Privacy Notice

This Notice applies to the personal data of all Users, including individual registered Users, visitors to the Cazper website, and representatives of Enterprise Users, who access or use Cazper.

For the purposes of this Notice, in relation to the processing of Users’ personal data, Mismo shall act as the Data Fiduciary (or other equivalent designation under applicable laws), and the third-parties engaged to process personal data on Mismo’s behalf shall act as Data Processors or Sub-Processors.

Where a User uploads or processes Customer Data through Cazper, that User or the enterprise directing the User to upload or process the Customer Data, acts as the data fiduciary (or other equivalent designation under applicable laws) and Mismo processes such Customer Data in its capacity as a data processor on behalf of that User.

Mismo collects personal data directly from you when you register for, subscribe to, or use Cazper, and automatically through your use of the platform and the Cazper website. The categories of personal data collected are as follows.

Identifiers. We collect information that identifies you or relates to an identifiable natural person, including: full name; email address; telephone and mobile number; postal and billing address; and Internet Protocol (IP) address.

Professional Information. We collect (if applicable) information relating to your professional role and organisation, including: job title and designation; professional role and function; and company or organisation name and industry sector.

Account and Authentication Information. We collect information related to the creation and management of your Cazper account, including: username and, where Single Sign-On (SSO) is not used, account credentials (passwords are stored in hashed, non-reversible form and are not accessible to Mismo in plain text; where SSO is used, authentication is managed by the end-user’s identity provider and no password is stored by Mismo); authentication tokens and session identifiers; and account preferences and configuration settings.

Interaction Data. We collect data arising from your interactions with Cazper and our support services, including: customer support logs, tickets, and correspondence; survey responses and feedback submitted to Mismo; audio recordings and transcripts of support calls or platform interactions, where applicable and where you have been notified of such recording; and query inputs and AI-generated responses within the Cazper platform.

Commercial and Transaction Information. We collect data relating to your commercial relationship with Mismo, including: Subscription plan details and history; purchase history and transaction records; and AI credit usage, balance information, and credit top-up records.

Financial Information. We currently process Subscription payments through manual invoicing. In the event that we integrate a third-party payment gateway in the future, we may collect financial information to the extent necessary to process Subscription payments, including: payment method type (e.g., credit card, debit card, UPI, or other accepted payment method); last four digits of card number (where applicable) and card expiry date; and billing address associated with the payment method.

Full payment card details are processed exclusively by our third-party payment Sub-Processor and are not stored on our systems. As required by Clause 4.2 of the Terms of Use, any automatic billing arrangement will be subject to notification at the time such payment gateway is introduced.

Usage Data. We automatically collect technical information when you access or use Cazper, including: browser type and version; operating system and device type; User ID and session identifiers; IP address and general geolocation inferred therefrom; pages, features, and API endpoints accessed, together with time and duration of access; and clickstream, navigation, and query interaction data within Cazper.

We process your personal data only for specified, explicit, and legitimate purposes and on the legal bases set out against each processing purpose below. Where the legal basis is legitimate interests, we have assessed that its interests are not overridden by your interests, rights, or freedoms, having regard to the nature of the data, the relationship between the parties, and the safeguards applied.

Provision of the Cazper Platform. We process identifiers, account data, and usage data to operate, deliver, and maintain the Cazper platform and its features, including Business Intelligence features and AI-driven query responses. (Legal basis: Contractual Necessity)

Account Management and Authentication. We process identifiers and account data to create, maintain, verify, and secure your User account and to manage access permissions within Cazper. (Legal basis: Contractual Necessity)

Subscription Management and Billing. We process commercial and financial information to administer your Subscription (including Free Trial activation and automatic transition to paid Subscription in accordance with Clause 4 of the Terms of Use), process payments, issue tax invoices, and handle refunds or billing disputes. (Legal basis: Contractual Necessity and Legal Obligation)

Business Intelligence Features. We process usage data, query inputs, and interaction data to provide the Business Intelligence features of Cazper, including AI-driven data analysis, natural language queries, and insight generation. (Legal basis: Contractual Necessity)

AI-Driven Responses via Third-Party AI Providers. Cazper integrates with one or more third-party artificial intelligence or large language model providers (each, an ‘AI Provider’) to generate query responses and insights. To the extent that your query inputs or User Content constitute or contain personal data, such data is transmitted to the relevant AI Provider as a Sub-Processor solely for the purpose of generating AI-driven responses within Cazper. Mismo does not use Customer Data for its own product development, analytics, or marketing, and does not authorise any AI Provider to use such data for training its models or for any purpose beyond providing the contracted service. Details of the AI Providers currently engaged by Mismo, including links to their applicable privacy policies, are set out in Section 4. (Legal basis: Contractual Necessity)

Customer Support. We process identifiers and interaction data (including support logs, correspondence, and, where applicable, call recordings) to respond to queries, troubleshoot issues, and provide technical assistance. (Legal basis: Contractual Necessity and Legitimate Uses)

