Privacy Notice & Data Handling Framework

LETSCOOKTECH ("we", "us", "our") is committed to responsible data stewardship, privacy by design, and complete transparency in how personal and operational information is collected, processed, and safeguarded.

Document ID: LCT-PRIV-001 Status: ACTIVE Version: 3.0 Classification: PUBLIC PRIVACY POLICY / DATA GOVERNANCE FRAMEWORK

This Privacy Notice applies to all personal data collected through our public websites, client communication channels, technical discovery workshops, staging sandboxes, and conversational assistants (including the Ely AI Assistant). Our data handling practices are engineered to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act, India) and the General Data Protection Regulation (GDPR, EU).

We collect information across three distinct operational categories:

• Directly Provided Information: Names, business email addresses, telephone numbers, organizational names, project requirements, and communication history submitted via our contact forms, fit review forms, or onboarding questionnaires. • Technical & Telemetry Data: IP addresses, browser types, operating systems, referring URLs, access timestamps, and anonymized interaction telemetry collected automatically when accessing our website and client documentation. • Project & Authentication Data: Client developer IDs, repository usernames, staging access logs, and administrative credentials required to provision staging environments and execute technical handovers.

We process personal data strictly under lawful legal grounds:

• Contract Performance: Processing requirements data, client communications, and credentials necessary to draft proposals, execute Statements of Work, build digital systems, and deliver client handovers. • Legitimate Business Interests: Analyzing platform performance, defending against malicious DDoS attacks, maintaining infrastructure security, and improving technical documentation clarity. • Legal & Statutory Compliance: Retaining financial records, invoices, and contracts to satisfy statutory tax, accounting, and corporate governance requirements. • Consent: Processing inquiries and newsletter subscriptions where explicit affirmative consent was provided by the user.

When LETSCOOKTECH builds, migrates, or tests systems handling client customer data, LETSCOOKTECH acts strictly as a Data Processor on behalf of the client (the Data Fiduciary / Controller):

• Strict Data Segregation: Client datasets are isolated in dedicated database instances or logically partitioned schemas. • Synthetic Staging Data: We enforce the use of synthetic, mocked, or sanitized data in non-production environments. Real production personal data is never copied into local developer sandboxes without written authorization and cryptographic masking. • No Secondary Exploitation: We do not sell, rent, monetize, or harvest client data for advertising or unauthorized analytical profiling. • AI Confidentiality Guarantee: Any AI models utilized in client solutions are configured with zero data retention and explicit opt-outs from provider model training.

Personal data is retained only for as long as necessary to fulfill the purpose for which it was gathered:

• General Inquiries & Unqualified Leads: Retained for 180 days from initial contact, then permanently purged from CRM systems. • Active Project Data & Staging Logs: Maintained for the duration of the project lifecycle plus 30 days following warranty completion to facilitate support transitions, after which staging environments and temporary access tokens are destroyed. • Contractual & Financial Records: Tax invoices, SOW agreements, and payment records are retained for statutory periods (typically 7–8 years) to comply with corporate tax laws. • Immediate Erasure: Upon written client request, all non-statutory project data, development backups, and staging records are purged within 14 business days.

To deliver our digital solutions, LETSCOOKTECH partners with enterprise infrastructure providers that maintain stringent security certifications (SOC 2 Type II, ISO/IEC 27001):

• Cloud Hosting & Edge Compute: Vercel Inc. (Global edge hosting), Amazon Web Services (AWS) (Cloud infrastructure) • Database & Authentication: Supabase Inc. (PostgreSQL database & auth), MongoDB Atlas (Document data stores) • Transactional Communications: Resend Inc. / SendGrid (Transactional emails), Twilio (SMS alerts) • Payment Processing: Razorpay Software Pvt. Ltd., Stripe Inc. (PCI-DSS Level 1 certified payment processing) • Analytics: Privacy-preserving analytics (Plausible / PostHog) configured without cross-site tracking cookies.

We implement defense-in-depth security measures to protect personal data:

• Cryptographic Encryption: Data in transit is encrypted using TLS 1.3 with modern cipher suites. Data at rest is encrypted using AES-256. • Access Control: Role-based access controls (RBAC) restrict staff access to personal data strictly on a need-to-know basis. • Multi-Factor Authentication: Mandatory hardware or TOTP MFA across all internal corporate accounts and cloud administration dashboards. • Breach Notification Protocol: In the unlikely event of a security breach affecting personal data, LETSCOOKTECH will notify affected clients and relevant supervisory authorities within 72 hours of becoming aware of the incident, in accordance with applicable statutory mandates.

Under the DPDP Act 2023 and GDPR, individuals possess fundamental privacy rights:

• Right to Access: Request a summary of personal data held about you and the processing activities undertaken. • Right to Correction & Updating: Request the immediate correction of inaccurate, outdated, or incomplete personal data. • Right to Erasure ('Right to be Forgotten'): Request the permanent deletion of personal data where retention is no longer legally required. • Right to Withdraw Consent: Revoke previously granted consent for marketing or non-essential communications at any time.

Grievance Officer & Official Inquiries: To exercise any privacy right or submit a formal data governance inquiry, please contact our designated Data Protection & Grievance Officer:

Entity: LETSCOOKTECH Attn: Privacy & Data Governance Officer Email: letscooktech@gmail.com Response SLA: Within 7 business days