Effective Date: 1st May 2026 | Last Revised: 1st May 2026 | Version 1.0

Welcome to GreLam and its subsidiaries and affiliates (collectively, “GreLam”, “we”, “our”, or “us”). GreLam is incorporated under the laws of India and operates a SaaS-based mobile application platform (the "GreLam Platform" or "Platform") that offers two interconnected categories of services:

• Home and Lifestyle Services – GreLam connects end-users with skilled, vetted independent service professionals/providers for services including but not limited to household task, maintenance, home repairs, cleaning, appliance maintenance, beauty and wellness, pest control, and related services (collectively, "Professional Services"); and
• Smart Queue Management Services – GreLam provides Establishment Partners with a digital queuing infrastructure, enabling Customers to register for, monitor, and receive real-time updates about their queue position at participating Establishments without requiring physical presence until called.

Together, the Professional Services and Queue Services are referred to as the "Services". The Platform is accessible through our mobile application available on Android and iOS platforms as well as through our web interface at www.grelam.com.

This Privacy Policy (“Policy”) sets out how GreLam collects, uses, stores, processes, protects, and discloses personal data when you access or use the Platform or any of the services offered on or through the Platform (collectively, the “Services”). We have drafted this Policy in accordance with the Information Technology Act, 2000 (India) and its associated rules, the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"), and all other applicable data-protection statutes.

The Policy applies to all users of the Platform, including individual consumers, registered members, and visitors. By downloading, installing, or using the Platform in any manner, or by clicking "I Agree" on any registration or consent screen, you acknowledge that you have read and understood this Policy and that you freely, specifically, and informedly consent to the collection and processing of your personal data as described herein.

Please read this Policy carefully. By accessing or using the Platform, you confirm that you have read, understood, and agree to the practices described herein. If you do not agree with this Policy, please do not access or use the Platform. Defined terms not expressly defined in this Policy shall carry the meaning ascribed to them in the GreLam Terms and Conditions available on the Platform (“Terms and conditions”).

1. SCOPE AND APPLICABILITY

(a) This Policy applies to all natural persons who:

• register for or access the Platform as an individual user (“User” or “you”);
• use the Platform to browse, book, or avail Home and Lifestyle Services or Queue & Appointment Management Services;
• interact with customer support, participate in surveys, contests, or promotional campaigns conducted through the Platform; or
• otherwise submit personal data to GreLam in any manner.
• Providers/Professionals who use the Platform to browse, accept, register or avail Home and Lifestyle Services
• Patients, students, vehicle owners, or any member of the public who use the Queue Services at a Partner Establishment (defined below);
• Representatives of organisations ("Partner Establishments") that subscribe to our Queue Services; and
• Visitors to our website or users of our customer support channels.

(b)Partner Establishments - Clinics, hospitals, schools, universities, parking operators, government agencies, retail chains, and other organisations that license our Queue Services are referred to as "Partner Establishments". Where a Partner Establishment deploys the GreLam Platform to manage queues or appointments on its premises, GreLam acts as a data processor on behalf of the Partner Establishment, which remains the data fiduciary for the personal data of its visitors or patients. GreLam may independently act as a data fiduciary for technical, operational, and analytics data generated through the Platform.

(c) GreLam reserves the right to modify this Policy at any time. Where a material change is made, we will notify you through the Platform or via the registered contact information you have provided. Continued use of the Platform following notification of changes constitutes your acceptance of the revised Policy.

(d)Third-Party Links and Integrations - The Platform may contain links to, or integrations with, third-party websites, payment gateways, mapping services, or software applications. GreLam does not own, operate, or control such third-party services and is not responsible for their privacy or security practices. We encourage you to review the privacy policies of any third-party service before sharing personal data with them.

2. PERSONAL DATA WE COLLECT

2.1 Identity and Contact Data

• Full name, username, and profile photograph
• Mobile number and email address
• Residential or billing address and pin code
• Date of birth and gender (where voluntarily provided)

2.2 Service and Transaction Data

• Details of services booked, availed, or cancelled through the Platform
• Service location and preferred time slots
• Queue booking references, appointment confirmation numbers, and check-in status
• Payment transaction identifiers, partial payment instrument details (e.g., last four digits of card), and UPI or wallet handles as provided by authorised payment processors
• Order history and service ratings or reviews submitted by you

2.3 Technical and Device Data

• Device identifiers (Device ID, Advertising ID), device type, operating system, and browser type
• Internet Protocol (IP) address and internet service provider details
• Access timestamps, session duration, page views, and navigation patterns within the Platform
• Push notification tokens for delivering service alerts and queue updates
• Crash logs and performance diagnostics collected for Platform stability

