1. Your Data

Excellon Software respects your privacy and is committed to upholding your privacy rights. All personal information provided by you and/ or stored by Excellon Software is governed by Excellon Software’s Terms and Conditions and this Privacy Policy. This Privacy Policy also governs the collection, use, retention, disclosure, and security of audit logs, and API logs, associated  with  taxpayer  data  processed  via  our  GST  Suvidha  Provider  .

By using the Excellon Software’s (EXACT Solution) website, or by providing any information to Excellon Software in accordance with the Terms and Conditions or otherwise, you consent to the collection, use and disclosure of your personal information as set out in this Privacy Policy.

For the purposes of this Privacy Policy: (a) “Excellon Software” or “Company” means Excellon Software Private Limited, a company incorporated under the laws of India, including its subsidiaries, affiliates, officers, directors, employees, agents, and successors; (b) “User” or “you” means any individual or entity accessing or using the EXACT Solution platform or services; (c) “Personal Data” has the meaning ascribed to it under the Digital Personal Data Protection Act, 2023 (“DPDPA”) and applicable rules thereunder; (d) “Services” means all software, platforms, APIs, GST Suvidha Provider services, and related offerings provided by Excellon Software. By accessing or using the Services, you irrevocably acknowledge that you have read, understood, and agree to be bound by this Privacy Policy in its entirety.

2. How Personal Information Is Collected

Generally, Excellon Software collects personal information directly from you, such as:

a) When you personally submit information through the Excellon Software (EXACT Solution) website;

b) In the course of providing you with a requested product, service or benefit; or When you have other dealings with Excellon Software.

We also collect system-generated API logs, and audit trails automatically in the course of providing our services. For clarity, audit log means a chronological record of system or application events, access, or transactions; API log means record of API requests/ responses, etc.

Excellon Software may collect information from third parties. If you provide personal information of any third party to Excellon Software, you represent and warrant to us that the third-party consents to their information being provided to us in this manner.

The information that you disclose to us is transferred through a secure socket layer (SSL) into Excellon Software’s cloud server setup. By providing your personal information to Excellon Software, you hereby consent to such transfer.

3. What We Collect

Excellon Software will collect certain personally identifiable information when you communicate with us or register with us to open an Account. This information may include any or all of the following:

• Your e-mail address;
• Your name, address, telephone number and contact details;
• Transaction details relating to your use of Excellon Software products, services or benefits;
• System and service logs (e.g. audit logs, API invocation logs, error logs, metadata) generated during the normal operation of our services.

When you register on the Excellon Software site, you will be asked to provide information required to verify your identity.As you progress through the verification process you will be requested to enter official information from ID documents such as

your passport, driver’s license, medical health insurance card or other document that can identify you and your country of origin/citizenship/residence. Excellon Software assesses this information for its accuracy and authenticity. Once the submitted information is

verified, any personal identification numbers are removed from Excellon Software’s system for your personal security.

Excellon Software also collects personal information from third parties regarding the accuracy and authenticity of your ID documents. Excellon Software may also collect and store certain aggregate information regarding your use of the Excellon Software website and the services available on it, which may include:

a) The pages you access or visit;

b) The frequency of visits;

c) The type and time of transactions;

d) The type of browser and operating system; and

e) Other information volunteered by you (such as through any surveys or site registrations Excellon Software might conduct).

Sensitive information will only be collected as outlined above. Sensitive information will not be collected without your consent unless Excellon Software is required to do so under law.

Although Excellon Software provides the data storage, databases and the Excellon Software website, you retain all rights to your data. Subject to paragraph 7 below, if you cancel or terminate your subscription, reasonable steps will be taken to ensure that all data including photos, documents and personal identification is deleted from Excellon Software systems or

de-identified. Notwithstanding the foregoing, Excellon Software reserves the right to retain data, in whole or in part, for such period as may be required for: (i) compliance with applicable law, regulatory requirements, or court orders; (ii) resolution of pending disputes, claims, or investigations; (iii) enforcement of Excellon Software’s legal rights; or (iv) legitimate business purposes as permitted under applicable data protection law. Retained data shall be subject to the security and confidentiality obligations set forth in this Privacy Policy.

