Privacy Policy

1. Introduction

Wabcash, operated by WABCASH MARKET INSIGHTS (OPC) PRIVATE LIMITED, is legally obligated to protect the privacy of its users in accordance with applicable data protection laws.

This Privacy Policy explains how we collect, use, share, store, and protect personal data, and the rights available to you under applicable privacy laws, including:

• General Data Protection Regulation (GDPR) (EU) 2016/679 — For all users in the European Economic Area.
• Digital Personal Data Protection Act, 2023 (DPDP Act) — For all users in India.
• California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) — For users in California, USA.
• Information Technology Act, 2000 and SPDI Rules, 2011 — Under Indian law.

2. Contact Details to the Controller

Name of the Company: WABCASH MARKET INSIGHTS (OPC) PRIVATE LIMITED

CIN Number: U74999BR2021OPC051000

Registered Office Address: Nazra Mohammad Abad, Ward No. 1, District Darbhanga, Bihar, India – 847239

Country of Operation: India

E-mail Address to Customer Support: aadil@wabcash.com

3. Data Storage

Personal data may be stored and processed on secure servers located in the United States and other jurisdictions where Wabcash and its authorised service providers operate. Appropriate technical and organisational measures, including encryption and access controls, are implemented to safeguard personal data.

4. Contact Details for the Controller's Representative

Name: M.D. Aadil

Title: Privacy and Grievance Officer

E-mail Address: aadil@wabcash.com

5. What is Personal Data?

"Personal data" is any information relating to an identifiable or identified person (you as a user). An identifiable person is someone who can be identified, directly or indirectly, for example by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

6. Special Categories of Personal Data

Special categories of personal data include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as data concerning health, sex life, or sexual orientation.

We do not actively seek to collect special categories of personal data. Where such data is collected, it is processed only in limited circumstances where it is strictly necessary for a specific survey purpose and only where you have provided explicit consent or where another lawful basis is permitted under applicable data protection laws.

Where such data is processed, it is subject to enhanced security measures, including strict access controls, role-based permissions, and confidentiality safeguards. Such data is not used for marketing purposes and is kept separate from directly identifiable personal data wherever reasonably practicable.

7. Personal Data We Handle

We process personal data for specific and legitimate purposes as described in this Privacy Policy. The categories of data collected, the purposes of processing, the legal bases for processing, and the applicable retention periods are explained in the relevant sections below.

Email Address

We collect and process your email address to validate that the user entering our system is a real person. We do this as it is necessary for our performance of a contract where you as a user are a party.

Address

We collect and process your address (only postal code, state, region and country) as most surveys are geo-targeted to respondents from specific locations. We do this as it is necessary for our performance of a contract where you as a user are a party.

Date of Birth

As most surveys are targeting respondents based on age, we collect and process your date of birth/age, as it is necessary for our performance of a contract where you as a user are a party.

Professional Details

Many surveys are targeted to specific professional profiles. Therefore, we collect and process your professional details as it is necessary for our performance of a contract where you as a user are a party.

Profiling Details

For statistical reasons, many surveys require profiling details (including gender, highest completed level of education, occupation, marital status and annual/monthly income). We therefore collect and process this personal data as it is necessary for our performance of a contract where you as a user are a party.

Event Registration Details

Some survey creators collect event registration details, and this is therefore collected and processed by us, as it is necessary for our performance of a contract where you as a user are a party.

Incentive & Reward Details (Sensitive Personal Data or Information)

We collect and process your financial and payout details exclusively to distribute rewards, cashouts, and incentives earned through your participation in our survey panel or aggregated survey walls. Depending on your choice of redemption, this includes your Unified Payments Interface (UPI) ID, digital wallet identifiers, or bank account parameters. Under the Indian SPDI Rules, 2011, this is managed with enhanced security controls and is strictly processed under contractual necessity.

8. Automatically Collected Information

We automatically collect certain technical information when you use our platform, including IP address, device identifiers, non-biometric device fingerprinting information, browser type, operating system, and session data.