2.4 Location Data

• Precise or approximate geographic location, collected only with your express consent and only when the Platform is in active use, for the purpose of matching you with nearby service professionals or partner establishments
• Location data is not collected when the Platform is running in the background unless you have specifically enabled background location permissions

2.5 Usage and Behavioural Data

• In-app activity, including taps, clicks, feature usage, and search queries
• Queue position monitoring interactions and appointment tracking events
• User preferences, saved addresses, and frequently used services

2.6 Communications Data

• Messages exchanged between you and service professionals or establishment partners through the Platform’s in-app communication features
• Call metadata (where call masking technology is used) for quality assurance and dispute resolution
• Feedback, ratings, reviews, and responses submitted through surveys or support channels

2.7 Aggregated and Anonymised Data

We may generate aggregated or anonymised data derived from personal data for analytics, research, and service improvement. Such aggregated data does not identify any individual and is not considered personal data under applicable law. However, if aggregated data is combined with other data in a manner that directly or indirectly identifies you, it shall be treated as personal data under this Policy.

2.8 Data You Choose Not to Provide

Certain personal data is required to provide you with the Services. If you decline to provide mandatory data, we may be unable to register your account, process a booking, or deliver specific functionality. We will inform you at the point of collection whether a particular data field is mandatory or optional.

3. HOW WE COLLECT PERSONAL DATA

3.1 Data You Provide Directly

You provide personal data to us when you:

• register an account or complete your profile on the Platform;
• search for, book, or manage service appointments or queue slots;
• make payments or request refunds through the Platform;
• submit reviews, ratings, photographs, or other user-generated content;
• participate in promotions, surveys, or loyalty programmes; or
• contact our customer support team or report a complaint.

3.2 Automated Collection

Each time you use the Platform, we automatically collect Technical Data, Location Data (where permitted), and Usage Data through technologies including:

• Session cookies and persistent cookies for authentication and preference retention
• Analytics SDKs for usage tracking and crash reporting
• Server-side logs for security monitoring and performance analysis
• Push notification frameworks for queue and appointment alerts

3.3 Third-Party Sources

We may receive personal data about you from:

• Payment gateways and financial service providers, for transaction validation and fraud prevention
• Social media platforms or single sign-on providers (e.g., Google, Apple) if you choose to authenticate through them
• Partner establishments/Providers enrolled in GreLam’s Queue Management System/Professional Services, who may share appointment-related data with us
• Analytics and advertising technology providers for Platform improvement purposes

4. HOW WE USE YOUR PERSONAL DATA

We use your personal data only for lawful purposes and only to the extent necessary for those purposes. Our purposes for processing your personal data include:

4.1 Account Registration and Identity Verification

• Creating and maintaining your user account
• Verifying your identity through mobile number or email OTP authentication
• Enabling secure login and session management

4.2 Service Delivery

• Matching you with available service professionals based on your service requirements and location
• Processing queue bookings, assigning queue tokens, and providing real-time queue status updates
• Sending appointment confirmations, reminders, and schedule change notifications
• Facilitating communication between you and service professionals or partner establishments through the Platform

4.3 Payments and Transactions

• Processing service payments, issuing invoices, and managing refunds
• Detecting and preventing payment fraud or unauthorised transactions
• Maintaining transactional records in compliance with applicable tax and financial regulations

4.4 Platform Improvement and Personalisation

• Analysing usage patterns to enhance the functionality, reliability, and design of the Platform
• Personalising content, service recommendations, and promotional offers based on your activity and preferences
• Conducting A/B testing and feature experimentation to optimise user experience

4.5 Customer Support and Dispute Resolution

• Responding to queries, complaints, and requests submitted through the Platform or support channels
• Investigating and resolving disputes between users and service professionals or partner establishments
• Maintaining records of support interactions for quality assurance

4.6 Safety, Security, and Legal Compliance

• Monitoring for suspicious, fraudulent, or abusive activity on the Platform
• Enforcing the Terms of Use and this Policy
• Complying with applicable laws, regulations, judicial orders, or lawful requests from government authorities
• Establishing, exercising, or defending legal rights and claims

4.7 Marketing and Communications

• Sending promotional communications, offers, and updates about GreLam Services with your consent
• Administering referral programmes and user loyalty initiatives

You may withdraw your consent to receive marketing communications at any time by using the opt-out mechanism in any such communication or by adjusting your notification preferences within the Platform. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

5. LEGAL BASES FOR PROCESSING

To the extent required by applicable data protection law, we process your personal data on the following legal grounds:

• Contractual Necessity – processing required to fulfil our obligations under the Terms and Conditions or to take steps at your request prior to entering a contract;
• Legitimate Interests – processing for fraud prevention, security monitoring, and Platform improvement, where such interests are not overridden by your rights;
• Legal Obligation – processing necessary to comply with applicable law, regulatory requirements, or court orders; and
• Consent – processing based on your freely given, specific, informed, and unambiguous consent, such as for marketing communications and precise location access.