4. Use of Information

Excellon Software uses your personal information to verify your identity. Excellon Software will not use your personal information for any secondary purpose without your consent. You do not have to disclose your personal information, however if you choose not to disclose your personal information it will be impossible for Excellon Software to provide the services you’ve requested.

Excellon Software may use personal information for auditing, research and analysis, in particular, system logs, audit logs, and transaction logs are processed and retained for purposes of compliance, forensic analysis, troubleshooting, internal audits, and regulatory requirements to operate and improve the Excellon Software website. Excellon Software may also use some information collected from you to help diagnose technical problems, administer the Excellon Software site, answer any query by you or improve the quality and types of services delivered to you. By providing Excellon Software with your personal information, you expressly consent to your personal information being used for these purposes. We do not use audit or transactional logs beyond such permitted use without prior consent or legal requirement.

We process personal data only for lawful purposes related to provision of GST Suvidha Provider services, contractual obligations, statutory compliance, and other purposes permitted under applicable data protection laws including the Digital Personal Data Protection Act, 2023.

Excellon Software may use third parties to assist us in processing your personal information. Excellon Software requires that such third parties comply with this Privacy Policy as well as additional confidentiality and security measures as appropriate.

Excellon Software may provide non-identifying and aggregate usage and volume statistical information derived from the actions of its visitors and Account holders to third parties. Personal information collected by Excellon Software is not shared with or sold to other organizations for commercial purposes without your permission.

If Excellon Software is required by law to disclose your personal information, Excellon Software will use reasonable endeavours to notify you before personally identifiable information about you is transferred or disclosed.

Excellon Software expressly disclaims any obligation to notify you of disclosures mandated by a court order, governmental authority, or regulatory body where such notification is legally prohibited or would impede an investigation. Excellon Software shall bear no liability

whatsoever to you or any third party for any disclosure made in good faith compliance with applicable law or the order of a competent authority. You hereby irrevocably waive any right, claim, or cause of action against Excellon Software arising from such compelled disclosures.

5. Sending Data Overseas

Excellon Software will process your personal information in India, as that is where its computer systems are located. If you are subject to a privacy regime outside India, by using the Excellon Software website you consent to the transfer of your personal information to India. Any logs or audit data transferred outside India shall continue to be protected under equivalent security and privacy safeguards and shall comply with applicable data localization or cross-border rules.

Any cross-border transfer of personal data shall be conducted in accordance with applicable law and subject to contractual safeguards ensuring equivalent data protection standards.

6. Cookies

A cookie is a small amount of data, which often includes an anonymous unique identifier that is sent to your browser from a website’s computers and stored on your computer’s hard drive. Cookies are used to identify unique visitors to the Excellon Software website and to provide you with easy access to your files and are required to use the Excellon Software website. If you have your browser set to reject cookies, your access to the services and usage of the Excellon Software website is likely to be interrupted.

Excellon Software may deploy the following categories of cookies: (a) Strictly Necessary Cookies, which are essential for the operation of the platform and cannot be disabled; (b) Performance and Analytics Cookies, which enable Excellon Software to analyse usage patterns and improve service quality; (c) Functional Cookies, which retain your preferences to enhance your user experience; and (d) Third-Party Cookies, which may be set by authorised service providers to facilitate specific functionality. By continuing to use the Excellon Software platform, you expressly consent to the deployment of all categories of cookies described herein. You acknowledge that disabling strictly necessary cookies may render the Services wholly or partly inoperative, and Excellon Software shall bear no liability for any resulting service degradation or loss. Excellon Software reserves the absolute right to modify, add, or discontinue any cookie at any time without prior notice.