Platform Analytics and Improvement. We process usage data and interaction data, in aggregated or de-identified form where operationally feasible, to monitor platform performance, diagnose technical issues, and improve the features and functionality of Cazper. (Legal basis: Legitimate Uses)

Security and Fraud Prevention. We process identifiers and usage data to protect the security and integrity of Cazper and its Users, detect and prevent fraudulent, abusive, or unauthorised access, and ensure compliance with the Terms of Use. (Legal basis: Legitimate Uses)

Compliance with Legal Obligations. We process personal data as necessary to comply with applicable laws, regulations, court orders, governmental requests, and other legal obligations, including tax, accounting, and regulatory requirements. (Legal basis: Legal Obligation)

Marketing and Promotional Communications. Subject to your consent (where required by applicable law) or our legitimate interests as an existing service provider, we may process your identifiers and commercial information to send you product updates, newsletters, promotional offers, and other marketing communications relating to Cazper. You may opt out of marketing communications at any time by using the unsubscribe mechanism in our emails or by contacting us at the details in Section 12. (Legal basis: Consent and Legitimate Interests as an existing service provider)

Mismo engages the following Sub-Processors to process personal data on its behalf in connection with the provision of Cazper. Mismo has entered into appropriate data processing agreements with each Sub-Processor and remains responsible for ensuring that Sub-Processors process personal data in accordance with applicable data protection laws.

In addition to the Sub-Processors listed above, Mismo may share personal data with third parties in the following circumstances:

• Legal and Regulatory Requirements. Mismo may disclose personal data if required to do so by applicable law, regulation, court order, governmental authority, or in connection with legal proceedings, or as necessary to protect Mismo’s legal rights or those of third parties.
• Business Transfers. In the event of a merger, acquisition, restructuring, sale of assets, or other corporate transaction, personal data held by Mismo may be transferred to the acquirer or successor entity, subject to protection of such data under terms equivalent to this Notice or as required by applicable law.
• With Your Consent. Mismo may share personal data with third parties not listed above where you have provided your express prior consent.

Mismo does not sell personal data to third parties for monetary consideration. Mismo does not share personal data with third parties for their own independent marketing or advertising purposes, other than as expressly set out in this Notice.

Mismo retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. When determining the appropriate retention period, Mismo considers: the nature and sensitivity of the data; the purposes for which it is processed; potential risks of harm from unauthorised use or disclosure; and applicable legal, regulatory, and contractual obligations.

The following indicative retention periods apply:

• Account and Authentication Data: Retained for the duration of your active Subscription and for a period of 6 (six) months following termination or expiry of your Subscription, or as required by applicable law, whichever is longer.
• Financial and Commercial Data: Retained for a minimum of 6 (six) months from the date of the relevant transaction, in compliance with applicable tax, accounting, and financial reporting obligations.
• Usage Data and Technical Logs: Retained for a period of 6 (six) months from collection, unless longer retention is required for security, fraud prevention, or legal purposes.
• Customer Support Records: Retained for a period of 6 (six) months from the date of closure of the relevant support interaction, unless required for longer retention in connection with an ongoing dispute or legal claim.
• Marketing Communications Data: Retained until you withdraw consent or opt out of marketing communications, or for 6 (six) months following the last interaction, whichever is earlier.

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or otherwise rendered irrecoverable in accordance with Mismo’s data retention and destruction procedures.

Mismo is incorporated in India and operates primarily from New Delhi. Your personal data may be transferred to and processed in countries other than India, including the United States and the countries in which Microsoft Azure data centres are located. These countries may have data protection laws that differ from those of your country of residence.

Transfers from the European Economic Area (EEA) and United Kingdom. Where personal data of Data Subjects located in the EEA or United Kingdom is transferred outside the EEA or UK, Mismo ensures that appropriate safeguards are in place, including: Standard Contractual Clauses (SCCs) approved by the European Commission (for EEA transfers) or the UK International Data Transfer Agreement (IDTA) (for UK transfers), as applicable; adequacy decisions, where the destination country has been recognised as providing an adequate level of data protection; or other approved transfer mechanisms permitted under the GDPR or UK GDPR.

Transfers from India. Cross-border transfers of personal data from India are subject to the DPDP Act and any applicable rules and notifications issued by the Central Government thereunder. Mismo shall transfer personal data to Sub-Processors outside India only in compliance with applicable requirements under the DPDP Act.

You may request further information regarding the safeguards applicable to international transfers of your personal data by contacting Mismo at the details in Section 12.