Purpose of Processing

We process this information to support the secure and reliable operation of our platform, including:

• Ensuring platform security and preventing fraud
• Detecting duplicate accounts and suspicious or abusive activity
• Maintaining platform integrity, stability, and service quality
• Improving system performance and overall user experience
• Complying with applicable legal and regulatory obligations
• Managing incentives, rewards, and participation validation

We may use automated processing and profiling to match users with relevant surveys, assess eligibility, prevent fraud, and manage survey participation opportunities.

Such processing is carried out strictly for operational, security, and quality assurance purposes. It may influence your eligibility for certain surveys or reward opportunities; however, it does not result in decisions that have legal or similarly significant effects on you.

9. Cookies & Tracking Technologies

When you first visit Wabcash, we may place cookies on your device to recognise your browser and enable core platform functionality. Cookies are small text files stored on your device.

Where required by applicable law, you will be presented with a cookie consent mechanism that allows you to accept, reject, or customise your preferences for non-essential cookies before they are set.

We use cookies to operate and improve our services, including:

• Enabling essential platform functionality
• Remembering user preferences
• Analysing usage patterns to improve performance and user experience
• Supporting fraud prevention, security, and quality control

Most web browsers automatically accept cookies, but you can modify your browser settings to block or delete cookies. Please note that disabling cookies may affect the functionality and performance of certain features of the platform.

10. Data Sharing & Third Parties

We may share personal data with the following categories of third parties:

Third-Party Market Research Companies and Panel Providers

To connect you with relevant survey opportunities, we may share certain limited information with accredited third-party market research companies and panel providers. This information may include a unique identification number ("UID"), which is an internal identifier assigned by Wabcash and does not directly identify you, together with postal code, region/state, gender, marital status, education, employment information, ethnicity or race (only where permitted by applicable law and with your consent), and social grade.

Survey opportunities may be provided through third-party market research companies and panel providers, and participation in such surveys may also be subject to the privacy policies and terms of those partners.

We will never share your name, email address, phone number, or other direct contact information with third-party market research companies unless you have provided your explicit consent or such disclosure is otherwise required by applicable law.

All third parties receiving personal data are subject to appropriate contractual confidentiality, security, and data protection obligations.

Technology and Service Providers

We engage trusted technology, analytics, hosting, customer support, and security service providers to operate and support the Wabcash platform. These service providers are permitted to access personal data only to the extent necessary to perform services on our behalf and are bound by contractual obligations to protect such information.

Legal and Regulatory Requirements

We may disclose personal data where required to do so by applicable law, regulation, court order, governmental request, or other legal process. Where permitted by law, we will inform you of such disclosures.

What We Never Do

• We will never sell your personal data to third parties for commercial advertising or non-research purposes.
• We will never use your survey responses to send unsolicited commercial offers.
• We will never share personal data with parties that do not have appropriate data protection and confidentiality obligations in place.

Our safeguards include:

• Encryption of data in transit and at rest.
• Contractual safeguards with all data recipients, including Standard Contractual Clauses where applicable under GDPR.
• Access controls ensuring only authorised personnel can access data.

By using the Wabcash platform, you acknowledge and agree to the transfer and processing of your personal data in the United States and other countries as described in this Policy. You may request more information about our data transfer safeguards by contacting us at aadil@wabcash.com.

11. Data Retention

We retain personal data only for as long as necessary to provide our services, manage user accounts, distribute rewards, and comply with legal obligations.

Account Data

Account data is retained while your account remains active. Inactive accounts are deleted after twenty-four (24) months of continuous inactivity. We will send reminder emails at approximately twenty-two (22) and twenty-three (23) months before deletion.

After deletion, data is permanently removed or anonymised unless retention is required for legal, regulatory, fraud prevention, or dispute resolution purposes.

Profiling and Demographic Data

Profiling and demographic data are retained while your account is active. If you request account deletion, such data will be deleted or anonymised within thirty (30) days, unless retention is required by law.

For inactive accounts, this data is deleted together with account data after twenty-four (24) months of inactivity.

Survey Response Data

Survey response data is retained only for as long as necessary for research purposes and client reporting, typically no longer than twelve (12) months after project completion, after which it is deleted or anonymised.