6. DISCLOSURE OF YOUR PERSONAL DATA

We may share your personal data with the following categories of recipients for the purposes described in this Policy:

6.1 Service Professionals

Where you book a Home and Lifestyle Service, we share relevant identity, contact, and service-location data with the assigned service professional solely to enable fulfilment of the booked service.

6.2 Partner Establishments

Where you book a queue slot or appointment at a GreLam partner establishment (e.g., a clinic, school, or parking facility), we share your name, contact number, booking reference, and queue token with that establishment for the purpose of managing your visit.

6.3 Technology and Service Providers

We engage trusted third-party vendors who process personal data on our behalf, including:

• Cloud hosting and infrastructure providers for secure data storage
• Payment processors and financial technology partners for transaction handling
• SMS, email, and push notification delivery services
• Customer support and helpdesk platform providers
• Analytics and business intelligence tools

All third-party processors are contractually required to implement appropriate technical and organisational security measures and to process personal data only on our documented instructions.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of GreLam’s assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections as described in this Policy. We will notify you of any such transfer through the Platform or by other appropriate means.

6.5 Legal and Regulatory Disclosure

We may disclose personal data where required by applicable law, regulation, or a binding order of a court or competent government authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of GreLam, our users, or the public.

6.6 Professional Advisors

We may share personal data with our lawyers, auditors, accountants, and other professional advisors on a need-to-know basis, subject to confidentiality obligations.

6.7 With Your Consent

We may share your personal data with other parties not listed above where you have given explicit prior consent to such sharing.

7. COOKIES AND TRACKING TECHNOLOGIES

The Platform uses cookies and similar tracking technologies to enable core functionality, improve performance, and support analytics. Cookies are small data files stored on your device.

We use the following categories of cookies:

• Strictly Necessary Cookies – required for the Platform to function and cannot be disabled.
• Performance and Analytics Cookies – used to understand how users interact with the Platform and to identify areas for improvement.
• Functionality Cookies – used to remember your preferences and settings.
• Marketing Cookies – used, with your consent, to deliver relevant promotional content.

You may control cookies through your device or browser settings. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the Platform. You may also opt out of marketing cookies at any time through the Platform's notification preferences screen.

Some third-party tools integrated with the Platform (such as analytics libraries) may set their own cookies or tracking identifiers. GreLam does not control such technologies and encourages you to review the relevant third party's privacy policy.

8. DATA STORAGE AND INTERNATIONAL TRANSFERS

Personal data collected through the Platform is primarily stored on servers located within India. Where data is transferred to or processed in a jurisdiction outside India, we ensure that:

• the recipient jurisdiction provides an adequate level of data protection; or
• appropriate safeguards are in place, such as data processing agreements incorporating standard contractual clauses or equivalent protections recognised under applicable Indian data protection law.

By using the Platform, you acknowledge and consent to the transfer and processing of your personal data as described in this Section.

9. DATA SECURITY

GreLam implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security) protocols
• Encryption of sensitive data at rest
• Role-based access controls and multi-factor authentication for system access
• Regular security assessments, penetration testing, and vulnerability management
• Call and communication masking for privacy during service coordination

You are responsible for maintaining the confidentiality of your account credentials. You should notify us immediately at the contact details provided in Section 15 if you suspect any unauthorised access to your account. GreLam shall not be liable for any loss arising from your failure to safeguard your login credentials.

10. DATA RETENTION

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention principles are:

• Account Data: retained for the duration of your active account and for a further period after account closure as required by law or as necessary to resolve disputes or enforce agreements.
• Transaction and Financial Data: retained for the period mandated by applicable tax, financial, or accounting regulations.
• Support and Communications Data: retained for the period required for dispute resolution and quality assurance.
• Technical and Log Data: retained for defined rolling periods for security and diagnostic purposes.
• Call and communication masking for privacy during service coordination

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised data may be retained indefinitely for research and analytics purposes without further obligation to you.

