PRIVACY POLICY

Effective date: 24 September 2025; Updated as of: 24 September 2025

1. Who we are

If designated as a Significant Data Fiduciary by the Government of India, we will comply with additional obligations including appointing a Data Protection Officer (DPO), conducting Data Protection Impact Assessments (DPIAs), and independent audits.

2. Scope and applicability

This policy explains how we process personal data for our venture program/contest designed to identify suitable co-founders to form teams for new companies (the “Program”).

It applies to applicants, participants, mentors, evaluators, referees, and visitors to our websites and application portals.

3. Categories of personal data we process

• Identity and contact: name, email, phone, city, country, age declaration (18+), nationality.
• Professional: résumé/CV, LinkedIn/GitHub, education, employment history, skills, references.
• Program materials: forms, pitch decks, problem statements, assessments, interview notes, matching preferences, cohort feedback, recordings (with notice).
• KYC/compliance (if shortlisted or funded): PAN or tax IDs, address proofs, bank details (limited), sanction screening results.
• Usage/technical: device, browser, IP, timestamps, cookies/SDK events for portal performance and security.
• Referee/mentor data: names and contact details provided by you (you confirm you have authority to share).

We do not intentionally collect special categories (health, biometrics) for the Program.

If such data appears in submissions, we will delete or redact it unless strictly necessary and lawful under applicable law.

4. Why we process your data (purposes) and our legal basis

Purposes:

• Program operations: application intake, eligibility checks, scheduling, interviews, assessments, cohort communications.
• Cofounder matching: evaluating complementary skills, preferences, and compatibility; generating shortlists and introductions.
• Selection and awards: scoring, due diligence (basic KYC/sanctions), result notifications, grant/award administration.
• Mentorship and community: connecting with mentors, experts, and partner networks; event management.
• Improvement and analytics: surveys, performance metrics, anonymized statistics, fraud prevention, security monitoring.
• Legal and compliance: responding to lawful requests, record-keeping, enforcement of Program Terms.

Legal grounds under the Digital Personal Data Protection Act, 2023 (DPDP Act):

• Consent: obtained via clear, specific notice at signup/submission; granular where appropriate (e.g., recordings, marketing).
• Deemed consent/legitimate program operation: for purposes reasonably expected by participants, such as evaluating submissions, scheduling, and security.
• Legal obligations: e.g., responding to government requests, financial record retention.

We do not use your data for unrelated purposes without fresh consent or another lawful ground.

5. How we obtain data

• Directly from you during registration, forms, interviews, emails, or events.
• Automatically via our portals (cookies/SDKs) for security and performance.
• From referees or third parties you nominate, and from service providers that support identity, security, or scheduling, only as permitted by applicable law and this policy.

6. Sharing and disclosures

We may share certain data with:

• Service providers/processors: application portals, cloud hosting, email/communications, calendar/scheduling, video interview tools, background/sanctions screening. Bound by contracts and confidentiality; they act only on our instructions.
• Mentors, evaluators, and partners: to assess applications and enable cofounder matching and mentorship, limited to what is necessary and with access controls.
• Affiliates: for Program administration and transition to incubation/investment, where relevant.
• Authorities and regulators: when required by applicable law or lawful process.
• Transactions: if we reorganize our venture operations, your data may transfer with appropriate safeguards under applicable law.

We do not sell personal data.

7. Crossborder transfers

We may store or process data in or outside India using reputable providers.

Transfers will comply with the DPDP Act, including any Government-notified restrictions on specific jurisdictions.

We use contractual and technical safeguards (e.g., encryption, access controls).

8. Data retention

We retain personal data:

• For applicants not selected: up to 24 months to consider you for future cohorts (if you consent) or 6 months if you do not.
• For participants, winners and awardees: for the Program duration and up to 7 years thereafter for legal, audit, and grant/investment records.
• Analytics logs/cookies: up to 24 months depending on necessity.

We delete or anonymize data when no longer needed, subject to applicable law to which we are subject.

9. Security safeguards

We implement appropriate technical and organizational measures, including encryption in transit and at rest, rolebased access control, MFA, network security, secure software development practices, vendor due diligence, and employee confidentiality obligations.

We review controls periodically and train staff on data protection.

10. Your rights (Data Principal rights)

Subject to the DPDP Act, you are entitled to the following:

• Access: confirm whether we process your data and obtain a summary.
• Correction and update: correct, complete, or update inaccurate data.
• Erasure: request deletion when data is no longer necessary or consent is withdrawn.
• Consent withdrawal: withdraw consent for one or more purposes at any time; we will cease processing for those purposes.
• Grievance redressal: contact our Grievance Officer; if unresolved, you may complain to the Data Protection Board of India.
• Nomination: nominate an individual to exercise your rights in the event of death or incapacity.

How to exercise: email support@thefoundery.in. We aim to respond within 15 days, or a legally prescribed timeline if specified.

11. Children and minors

The Program is for individuals aged 18+. We do not knowingly process children’s data.

If you believe a minor has submitted data, contact us to remove it.

If we ever run a youth track, we will obtain verifiable parental consent and implement heightened safeguards.

12. Marketing communications

We will send Program updates and community invitations. You can opt out at any time via unsubscribe links or by contacting us.

Opt-out will not affect essential Program communications.

13. Automated decisionmaking

We may use scoring tools to assist with screening and matching. Final decisions involve human review.

You may request human reconsideration of a significant adverse decision affecting you.

14. Cookies and similar technologies

We use only those cookies/SDKs necessary for security, load balancing, analytics, and session management.

Where required, we will display a cookie notice and obtain consent.

You can adjust preferences via your browser or our cookie banner.

15. How to contact us

16. Changes to this policy

We may update this policy to reflect changes in applicable law or Program operations.

We will post the updated version with a new Effective Date and, where material, provide prominent notice or seek consent where required.