Deletion Requests

You may request deletion of your account and personal data at any time by contacting us or through your account. We will process requests in accordance with applicable laws, except where retention is required for legal obligations, fraud prevention, dispute resolution, or enforcement of agreements.

Legal Retention

We may retain personal data for longer periods where required by law or for legitimate purposes such as tax compliance, fraud prevention, or legal claims. In such cases, data is retained only for the minimum necessary period and securely deleted or anonymised thereafter.

12. Data Security and Breach Notification

Wabcash implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, loss, misuse, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest using industry-standard security measures.
• Access controls and role-based permissions limiting access to authorised personnel only;
• Monitoring, logging, and intrusion detection mechanisms;
• Regular internal security reviews and vulnerability assessments; and
• Staff training and awareness regarding data protection obligations.

In the event of a personal data breach, Wabcash will promptly investigate the incident and take appropriate steps to contain, assess, and remediate the breach. Where required by applicable law, we will notify the relevant supervisory authority without undue delay and, in the case of the GDPR, within seventy-two (72) hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Where the breach is likely to result in a high risk to affected individuals, we will notify those individuals without undue delay in accordance with applicable legal requirements. Such notifications may include the nature of the breach, categories of personal data affected, likely consequences, measures taken or proposed to address the breach, and contact information for obtaining further assistance.

We will also notify relevant business partners, clients, service providers, and data processors in accordance with applicable laws and contractual obligations where such notification is necessary.

13. Your Rights

You have the following rights over your personal data. To exercise any of these rights, please contact us at aadil@wabcash.com or submit a support ticket through your account.

Right to Access

You have the right to obtain confirmation of whether we process personal data about you, and to receive a copy of that data together with information about the purposes of processing, categories of data, recipients, retention periods, and the existence of any automated decision-making.

Right to Rectification

You have the right to request correction of inaccurate personal data and completion of incomplete data. We will action such requests within 30 days.

Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data. We will delete it as soon as possible and no later than one (1) month from receipt of your request, except where retention is required to comply with legal obligations or for the establishment, exercise, or defence of legal claims.

Right to Restriction of Processing

You may request restriction of processing in certain circumstances, including where you contest the accuracy of personal data, where processing is unlawful but you do not wish the data to be deleted, or where you have objected to processing pending verification of our legitimate grounds.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.

Right to Object

You have the right to object at any time to the processing of your personal data for automated decision-making (including profiling) and direct marketing purposes.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time by contacting aadil@wabcash.com. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Please note that withdrawing consent for certain categories of data may affect your ability to participate in some surveys.

Rights Under the Indian DPDP Act

Under the Digital Personal Data Protection Act, 2023, you have the right to access information about your personal data, correct or erase personal data, nominate a representative to exercise your rights in the event of your death or incapacity, and raise grievances regarding decisions made about your personal data.

14. Opt-In and Opt-Out of Communications

By registering on or using the Wabcash platform, you explicitly opt in to receive essential service-related communications, including account notifications, reward alerts, security messages, and survey invitations directly related to your account. For marketing or promotional communications (such as newsletters or special offers), we obtain your separate, explicit consent through an unchecked checkbox during registration or subsequently via your account settings. You may opt out of marketing communications at any time without affecting your ability to receive essential service-related messages.

You may opt out of receiving marketing or promotional communications at any time by clicking the unsubscribe link included in such emails or by contacting us at aadil@wabcash.com. All opt-out requests will be processed promptly and applied on a going-forward basis.

Opting out of marketing communications does not affect your ability to receive essential service-related or transactional communications that are necessary for the operation of your account or participation in surveys.

Where required by law, we obtain your explicit opt-in consent before sending marketing communications. You may withdraw your consent at any time by contacting aadil@wabcash.com, without affecting the lawfulness of processing carried out prior to such withdrawal.

Please note that withdrawing consent or opting out of certain communications may limit or prevent access to specific surveys, promotions, features, or non-essential services offered by Wabcash.

15. For Users in India — DPDP Act, 2023

Our Role: WABCASH MARKET INSIGHTS (OPC) PRIVATE LIMITED acts as your Data Fiduciary under the Digital Personal Data Protection Act, 2023.