7. Security

Excellon Software has implemented processes intended to protect user information and maintain security of data. Each Account holder is assigned a unique username and password with 2-factor authentication, which is required to access GSP service . It is each user’s responsibility to protect the security of his or her login information, however Excellon Software will take steps to ensure that the information held is protected from misuse, interference, loss and unauthorised access, modification or disclosure. These safeguards help prevent unauthorized access, maintain data accuracy, and ensure the appropriate use of data, While we implement robust security controls, no system can be completely secure. We continuously review and enhance our safeguards to mitigate risks.All audit logs, and API logs, are stored in encrypted form (at rest) using industry standard encryption. Access to such logs is restricted to authorized personnel on a strictly need-to-know basis.

In the event of a personal data breach that is likely to result in a risk to the rights of data principals, Excellon Software shall notify the Data Protection Board of India and, where required under applicable law, affected Users within the timeframe prescribed under the DPDPA and rules thereunder. Excellon Software’s liability in respect of any such breach shall be limited as set forth in Section 14 of this Privacy Policy. Notwithstanding the foregoing, Excellon Software shall not be liable for any breach arising from: (a) the User’s failure to maintain the security of their account credentials; (b) any act or omission of a third party beyond Excellon Software’s reasonable control; or (c) force majeure events. You agree to promptly notify Excellon Software upon becoming aware of any unauthorised access to or use of your account and to cooperate fully with Excellon Software’s investigation of any suspected breach.

8. Cancellation or Termination of the Account

Excellon Software will retain your information, API Logs and Audit Logs for a minimum period of 7 years as required for statutory compliance purposes, including GST regulations, in its backup and/or archival copies of its database, before deletion or anonymization, unless otherwise required to be retained longer by law. Excellon Software will make reasonable commercial efforts to delete or de-identify your information as soon as practical.

9. Children

Excellon Software’s services are not available to persons under 18 years of age. As a business service, Excellon Software does not target its offerings toward or knowingly collect any personal information from users under 18 years of age.

10. Accessing and Updating Personal Information

Excellon Software is committed to upholding the accuracy of your information. Excellon Software makes reasonable efforts to provide you with access to your personal information and either to correct this data if it is inaccurate or to delete such data at your request if it is not otherwise required to be retained by law or for legitimate business purposes. If you consider that any of your personal information is or becomes inaccurate, you must update your information. You can do so by logging in to your Account.

Excellon Software reserves the right to decline requests to access, correct or remove information that are unreasonably repetitive or systematic, require disproportionate technical effort, jeopardize the privacy of others, or would be extremely impractical (for instance, requests concerning information residing on a backup drive), or for which access is not otherwise required. However, please note that the audit logs, transactional logs, and system logs are maintained as immutable records for compliance and cannot be edited or deleted by users.

11. Privacy Complaints

Excellon Software is committed to upholding the accuracy of your information and working towards the resolution of any complaints about your privacy or the collection and use of your personal information. If you have an inquiry or complaint regarding this privacy policy or wish to access and update the information Excellon Software has collected from you, please contact us through the web address as mentioned herein: contact us.

12. Amendments to this Privacy Policy

Excellon Software reserves the right to update or amend this Privacy Policy from time to time. The most current version will be located on the Excellon Software website at https://exactgst.com/privacy-policy/ and is also available by contacting Excellon Software directly at the address set out below. Each version of this Policy will be identified at the bottom of the page by its effective date.

Material changes affecting security, log retention, or privacy rights will be communicated in advance (e.g. via email and will take effect 30 (thirty) days after such notice, unless required earlier by regulatory mandate.

13. Intellectual Property and Data Ownership

All intellectual property rights in and to the Excellon Software platform, EXACT Solution, and any derivative works, improvements, or developments thereto, including all software, code, algorithms, databases, interface designs, and documentation, are and shall remain the exclusive property of Excellon Software. Nothing in this Privacy Policy or the Terms and Conditions shall be construed as a transfer or assignment of any intellectual property rights to the User. You acknowledge that all system-generated logs, audit trails, API logs, anonymised or aggregated data derived from your use of the Services (including usage patterns, metadata, and analytics) are and shall be the exclusive property of Excellon Software, and Excellon Software is hereby granted an irrevocable, perpetual, worldwide, royalty-free licence to use such data for any lawful business purpose, subject to applicable data protection law.

