Consumer Privacy Policy

---

1. Purpose

This Consumer Privacy Notice explains how personal data may be processed when you receive a digital receipt or related transaction communication from a merchant using Green Receipt, a service provided by BuyNxt Pvt. Ltd. ("BuyNxt"). It is intended for customers of participating merchants.

This Notice is designed to support applicable requirements under DPDP and, where applicable, GDPR. It should be read together with the privacy information provided by the merchant from whom you purchased goods or services.

2. Scope

• Customers who provide a mobile/WhatsApp number to a participating merchant for a digital receipt or related transaction service.

• Receipts delivered through a Green Receipt-enabled shared number or through the merchant's own WhatsApp Business number, including supported Co-Existence configurations.

• Personal data processed through Green Receipt for receipt delivery, transaction support, preference management, security and related merchant-authorised services.

3. Who is Responsible for Your Personal Data?

The merchant from whom you purchased goods or services generally determines why your personal data is collected and used in connection with your purchase and receipt. The merchant generally acts as the relevant Data Fiduciary under DPDP and/or Controller under GDPR, where applicable.

BuyNxt generally processes this information on the merchant's behalf to provide Green Receipt and therefore acts as a Data Processor and/or Processor for that processing. BuyNxt may separately act as a Data Fiduciary/Controller for limited purposes it determines itself, such as platform security, legal compliance or handling a request directed to BuyNxt.

4. Personal Data We May Process

Category Examples

Contact data Mobile/WhatsApp number and name where supplied.

Merchant/store data Merchant identity, outlet/store and POS identifiers associated with your transaction.

Receipt / transaction data Invoice number, date/time, amount, taxes, products/services and other information appearing on the receipt.

Delivery metadata Message/template identifiers, timestamps, delivery/read status where available and technical delivery records.

Privacy / communication preferences Green Receipt opt-in/opt-out or preference actions, notice/consent version and timestamps where applicable.

Support & security data Limited support information and logs needed to operate, troubleshoot, secure and audit the service.

5. How We Receive Your Information

Typically, you provide your mobile number to the merchant or its staff at the billing counter for the purpose of receiving your receipt or related transaction communication. The merchant/POS/partner system then sends the information required for the Green Receipt service to BuyNxt.

You may also provide information directly through a Green Receipt interaction, for example by selecting Get Receipt, Share Feedback, More Options, Privacy, or another available action.

6. Why Your Information is Used

Purpose How the data may be used

Receipt delivery Generate and deliver the invoice/receipt or requested transaction communication.

Transaction support Confirm delivery, troubleshoot failures and assist the merchant or customer with receipt-related issues.

Security & audit Prevent misuse, secure the service and maintain necessary operational/audit records.

Privacy preferences Record and apply Green Receipt privacy/communication choices where the feature is used.

Merchant-authorised engagement Enable additional merchant functionality only where instructed by the merchant and supported by an appropriate legal basis.

Legal compliance Meet applicable legal obligations and respond to lawful requests.

7. WhatsApp Receipt Journey

A first Green Receipt message may identify the merchant and transaction and provide a button such as Get Receipt. It may also provide a short privacy statement and direct you to More Options for privacy information and preferences.

The purpose of the short message is to provide clear information in the WhatsApp journey while this full Notice provides more detail about the processing.

8. Marketing and Communication Preferences

Providing your mobile number for receipt delivery does not by itself constitute consent to BuyNxt promotional marketing. Where Green Receipt is used by a merchant to collect an affirmative preference for offers or updates, the preference and related audit information may be recorded on behalf of that merchant.

A STOP or similar preference action made through Green Receipt applies to the relevant Green Receipt-facilitated optional/promotional communication flow. It does not necessarily require deletion of invoice or transaction records that must be retained for legal, contractual, security or dispute purposes.

9. Merchant-Owned WhatsApp / Co-Existence

Depending on the merchant's setup, your receipt may be delivered through a shared Green Receipt-enabled number or the merchant's own WhatsApp Business account.