Your Status: You are a Data Principal and have the following rights:

• Access, correct, erase, and update your personal data.
• Register grievances regarding our processing of your personal data.
• Nominate a representative to exercise your rights upon your death or incapacity.

Nomination: You may nominate a representative by emailing aadil@wabcash.com with the nominee's full name, email address, and relationship to you. We will verify your identity and process the nomination request within thirty (30) days. You may modify or revoke your nomination at any time by contacting the same email address.

Grievance Officer: M.D. Aadil
Email: aadil@wabcash.com

Data Protection Board of India: Details regarding the Data Protection Board of India will be made available through the official website notified by the Government of India.

We acknowledge grievances within forty-eight (48) hours and endeavor to resolve them within thirty (30) days of receipt.

Consent: free, specific, informed, and unambiguous consent given through clear affirmative action before processing your personal data where required by the DPDP Act. You may withdraw your consent at any time by contacting aadil@wabcash.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Children's Data

During registration, we require all users to confirm their date of birth via a mandatory age-screening question. If a user indicates they are under eighteen (18) years of age, registration is immediately rejected and no personal data is collected. If we become aware that personal data relating to an individual under eighteen (18) years of age has been collected or processed despite this screening, we will delete such information within seventy-two (72) hours from our records.

Consent Manager

We do not currently engage a registered Consent Manager under the DPDP Act. All consent-related requests should be directed to aadil@wabcash.com. If we appoint a registered Consent Manager in the future, we will update this Privacy Policy accordingly.

16. Users Located in California

If you are a California resident, the following disclosures are provided in accordance with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), if we discover a breach of unencrypted personal information of a California resident, we will notify the affected resident within thirty (30) calendar days of discovery. If more than 500 California residents are affected by a single breach, we will submit a sample copy of the breach notification to the California Attorney General within fifteen (15) calendar days of notifying consumers. The notification will include: (a) name and contact information of Wabcash; (b) list of types of personal information involved; (c) date or estimated date range of the breach; (d) whether notification was delayed due to law enforcement investigation; (e) general description of the breach incident; and (f) credit reporting agency contact information if Social Security or driver's license numbers were exposed.

Categories of Personal Information We Collect

During the preceding twelve (12) months, we may have collected the following categories of personal information:

• Identifiers, such as name, email address, postal code, IP address, and account-related identifiers;
• Demographic and profile information, including age, gender, education, occupation, marital status, and similar profiling details;
• Internet or other electronic network activity information, including browser type, device information, cookies, session data, and interactions with our platform;
• Professional or employment-related information provided by you;
• Inferences drawn from the information collected to match users with relevant survey opportunities and maintain platform integrity; and
• Sensitive personal information only where voluntarily provided by you, permitted by applicable law, and necessary for a specific research purpose.

Sources of Personal Information

We collect personal information directly from you, automatically through your use of our services, and, where permitted by law, from trusted market research partners and service providers.

Purposes for Collecting and Using Personal Information

We use personal information to:

• Provide and administer your account and survey participation;
• Match users with relevant survey opportunities;
• Conduct market research and statistical analysis;
• Prevent fraud, abuse, and duplicate participation;
• Maintain security, quality control, and platform integrity;
• Manage incentives, rewards, and customer support;
• Comply with legal and regulatory obligations; and
• Improve and develop our services.

Disclosure of Personal Information

We may disclose personal information to accredited market research companies, panel providers, technology and hosting providers, analytics providers, customer support providers, and other service providers that assist us in operating our services. Such disclosures are made only for legitimate business purposes and subject to appropriate contractual safeguards.

Wabcash does not sell personal information for monetary consideration and does not share personal information for cross-context behavioural advertising purposes.

Your California Privacy Rights

Subject to applicable exceptions, California residents have the right to:

• Know the categories and specific pieces of personal information we collect, use, disclose, and retain;
• Request access to and obtain a copy of their personal information;
• Request deletion of personal information collected from them;
• Request correction of inaccurate personal information;
• Limit the use and disclosure of sensitive personal information, where applicable;
• Opt out of the sale or sharing of personal information (Wabcash does not sell or share personal information for cross-context behavioural advertising purposes); and
• Be free from discrimination for exercising their privacy rights.