11. YOUR RIGHTS IN RELATION TO PERSONAL DATA

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of Access – to obtain confirmation of whether we process personal data about you and to receive a copy of such data.
• Right to Correction – to request correction of inaccurate or incomplete personal data.
• Right to Erasure – to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction – to request that we restrict processing of your personal data in certain circumstances.
• Right to Portability – to receive your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Withdraw Consent – to withdraw previously given consent for processing, including for marketing communications or location data collection, without affecting the lawfulness of prior processing.
• Right to Nominate – to nominate another individual to exercise data rights on your behalf in the event of your incapacity or death, in accordance with applicable law.

To exercise any of the above rights, please contact our Grievance and Data Protection Officer as described in Section 15. We will respond to your request within the period prescribed by applicable law.

12. ACCOUNT AND DATA DELETION

You may request deletion of your GreLam account and associated personal data at any time by:

• using the “Delete Account” feature available within the Platform settings; or
• submitting a written request to the contact details provided in Section 15.

Upon receipt of a valid deletion request, we will process it within seven (7) working days. Please note that:

• Deletion of your account will result in permanent loss of access to the Platform and all associated service history.
• Transaction records and financial data will be retained for the periods required under applicable law notwithstanding account deletion.
• Data shared with service professionals or partner establishments prior to deletion cannot be recalled from those parties.

13. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, applications, or embedded services. GreLam does not operate or control such third-party services and is not responsible for their content, terms of use, or privacy practices. We encourage you to review the privacy policy of any third-party service you access through the Platform. The inclusion of a link does not imply endorsement by GreLam.

14. USER-GENERATED CONTENT

The Platform allows you to submit content such as service reviews, ratings, photographs, comments, and feedback (“User Content”). User Content that you post in publicly visible areas of the Platform may be accessible to other users and to the general public. You are solely responsible for the accuracy, legality, and appropriateness of any User Content you submit.By submitting User Content, you grant GreLam a non-exclusive, royalty-free, worldwide licence to use, reproduce, display, and distribute such content for the purpose of operating and promoting the Services. GreLam reserves the right to remove User Content that violates this Policy, the Terms of Use, or applicable law.

15. CHILDREN’S PRIVACY

The Platform is not directed at children under the age of 18 years. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data without verifiable parental or guardian consent, we will take reasonable steps to delete such data promptly. If you believe that we may have inadvertently collected data from a minor, please contact us at the details provided in Section 16.

16. GRIEVANCE OFFICER AND CONTACT DETAILS

In accordance with applicable information technology and data protection laws in India, GreLam has designated a Grievance Officer to address your concerns, complaints or requests relating to this Policy or the processing of your personal data.

Grievance & Data Protection Officer

• Name: GreLam
• Designation: Data Protection Officer, GreLam
• Email: support@grelam.com
• Postal Address: GreLam, Sunland Residency, Rajarhat, Kolkata, India
• Response Time: We will acknowledge your complaint within 72 hours and endeavour to resolve it within 30 (thirty) calendar days of receipt.

For general support queries unrelated to privacy, please use the Help & Support section within the Platform.

17. UPDATES TO THIS POLICY

GreLam may revise this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the “Last Revised” date at the top of this document and, where the changes are material, notify you through the Platform or via the contact information associated with your account. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any revised Policy, you should discontinue use of the Platform and may exercise your right to delete your account as described in Section 12.

18. GOVERNING LAW AND JURISDICTION

This Policy and any disputes arising under or in connection with it shall be governed by and construed in accordance with the laws of India. Any legal proceedings arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the courts located in [Kolkata], India.

19. GLOSSARY

The following definitions apply throughout this Policy:

• "DPDP Act 2023": The Digital Personal Data Protection Act, 2023 (India) and all rules, regulations, and guidelines issued thereunder.
• "Partner Establishment": Any clinic, hospital, school, university, parking facility, government office, retail establishment, or other organisation that has entered into a subscription or licence agreement with GreLam to use the Queue Services.
• "Personal Data": Any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act 2023.
• "Platform": The GreLam mobile application (Android and iOS) and web portal available at www.grelam.com collectively.
• "Professional Services": Home and lifestyle services provided by verified, independent Service Providers facilitated through the Platform.
• "Queue Services": Digital queue management, appointment scheduling, and visitor-flow management services provided to Partner Establishments through the Platform.
• "Service Provider": An independent professional or entity registered on the Platform to offer Professional Services to end users.
• "Services": Professional Services and Queue Services collectively.