14. Intellectual Property and Data Ownership

TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, EXCELLON SOFTWARE, ITS DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, AFFILIATES, AND LICENSORS SHALL NOT BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES WHATSOEVER, INCLUDING BUT NOT LIMITED TO LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS, LOSS OF DATA, LOSS OF GOODWILL, OR ANY OTHER INTANGIBLE LOSS, ARISING OUT OF OR IN CONNECTION WITH THIS PRIVACY POLICY OR THE PROCESSING OF YOUR PERSONAL DATA, EVEN IF EXCELLON SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN ANY EVENT, EXCELLON SOFTWARE’S AGGREGATE CUMULATIVE LIABILITY TO YOU FOR ALL CLAIMS ARISING UNDER OR IN CONNECTION WITH

THIS PRIVACY POLICY SHALL NOT EXCEED THE AMOUNT PAID BY YOU TO EXCELLON SOFTWARE FOR THE SERVICES IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE DATE OF THE CLAIM, OR INR 10,000 (TEN THOUSAND RUPEES), WHICHEVER IS LOWER. THE FOREGOING LIMITATIONS SHALL APPLY NOTWITHSTANDING THE FAILURE OF ANY ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. YOU ACKNOWLEDGE THAT THESE LIMITATIONS REFLECT A REASONABLE AND FAIR ALLOCATION OF RISK AND ARE AN ESSENTIAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN EXCELLON SOFTWARE AND YOU.

15. Indemnification

You shall, at your own expense, indemnify, defend, and hold harmless Excellon Software and its directors, officers, employees, agents, successors, and assigns (collectively, the “Indemnified Parties”) from and against any and all claims, demands, actions, proceedings, losses, liabilities, damages, costs, and expenses (including reasonable legal fees and court costs) arising out of or relating to: (a) your breach or alleged breach of any representation, warranty, obligation, or covenant under this Privacy Policy or the Terms and Conditions; (b) your violation of any applicable law or regulation; (c) the inaccuracy of any information or data provided by you to Excellon Software; (d) any third-party claim arising from the personal information of third parties that you have submitted to Excellon Software without valid consent; or (e) your unauthorised use of the Services. Excellon Software reserves the right, at your expense, to assume the exclusive defence and control of any matter subject to indemnification by you, and you agree to cooperate with Excellon Software’s defence of such claims. You shall not settle any such claim without the prior written consent of Excellon Software.

16. Governing Law and Dispute Resolution

This Privacy Policy shall be governed by and construed in all respects in accordance with the laws of India, without regard to its conflict of law principles. The parties irrevocably submit to the exclusive jurisdiction of the courts at Pune, Maharashtra, India for the resolution of any dispute, claim, or controversy arising out of or in connection with this Privacy Policy. Notwithstanding the foregoing, Excellon Software reserves the right to seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or confidential information. Any dispute that cannot be resolved amicably within thirty (30) days of written notice shall be referred to binding arbitration under the Arbitration and Conciliation Act, 1996, as amended, before a sole arbitrator appointed by Excellon Software. The seat of arbitration shall be Pune, Maharashtra; the language shall be English; and the award shall be final and binding on both parties. The foregoing arbitration clause shall not preclude Excellon Software from obtaining interim or conservatory relief from any competent court.

17. Severability, Waiver, and Entire Agreement

If any provision of this Privacy Policy is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it enforceable, or severed from this Privacy Policy, and the remaining provisions shall continue in full force and effect. The failure of Excellon Software to enforce any right or provision of this Privacy Policy shall not constitute a waiver of such right or provision. No waiver by Excellon Software of any breach shall be deemed a waiver of any subsequent breach. This Privacy Policy, together with the Terms and Conditions and any other policies incorporated herein by reference, constitutes the entire agreement between you and Excellon Software with respect to the subject matter hereof and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties with respect to such subject matter.

18. Questions

Any further questions about this Privacy Policy should be addressed to info@excellonsoft.com