Where a merchant uses its own WhatsApp Business account, including through supported Co-Existence functionality, the merchant may also use that account independently of Green Receipt. Communications independently initiated by the merchant are controlled by the merchant and are subject to the merchant's own privacy and communication practices.

Green Receipt privacy or communication preferences apply to processing and communications facilitated through Green Receipt and may not control communications independently initiated by the merchant through its own channels. For those communications, please contact the merchant directly.

10. Sharing and Disclosure

• The merchant from whom you purchased the goods or services.

• BuyNxt as the Green Receipt technology provider.

• The merchant's POS, fintech or enterprise provider involved in the integrated receipt flow.

• Meta/WhatsApp for delivery of WhatsApp communications.

• BuyNxt's authorised hosting, cloud, security, monitoring, support and other service providers/sub-processors.

• Government, regulatory, law-enforcement or judicial authorities where required or permitted by law.

BuyNxt does not sell Green Receipt customer personal data to third parties for their independent advertising purposes.

11. International and Cross-Border Processing

WhatsApp, cloud and other technology services may involve processing in more than one country. Applicable cross-border transfer requirements will be followed by BuyNxt and/or the relevant merchant, including GDPR safeguards where GDPR applies and applicable DPDP restrictions or requirements.

12. Data Retention and Deletion

Retention depends on the information, merchant instructions, purpose of processing and applicable legal or contractual requirements. BuyNxt seeks to minimise retention and delete or anonymise personal data when the applicable purpose and retention requirement end.

Data type Retention approach

Receipt / invoice data For the merchant-agreed operational period and any additional period required by law, contract, dispute or audit requirements.

Message delivery metadata For a limited operational, troubleshooting and audit period.

Green Receipt preference / opt-out records For as long as needed to honour and demonstrate the preference.

Security / audit logs For a defined risk-based security and compliance period.

Backups Removed through controlled backup rotation after the applicable active-data retention period.

13. Security

BuyNxt uses administrative, organisational and technical safeguards designed to protect the confidentiality, integrity and availability of information, including appropriate access controls, authentication, encryption, logging/monitoring, vulnerability management, secure development, backups, incident response and vendor controls.

BuyNxt is implementing an Information Security Management System aligned with ISO/IEC 27001:2022. This does not represent ISO certification unless and until certification has been formally obtained for the relevant scope.

14. Your Privacy Rights

Depending on the law applicable to the processing, you may have rights to obtain information about processing, access personal data, request correction/completion/update, request erasure, withdraw consent, manage communication preferences and raise a grievance. Under DPDP, applicable rights also include nomination. Where GDPR applies, additional rights may include restriction, objection and data portability.

Some rights are subject to legal conditions and exceptions. For example, a merchant may need to retain an invoice or transaction record even after you opt out of optional communications.

15. How to Exercise Your Rights

Use the privacy option available under More Options in the Green Receipt journey, contact the relevant merchant, or contact BuyNxt using the details below. Please provide enough information to identify the merchant/store and relevant receipt/transaction. Identity verification may be required.

If BuyNxt processes the relevant data only on behalf of the merchant, BuyNxt may forward or coordinate your request with the merchant as the relevant Data Fiduciary/Controller.

16. Children

Green Receipt is a transaction/receipt technology and is not designed to profile children. Where a transaction involves a child's personal data, the merchant is responsible for identifying and complying with applicable requirements, including parental consent where legally required.

17. Changes to this Notice

We may update this Notice when our Services, processing practices or applicable laws change. The current version and effective date will be published on the BuyNxt / Green Receipt privacy page.

18. Contact and Grievance

BuyNxt Pvt. Ltd.

513, Kailash Building, KG Marg, Connaught Place, New Delhi - 110001, India

Privacy / Grievance Email: ethics@buynxt.in

Grievance Officer / DPO (if applicable): Prabhat Ummat

For the fastest handling of a receipt-related request, please identify the merchant/store and approximate transaction date. You may also contact the merchant directly because the merchant generally controls the customer relationship and the purpose for which the receipt data was collected.