You may exercise these rights by contacting us at aadil@wabcash.com or by submitting a support request through your account. We may verify your identity before processing your request. You may also designate an authorised agent to submit requests on your behalf.

California residents may make requests to know or access their personal information up to twice within a twelve (12) month period, as permitted by applicable law.

17. International Data Transfers

Wabcash may transfer and process personal data outside the user's country of residence, including in the United States and other countries where Wabcash or its service providers operate. Where required under applicable law, appropriate safeguards, including contractual protections and recognised transfer mechanisms, will be implemented to ensure that personal data remains protected in accordance with this Privacy Policy and applicable data protection.

Wabcash protects personal data through appropriate technical, organisational, and administrative measures designed to ensure confidentiality, integrity, and availability of personal information. We process personal data in accordance with applicable data protection laws and principles of transparency, fairness, and accountability.

Users retain control over their personal data through the rights described in this Privacy Policy, including the rights to access, correct, erase, restrict, object to certain processing activities, and withdraw consent where applicable. We regularly review our data protection practices and implement safeguards appropriate to the nature of the personal data processed and the risks involved.

For transfers of personal data from the European Economic Area (EEA) to countries outside the EEA, including the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. You may request a copy by contacting aadil@wabcash.com.

18. GDPR Compliance

Wabcash is committed to protecting personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We process personal data fairly, lawfully, transparently, and only for specified and legitimate purposes.

We implement appropriate technical and organisational measures to safeguard personal data against unauthorised access, disclosure, alteration, loss, or destruction. Access to personal data is restricted to authorised employees, contractors, and service providers who require such access to perform their duties and who are subject to confidentiality and data protection obligations.

The legal basis for processing personal data may vary depending on the nature of the survey or service provided and may include:

• The data subject's informed consent, including consent to participate in market research activities;
• The performance of a contract to which the data subject is a party;
• Compliance with legal obligations; and
• Legitimate interests pursued by Wabcash or its clients, provided that such interests are not overridden by the rights and freedoms of the data subject.

Personal data collected through surveys is used only for the purposes described in this Privacy Policy and the relevant survey invitation. Survey results are generally reported to clients in an aggregated or anonymised format. Where a client requests access to identifiable survey responses, we will seek your specific consent where required by applicable law.

Wabcash may engage carefully selected third-party service providers and research partners to assist in delivering its services. Appropriate contractual safeguards are implemented to ensure that personal data is protected and processed only in accordance with our instructions and applicable data protection laws.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, enforce our agreements, and protect our legitimate interests. Where consent is withdrawn and no other lawful basis for processing exists, we will delete or anonymise the relevant personal data in accordance with our retention practices.

Participation in market research surveys is voluntary. You may withdraw from a survey at any time and may exercise your rights under the GDPR, including rights of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent, subject to applicable legal limitations.

You have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement, in accordance with applicable data protection laws.

19. Privacy and Grievance Officer (Data Protection Officer)

Wabcash is committed to protecting your personal data and handling privacy-related concerns in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the General Data Protection Regulation (GDPR).

We have appointed a dedicated Data Protection Officer (DPO) / Grievance Officer to oversee data protection compliance and address user queries and complaints.

If you have any questions about this Privacy Policy, wish to exercise your data protection rights (including access, correction, or deletion), or wish to raise a grievance regarding the processing of your personal data, you may contact our officer below:

• Name: M.D. Aadil
• Title: Privacy and Grievance Officer (Data Protection Officer)
• Email: aadil@wabcash.com

The Data Protection Officer and Grievance Officer roles may be performed by the same individual for operational purposes.

We will acknowledge all grievances within forty-eight (48) hours and aim to resolve them within thirty (30) days of receipt.

20. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The updated version will be posted on this page, and the "Last Updated" date at the top of this Privacy Policy will be revised accordingly. Where required by applicable law, or where changes materially affect your rights or the way we process your personal data, we will provide additional notice through our website, email communications, account notifications, or other appropriate means before such changes take effect.

21. Your Consent

By registering for and using the Wabcash platform, you acknowledge that you have read, understood, and agree to this Privacy Policy. You confirm that you are eighteen (18) years of age or older.