The following rights are available to you as a user of Cazper:

• Right of Access. You have the right to request confirmation of whether Mismo processes your personal data and, if so, to obtain a copy of that data together with supplementary information regarding the processing activities. Additionally, you have the right to demand details of the processing of your personal data, that include the identities of all Data Processors and other Data Fiduciaries with whom your personal data has been shared; and any other information as may be prescribed by the appropriate authority.
• Right to Rectification. You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data concerning you.
• Right to Erasure. You have the right to request the deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object and there are no overriding legitimate grounds; (d) the data has been unlawfully processed; or (e) erasure is required by applicable law.
• Right to Withdraw Consent. Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Grievance Redressal. You have the right to register a grievance with Mismo regarding the processing of your personal data or the exercise of your rights under applicable law. Mismo shall acknowledge and respond to your grievance within the time period prescribed by applicable law. Grievances may be submitted using the contact details set out in Section 12 of this Notice or to Mismo’s designated Grievance Officer.
• Data Protection Board. If your grievance is not satisfactorily resolved by Mismo, you have the right to file a complaint against a competent authority. If you are a data subject residing in India, then the Data Protection Board shall be the competent authority.

As a data subject residing in: (i) the European Economic Area or the United Kingdom, along with the rights provided above, the GDPR and UK DPA Addendum below shall be applicable; (ii) the state of California, along with the rights provided above, the CCPA Addendum below shall be applicable; (iii) Canada, along with the rights provided above, the PIPEDA Addendum below shall be applicable.

Mismo implements and maintains appropriate technical and organisational security measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. These measures are calibrated to the nature, scope, context, and purposes of processing, and to the risks to the rights and freedoms of Data Principals and Data Subjects. This obligation is consistent with Clause 9.3 of the Terms of Use.

Mismo’s security measures include, without limitation:

• encryption of personal data in transit (using TLS) and at rest using industry-standard protocols;
• role-based access controls and multi-factor authentication for personnel with access to systems processing personal data;
• regular security assessments, penetration testing, and vulnerability management procedures;
• pseudonymisation and anonymisation of personal data where operationally feasible;
• data protection training for Mismo personnel with access to personal data; and
• incident detection, response, and notification procedures for personal data breaches.

Notwithstanding the foregoing, no method of data transmission or storage is entirely secure. In the event of a personal data breach, Mismo will notify affected Users and relevant supervisory authorities in accordance with the timescales and requirements prescribed by applicable law.

The Cazper platform and the Cazper website use cookies and similar tracking technologies (including web beacons, pixels, and local storage) to collect Usage Data, to provide and improve the platform, and to support advertising and analytics activities. A ‘cookie’ is a small data file stored on your device when you access a website.

Mismo uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of Cazper, including authentication, session management, security, and load balancing. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences, language settings, and personalise your experience within Cazper.
• Analytics Cookies: Used to collect information about how Users access and interact with Cazper, including pages visited, session duration, and error reporting, to help Mismo improve performance and user experience.
• Marketing and Advertising Cookies: Used to track browsing activity across websites for the purpose of delivering targeted advertising and retargeting. These are deployed only subject to your prior consent, where required by applicable law.

You may manage your cookie preferences through the cookie consent banner displayed on the Cazper website or the Cazper platform interface. You may also manage cookies through your browser settings; however, please note that disabling certain cookies may impair the availability or functionality of Cazper.

Cazper is not directed at or intended for use by individuals under the age of eighteen (18) years (or such higher age as may be applicable under local law). Mismo does not knowingly collect personal data from minors. If Mismo becomes aware that it has inadvertently collected personal data from an individual under the applicable minimum age, it will take prompt steps to delete such data. If you believe that Mismo has collected personal data from a minor, please contact Mismo at the details in Section 12.

Mismo reserves the right to update or amend this Notice from time to time to reflect changes in applicable law, regulatory guidance, Mismo’s processing activities, or the features of Cazper. The updated Notice will be published on the Cazper website at the Privacy Notice page with the revised ‘Last Updated’ date.

Where a change to this Notice is material, including any change that significantly affects your rights, the categories of data collected, the purposes or legal bases for processing, or the identity of Sub-Processors, Mismo will provide reasonable prior notice to Users through the Cazper platform interface or by email to the address associated with your account.

Your continued access to or use of Cazper following the effective date of a revised Notice will be treated as your acknowledgement of the changes, except where applicable law requires that material changes be subject to your active acceptance, in which case Mismo will seek such acceptance through the platform or by email prior to the revised Notice taking effect. If you do not agree to the revised Notice, you may discontinue your use of Cazper and terminate your Subscription in accordance with the Terms of Use.

For any questions, concerns, requests, or complaints relating to this Notice or to the processing of your personal data by Mismo, please contact Mismo’s Privacy Team or designated Data Protection Officer at:

Mismo Systems Private Limited 2nd Floor, Elegance Building, Mathura Rd, District Centre, Old Jasola Vihar, New Delhi, Delhi 110025, India. Attn: Data Protection Officer / Grievance Officer. Email: mohit.narang@mismosystems.com

Grievance Officer / Data Protection Officer: Gangadhar Gaur, Cofounder — gangadhar.gaur@mismosystems.com