.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

5. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

We implement industry-standard security measures including encrypted HTTPS/TLS communication, access controls, authentication safeguards, and restricted administrative access to protect stored information.

6. Do We Collect Information From Minors?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at [email protected].

7. What Are Your Privacy Rights?

In Short: You may review, change, or terminate your account at any time.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here.

If you are located in Switzerland, the contact details for the data protection authorities are available here.

Withdrawing Your Consent

If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time by contacting us using the details in "How Can You Contact Us About This Notice?" below. However, please note that this will not affect the lawfulness of the processing before its withdrawal.

Opting Out of Marketing and Promotional Communications

You can unsubscribe from our marketing and promotional communications at any time by replying 'STOP' or 'UNSUBSCRIBE' to the SMS messages that we send, or by contacting us using the details provided below. You will then be removed from the marketing lists. However, we may still communicate with you for service-related, non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.
• Contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at [email protected].

8. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

9. Do California Residents Have Specific Privacy Rights?

In Short: Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the 'Shine The Light' law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g. backups, etc.).

CCPA Privacy Notice

The California Code of Regulations defines a 'resident' as: (1) every individual who is in the State of California for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose. All other individuals are defined as 'non-residents'. If this definition of 'resident' applies to you, we must adhere to certain rights and obligations regarding your personal information.

What Categories of Personal Information Do We Collect?

We have collected the following categories of personal information in the past twelve (12) months:

We will use and retain the collected personal information as needed to provide the Services, or for:

• Category A — As long as the user has an account with us
• Category B — As long as the user has an account with us

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of: receiving help through our customer support channels; participation in customer surveys or contests; and facilitation in the delivery of our Services and to respond to your inquiries.

How Do We Use and Share Your Personal Information?

You may contact us by email at [email protected], or by referring to the contact details at the bottom of this document.

If you are using an authorised agent to exercise your right to opt out, we may deny a request if the authorised agent does not submit proof that they have been validly authorised to act on your behalf.

Will Your Information Be Shared With Anyone Else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Each service provider is a for-profit entity that processes the information on our behalf, following the same strict privacy protection obligations mandated by the CCPA.

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be 'selling' of your personal information.

Varnet Solutions Private Limited has not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, and will not sell or share personal information in the future belonging to website visitors, users, and other consumers.

Your Rights With Respect to Your Personal Data

• Right to request deletion of the data. You can ask for the deletion of your personal information, subject to certain exceptions provided by law.
• Right to be informed. Depending on the circumstances, you have a right to know whether we collect and use your personal information, the categories we collect, the purposes for which it is used, whether we sell or share it, and the specific pieces of personal information we collected about you.
• Right to non-discrimination for the exercise of your privacy rights.
• Right to limit use and disclosure of sensitive personal information. We do not process consumers' sensitive personal information.

Verification Process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request, and will delete any additionally provided verification information as soon as we finish verifying you.

Other Privacy Rights

• You may object to the processing of your personal information.
• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.
• You can designate an authorised agent to make a request under the CCPA on your behalf.
• You may request to opt out from future selling or sharing of your personal information to third parties. We will act on such requests no later than fifteen (15) days from the date of submission.

To exercise these rights, you can contact us by email at [email protected], or by referring to the contact details at the bottom of this document.

10. Do Virginia Residents Have Specific Privacy Rights?

In Short: Yes, if you are a resident of Virginia, you may be granted specific rights regarding access to and use of your personal information.

Virginia CDPA Privacy Notice

Under the Virginia Consumer Data Protection Act (CDPA), 'Consumer' means a natural person who is a resident of the Commonwealth acting only in an individual or household context, and does not include a natural person acting in a commercial or employment context. 'Personal data' means any information that is linked or reasonably linkable to an identified or identifiable natural person, and does not include de-identified data or publicly available information. 'Sale of personal data' means the exchange of personal data for monetary consideration.

The information we collect, use, and disclose about you will vary depending on how you interact with Varnet Solutions Private Limited and our Services. To find out more, please see "What Information Do We Collect?", "How Do We Process Your Information?", and "When and With Whom Do We Share Your Personal Data?" above.

Your Rights With Respect to Your Personal Data

• Right to be informed whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ('profiling')

Varnet Solutions Private Limited has not sold any personal data to third parties for business or commercial purposes, and will not sell personal data in the future belonging to website visitors, users, and other consumers.

Exercise Your Rights Provided Under the Virginia CDPA

You may contact us by email at [email protected], or by referring to the contact details at the bottom of this document. If you are using an authorised agent to exercise your rights, we may deny a request if the authorised agent does not submit proof that they have been validly authorised to act on your behalf.

Verification Process

We may request that you provide additional information reasonably necessary to verify you and your consumer's request. Upon receiving your request, we will respond without undue delay, but in all cases within forty-five (45) days of receipt. This period may be extended once by forty-five (45) additional days when reasonably necessary, and we will inform you of any such extension within the initial 45-day response period.

Right to Appeal

If we decline to take action regarding your request, we will inform you of our decision and reasoning. If you wish to appeal our decision, please email us at [email protected]. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response, including a written explanation of the reasons for the decision.

11. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

12. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact our Privacy Team, Rajkumar Yadav: