MSAService TermsPrivacy PolicyLogin

Privacy and Data Protection Policy

Version 1.6.6Effective: 7 October 2026

1. Purpose, Scope, and Compliance

This Privacy and Data Protection Policy ("Policy") sets out how ImpactPlus Ventures LLP ("ImpactPlus", "Service Provider", "we", "us", or "our") collects, uses, stores, and protects personal data through GrowthMind, our AI-powered platform for business productivity and optimization.

MarketingSense is a product on the GrowthMind platform, operated by ImpactPlus Ventures LLP.

GrowthMind is the product platform operated by ImpactPlus Ventures LLP, a limited liability partnership incorporated under the Limited Liability Partnership Act, 2008, having its registered office at 1009 D, Titanium City Centre, 100 Feet Ring Road, Satellite, Ahmedabad, 380015, Gujarat, India.

This Policy applies to all personal data processed through the Platform and its Product Offerings, whether relating to Account Administrators, Authorized Users, or any individuals whose data may be contained in uploaded content. The Policy is designed to comply with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the DPDP Rules 2025, the Information Technology Act, 2000 (together with relevant rules), the CERT-In Cybersecurity Directions 2022, the Bharatiya Sakshya Adhiniyam 2023, and the Limitation Act 1963, as well as globally accepted privacy principles.

All ImpactPlus staff and any third parties handling personal data on our behalf are required to adhere to this Policy. This Policy should be read in conjunction with the Master Services Agreement and applicable Product Schedules, which govern your use of the Platform.

2. Definitions

In this Policy, unless the context otherwise requires:

"Account Administrator" means the individual who completes the subscription purchase and serves as the primary contact and administrator for your Organization's Platform account, with authority to add users and manage subscriptions.

"AI Output" means any report, analysis, recommendation, insight, or other result generated by the Platform's AI modules.

"Authorized User" means any individual within your Organization who is authorized by the Account Administrator to access the Platform under your subscription, verified through organizational email domain.

"User Content" means any documents, files, data, media, or other materials uploaded to or created within the Platform for processing, including but not limited to business documents, marketing materials, presentations, reports, and other professional content.

"Confidential Information" means all non-public, proprietary information including: (a) for you, your uploaded User Content, business strategies, product information, and AI Outputs; (b) for us, the Platform's AI algorithms, knowledge bases, scoring methodologies, and system architecture.

"Expert Assessment Units" or "EAUs" means the units of usage purchased under your subscription plan that are consumed when User Content is processed through the Platform.

"Organization" means the company or legal entity on whose behalf you are accepting the Terms and using the Platform.

"Platform" means the GrowthMind web application through which ImpactPlus delivers its Product Offerings, including AI modules and associated features.

"Product Offerings" means the various services available through the Platform, as described in the applicable Product Schedules.

"Knowledge Base" means the Platform's curated databases of industry regulations, best practices, standards, and explicit knowledge prevailing in the industry, relevant to the applicable Product Offerings.

3. Data Protection Principles

ImpactPlus handles personal data in accordance with core data protection principles: We process data lawfully, fairly, and transparently; we collect data only for specific, explicit and legitimate purposes and refrain from using it in ways incompatible with those purposes; we collect only as much personal data as is adequate and relevant for the intended purpose (data minimization); we take reasonable steps to ensure personal data remains accurate and up-to-date; we do not retain personal data longer than necessary for the purposes stated (storage limitation), subject to retention obligations imposed by applicable law; we secure personal data with appropriate safeguards to prevent unauthorized access or breaches; and as the data fiduciary (data controller), ImpactPlus remains accountable for all personal data processing under its control.

4. Collection of Personal Data

ImpactPlus collects personal data only by lawful and fair means and only to the extent necessary for its operational and business purposes. The types of personal data we collect through the Platform may include:

Account Information: Name, organizational email address, phone number, company name, job title, and professional credentials of Account Administrators and Authorized Users;

Payment Information: Billing details processed through Razorpay (we do not store complete payment card details);

Uploaded User Content: Documents and materials submitted for assessment, which may incidentally contain personal data of third parties;

Usage Data: Platform interaction data including login activity, assessment history, EAU consumption, and feature utilization;

Technical Data: IP addresses, browser type, device information, and session data.

The Platform is not intended for processing patient-identifiable clinical data, individual health records, or personal data of minors. Users should not upload User Content containing such data unless explicitly permitted under the applicable Product Schedule.

5. Use of Personal Data

Personal data collected through the Platform will be used solely for the purposes communicated at the time of collection or for closely related purposes. Such purposes include:

  • Providing Platform services and generating AI Outputs;
  • Managing subscriptions, processing payments through Razorpay, and issuing GST-compliant invoices;
  • Authenticating Account Administrators and Authorized Users through organizational email domain verification;
  • Communicating service updates, renewal reminders (7 days before renewal), Platform notifications, and service-related informational communications as set out in Section 7.4;
  • Monitoring Platform usage for security, compliance, and audit purposes;
  • Protection of ImpactPlus's legal rights or the rights and safety of others;
  • Compliance with legal obligations and responding to lawful requests from authorities.

We will not use personal data for any new purpose that is incompatible with the original purposes unless we obtain fresh consent or have an alternative lawful basis recognized under applicable law.

For the avoidance of doubt, and as a negative limit on the uses described above, ImpactPlus does not use your User Content or other client data to train, fine-tune, or improve any artificial intelligence model, whether ours or that of any third-party service provider. This commitment is stated more fully in Section 7.1 (Aggregated Anonymised Industry Benchmarks) and Section 15.1 (Use of Data for AI Processing).

6. Lawful Bases for Processing and Consent

ImpactPlus ensures that all processing of personal data is justified by a lawful basis. Our primary bases for processing include:

(a) Consent: Where required, obtained through clear affirmative action during account creation and subscription, which will be free, specific, informed, and unambiguous;

(b) Contract Performance: Processing necessary to provide Platform services under the Master Services Agreement and applicable Product Schedules;

(c) Legal Compliance: Processing required under applicable laws including the DPDP Act, DPDP Rules 2025, IT Act, CERT-In Directions, and tax regulations;

(d) Emergency: Processing necessary for an emergency involving an individual's life or safety;

(e) Specified Purpose: Processing for the specified purpose for which the Data Principal has voluntarily provided personal data, recognised under Section 7(a) of the DPDP Act 2023;

(f) Legitimate Uses: Other lawful bases recognized under Section 7 of the DPDP Act, including processing necessary to fulfil an obligation under any law to disclose information to the State or its instrumentalities under Section 7(d).

Users have the right to withdraw consent at any time. Withdrawal requests can be submitted through account settings or by contacting our Grievance Officer. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal. Whenever we process data without consent, we will ensure that such processing is permitted by law and will inform individuals as required.

7. Consent for Specific Processing Activities

IMPORTANT: Under the Digital Personal Data Protection Act, 2023, we require your explicit consent for the following specific processing activities:

7.1 Aggregated Anonymised Industry Benchmarks

ImpactPlus does not use your User Content or other client data to train, fine-tune, or improve any AI model, whether ours or third-party. ImpactPlus may, with your consent, use genuinely anonymised and aggregated insights derived from Platform usage across a minimum of five (5) Organizations to develop industry benchmarks. This processing:

  • Uses only irreversibly anonymised data, aggregated across multiple Organizations, that cannot identify you or your Organization;
  • Does not include your confidential business information;
  • Is used solely to develop pharmaceutical industry benchmarks for the benefit of all users.

By accepting this Privacy Policy, you consent to the development of anonymised aggregated industry benchmarks on the terms set out above. You may withdraw this consent at any time through your account settings.

7.2 Third-Party AI Service Providers

The Platform incorporates third-party AI models and services to deliver our Product Offerings. These services include:

  • Large language models for content analysis and generation
  • Cloud-hosted AI inference services
  • AI services for specific analytical functions, including document embeddings and specialised processing

All third-party AI service providers used by ImpactPlus operate under enterprise API terms that contractually prohibit the use of your data for model training, fine-tuning, or improvement of any AI model. ImpactPlus maintains a current list of material third-party AI service providers and will disclose this list to Account Administrators upon reasonable written request, subject to customary confidentiality obligations. Where a change in our use of third-party AI providers materially alters how your personal data is processed, it will be treated as a material amendment under Section 22(b); the routine replacement or addition of a provider on equivalent enterprise terms that prohibit training on customer data is treated as a non-material amendment under Section 22(a). By using the Platform, you acknowledge and consent to your User Content being processed by these third-party AI service providers under these enterprise terms.

7.3 Marketing Communications (Optional)

With your separate opt-in consent, we may send you:

  • Product updates and new feature announcements
  • Industry insights and best practices
  • Promotional offers and newsletters

Marketing communications consent is optional and does not affect your ability to use the Platform. You may opt-out at any time through account settings or by clicking unsubscribe in any marketing email.

7.4 Service-Related Informational Communications

As part of the Service, we send Authorized Users periodic informational communications containing useful tips and insights relevant to pharmaceutical promotional collateral review and related workflows. These communications are part of the Service you have subscribed to and are distinct from the marketing communications described in Section 7.3.

Service-related informational communications:

(a) Are sent to Authorized Users on a defined schedule, currently twice per week (Monday and Thursday).

(b) Contain pharma-industry tips and insights, structured prompts for collateral review, and platform-level patterns. They do not contain marketing content, promotional offers, or third-party advertising.

(c) Do not require separate opt-in consent because they form part of the Service. Your acceptance of this Privacy Policy at subscription includes acceptance of these communications.

(d) Include a one-click unsubscribe link in every email. Opting out of these communications does not affect your access to the Service in any way. Transactional communications (account, billing, security, service-critical updates) are unaffected by this preference and continue regardless of your informational-communications setting.

(e) Are sent using your registered email address only. No additional personal data is processed for the purpose of these communications.

The lawful basis for these communications is specified purpose under Section 7(a) of the Digital Personal Data Protection Act 2023, since you have voluntarily provided your email address as part of your subscription to the Service and these communications form part of the Service you have subscribed to.

You may manage your preference for service-related informational communications at any time through your account settings or by clicking unsubscribe in any such email.

8. Cookies and Tracking Technologies

8.1 Use of Cookies

The Platform utilizes cookies and similar tracking technologies such as web beacons, pixels, session identifiers, and analytics tools to enhance user experience, facilitate Platform functionality, and analyze usage patterns. These technologies are used to authenticate sessions, manage secure access, analyze user navigation patterns, optimize AI-driven processing, and gather metrics to improve Platform performance.

8.2 Types of Cookies

Essential Cookies: Required for core Platform operations such as login authentication and session management;

Analytical/Performance Cookies: Collect data to help us understand how users interact with the Platform;

Functional Cookies: Store user preferences and settings;

AI Interaction Logs: Store pseudonymised interaction data to support Platform debugging and security monitoring.

8.3 Third-Party Analytics

We use Google Analytics and Microsoft Clarity on our public website pages to understand how visitors use them. They load only after you accept analytics cookies, and they never run inside the logged-in Platform. Such third parties may use their own tracking mechanisms governed by their respective privacy policies. Users are encouraged to review those policies directly.

8.4 Consent and Controls

By default, only Essential Cookies are enabled upon first access. Use of non-essential cookies is subject to explicit opt-in consent via cookie banner or settings module. Users can manage cookie preferences through the Platform interface at any time. Where required under the DPDP Act, we retain evidence of cookie consents as audit logs.

9. Disclosure of Personal Data to Third Parties

ImpactPlus will not disclose or share personal data with any third party except as permitted by this Policy and applicable law. Third-party disclosures may occur under these circumstances:

(a) Payment Processors: Razorpay processes payment transactions under their own privacy policy and PCI-DSS compliance;

(b) Service Providers: Cloud hosting, analytics, and technology vendors who process data on our behalf under strict confidentiality agreements;

(c) Third-Party AI Services: The Platform incorporates third-party AI models and services; where we use such services, we ensure appropriate licensing, compliance, and data protection agreements;

(d) Legal Requirements: Where required by law or pursuant to an order of a competent authority or court (we will only share what is legally necessary);

(e) Government/Law Enforcement: In response to lawful requests from government or law enforcement agencies, only upon receipt of valid legal process or mandate, and where permissible, we shall notify you prior to disclosure;

(f) Corporate Transactions: In connection with a merger, acquisition, or asset sale, with the receiving party bound to honor these data protection standards.

We will never sell personal data to third parties for their own marketing or independent use.

10. Third-Party Processors and Sub-Processors

Whenever ImpactPlus engages a third-party service provider to process personal data on our behalf (as a "data processor" or sub-processor), we will conduct due diligence to ensure that the vendor is capable of maintaining the security and privacy of the data to the standards required by law and this Policy.

ImpactPlus will enter into a binding contract or data processing agreement with each such third party, mandating (at a minimum) that the service provider:

  • Processes personal data only on ImpactPlus's documented instructions and for the purposes we specify;
  • Uses appropriate technical and organizational security measures to safeguard the data;
  • Ensures that persons accessing the data are bound by confidentiality;
  • Does not further disclose or subcontract the data to other parties without authorization;
  • Assists ImpactPlus in meeting our compliance obligations (including enabling audits and helping address data subjects' rights and breach response).

ImpactPlus remains responsible and liable for the protection of personal data even when it is processed by our vendors. We will monitor and enforce our vendors' compliance. If any vendor or sub-processor fails to comply with required standards, ImpactPlus will take prompt remedial action, including the possibility of suspension or termination of the service relationship. A list of material third-party sub-processors may be provided upon reasonable request.

Third-Party Platform Integrations

The Platform may offer integrations or interoperability with external services, including but not limited to Google, Microsoft, Zoom, LinkedIn, or similar platforms. ImpactPlus is not responsible for the data processing practices, privacy controls, or terms of use of such third-party platforms. Users are encouraged to review the respective privacy policies and terms of any external service they choose to connect with or access through the Platform. Any data shared with such third-party platforms shall be governed by their respective terms and not by this Policy.

11. Monitoring and Platform Usage

ImpactPlus monitors the following on the lawful bases of contract performance (necessary to provide Platform services), legitimate use under Section 7 of the DPDP Act 2023, and compliance with applicable law:

  • Platform usage patterns, login activity, and feature utilization;
  • EAU consumption and processing activity;
  • Content inputs (for security and compliance purposes only);
  • System events for security, compliance, performance, and billing accuracy.

This monitoring is conducted to ensure Platform security, maintain service quality, accurately bill for usage, verify compliance with our Terms of Service, and fulfil our legal and regulatory obligations. Such monitoring does not require separate consent and is integral to the provision of the Platform services.

12. Data Security Measures

ImpactPlus implements and maintains appropriate technical and organizational security measures to protect personal data, including:

  • Encryption of personal data in transit (TLS 1.3 preferred, TLS 1.2 minimum) and at rest (AES-256 via AWS Key Management Service);
  • AWS KMS field-level encryption for sensitive organisation columns at the database layer;
  • Access control mechanisms with organizational email domain verification for Authorized Users;
  • Password requirements (minimum 12 characters with alphanumeric and symbol requirements);
  • Firewalls, intrusion detection systems, and monitoring;
  • Periodic security assessments and audits;
  • Multi-tenant security controls ensuring client data isolation through PostgreSQL Row-Level Security;
  • Secure development practices and regular security testing.

While we implement commercially reasonable security measures, no system is completely secure, and we cannot guarantee absolute security against all threats.

13. Data Retention and Deletion

ImpactPlus retains personal data and associated records in accordance with a four-tier retention framework, designed to balance the principle of data minimisation under the Digital Personal Data Protection Act 2023 with statutory retention obligations under Indian law.

Tier 1, Operational data. Account data, usage data, uploaded User Content, AI Outputs, and other operational records associated with your subscription are retained throughout your active subscription. Upon termination, expiry, or account deactivation, you have 30 days of read-only access to export this data. After 30 days, this data is permanently deleted, save for aggregated anonymised insights retained under our Terms of Service.

Tier 2, Processing logs. Pseudonymised AI trace logs, API call records, and ICT system logs are retained for a minimum of one year from the date of processing, in voluntary alignment with anticipated DPDP regulatory standards under the DPDP Rules 2025, and for 180 days under the CERT-In Cybersecurity Directions 2022. Processing logs may contain metadata that can be linked to a specific user or Organization through internal identifiers, and are therefore treated as pseudonymised personal data under the DPDP Act. The lawful basis for retention is contract performance (necessary to provide the Platform services and to fulfil our security and audit obligations) and legitimate use under Section 7 of the DPDP Act 2023.

Tier 3, Consent and acceptance records. The audit trail of your acceptance of our Privacy Policy, Master Services Agreement, and applicable Product Schedule is retained for seven years from the date of your last consent action. The basis for this retention period is the admissibility framework for electronic records under Section 61 of the Bharatiya Sakshya Adhiniyam 2023, read together with the limitation periods applicable to potential claims under the Limitation Act 1963.

Tier 4, Financial and payment records. Invoices, GST records, and payment transaction logs are retained for an operational standard period of eight (8) years, in compliance with the Goods and Services Tax Act 2017, the Income-tax Act 2025 (with transitional savings under Section 536 of that Act for tax years before 1 April 2026), and the Companies Act 2013.

Retention under Tiers 2, 3, and 4 is permitted under Section 8(7) of the Digital Personal Data Protection Act 2023, which expressly preserves retention required for compliance with any law for the time being in force, and is supported by the specified purpose basis under Section 7(a) of that Act for processing personal data that you have voluntarily provided, and by Section 7(d) where retention is required to fulfil an obligation under any law to disclose information to the State or its instrumentalities. Such retention does not require fresh consent from you.

Failed Payment Grace Period: A 7-day grace period with read-only access for data export is provided, followed by account suspension.

Failed Payment Accounts: Operational data is scheduled for deletion 30 days after account deactivation due to unsuccessful payment, in accordance with Tier 1 above. Other categories of data continue to be retained in accordance with the applicable tier.

Upon request, we will delete personal data in accordance with your rights under the Digital Personal Data Protection Act 2023, subject to any overriding legal obligations requiring continued retention as set out in Section 14(c) below.

14. Data Subject Rights

Under this Policy and in accordance with applicable law, users have the following rights regarding their personal data:

(a) Right to Access: Request confirmation of whether we are processing your personal data and obtain access to such data, along with information about how we use and share it;

(b) Right to Correction: Have inaccurate or outdated personal data corrected or updated, and incomplete data completed, through account settings or by contacting us;

(c) Right to Erasure: Request deletion of your personal data when it is no longer necessary, you withdraw consent, or processing is unlawful, subject to the retention framework set out in Section 13 and any overriding legal obligations. For the avoidance of doubt, the right to erasure is subject to the exceptions recognised under Section 12 of the Digital Personal Data Protection Act 2023 (read with Section 8(7) thereof), including retention required for compliance with any law for the time being in force and retention required for the establishment, exercise, or defence of legal claims;

(d) Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent;

(e) Right to Grievance Redressal: Lodge complaints with us and expect a timely response, and if unsatisfied, escalate to the Data Protection Board of India;

(f) Right to Data Portability: Request a copy of personal data you provided to us in a structured, commonly used, machine-readable format, or ask us to transfer it to another service provider when technically feasible. Personal data will be provided in the following formats: structured account, billing, and usage data in JSON or CSV; Assessment Reports and AI Outputs in PDF; and any documents originally uploaded by you in their original uploaded format;

(g) Right to Restriction of Processing: Request that we limit the processing of your data in certain circumstances (for example, while a complaint or correction request is being evaluated);

(h) Right to Object: Object to specific processing activities such as direct marketing communications or automated decision-making/profiling.

ImpactPlus will not charge individuals for exercising these rights. To exercise your rights, contact our Grievance Officer at the details provided in Section 19. We may need to verify your identity before fulfilling certain requests. We will respond to eligible requests within the timeframes prescribed by applicable law (typically within 30 days).

15. AI Data Processing and Automated Decision-Making

15.1 Use of Data for AI Processing

ImpactPlus does not use your User Content or other client data to train, fine-tune, or improve any AI model, whether ours or third-party. The third-party AI service providers used by the Platform operate under enterprise API agreements that contractually prohibit the use of your data for model training.

ImpactPlus may, with your consent, use genuinely anonymised and aggregated insights derived from Platform usage across a minimum of five (5) Organizations to: (a) develop pharmaceutical industry benchmarks; and (b) create anonymised case studies, provided that no such use results in identification of your Organization, your brands, or your confidential business information. This is the only aggregate-data use case ImpactPlus undertakes.

15.2 Anonymisation Safeguards

Where data is anonymised for the limited benchmarking and case-study purposes set out in Section 15.1, the anonymisation is intended to be irreversible. Anonymisation safeguards include removing direct identifiers, aggregating across multiple Organizations, and implementing usage boundaries as per industry standards. Anonymised or aggregated data falling within Section 15.1 shall not be used to infer individual identities and falls outside the scope of personal data under the DPDP Act.

For the avoidance of doubt, processing logs retained under Section 13, Tier 2 are pseudonymised rather than anonymised, remain within the scope of the DPDP Act, and are processed on the lawful bases set out in Section 13.

15.3 Human Review Rights

Identifiable personal data is not used for AI training. In scenarios where a decision significantly affecting an individual is made solely by an automated system, the individual has the right to request human review of that decision.

16. Data Breach Notification

In the event of a personal data breach (meaning a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data), ImpactPlus will:

  • Promptly activate data breach response procedures to contain and investigate the incident;
  • Notify affected Account Administrators within 72 hours if the breach involves their data;
  • Report notifiable breaches to the Data Protection Board of India without delay, in accordance with Rule 7 of the DPDP Rules 2025, and to CERT-In within six hours of noticing such incidents (or such incidents being brought to our notice) where required under the CERT-In Cybersecurity Directions 2022;
  • Provide reasonable details of the incident, the personal data compromised (in general terms), and steps users should take to protect themselves;
  • Take immediate steps to mitigate the breach's effects and prevent future occurrences;
  • Document all breaches and responses, and conduct root cause analysis.

Users should promptly report any suspected security breach or data exposure to growth@impactplus.co.in.

17. Cross-Border Data Transfers

By default, all personal data is stored in secure servers within India. Any cross-border transfer of personal data will be carried out in compliance with applicable laws, including the DPDP Act. We will ensure that the destination country or organization is not restricted by the Indian government for such transfers, or that appropriate safeguards are in place (such as standard data protection clauses or adequacy decisions). ImpactPlus will inform users of material cross-border transfers and, where required by law, obtain consent. Cross-border transfers will be limited to what is necessary.

18. Internal Governance and Accountability

ImpactPlus maintains a robust internal governance framework for data protection to ensure accountability and compliance:

Designated Officer: A Data Protection Officer (DPO) or equivalent responsible officer is designated to oversee privacy compliance, advise on data protection obligations, and act as a point of contact for data principals and regulators;

Audits and Assessments: Regular privacy and security audits (at least annually) to evaluate compliance with this Policy and applicable laws, including privacy impact assessments for new AI deployments;

Employee Obligations: All ImpactPlus employees and contractors who handle personal data are subject to confidentiality obligations and receive training on data protection principles;

Access Controls: Employee access to personal data is restricted based on role and necessity (role-based access control);

Disciplinary Action: Any misuse of personal data by staff may result in disciplinary action, including termination;

Records: We maintain required records of processing activities;

Regulatory Cooperation: We cooperate fully with regulatory authorities in the event of inquiries or inspections.

19. Grievance Redressal and Contact Information

ImpactPlus is committed to addressing questions, concerns, or complaints related to personal data promptly. For any privacy-related inquiries or to exercise your rights:

Grievance Officer: Kajal Mehta

Email: growth@impactplus.co.in

Address: ImpactPlus Ventures LLP, 1009 D, Titanium City Centre, 100 Feet Ring Road, Satellite, Ahmedabad, 380015, Gujarat, India

Upon receiving any grievance, the Grievance Officer shall acknowledge receipt within twenty-four (24) hours during business days. We will strive to substantively resolve the grievance within 30 days, or such shorter period as may be prescribed under the Digital Personal Data Protection Act 2023 or the DPDP Rules 2025. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India or the relevant statutory authority. We encourage individuals to contact us directly so that we have the opportunity to resolve any issues.

20. Eligible Users

The Platform is intended for use by individuals who are at least 18 years of age and legally capable of entering into contracts under Indian law. The Platform is designed for business professionals and organizations.

The Platform is not intended for use by children. ImpactPlus does not knowingly collect personal data from individuals under 18 years of age. If we discover that personal data of a minor has been inadvertently collected, such data will be permanently deleted upon verification.

In accordance with Section 9 of the Digital Personal Data Protection Act 2023, ImpactPlus expressly confirms that it does not conduct any profiling, behavioural monitoring, targeted advertising, or tracking of children through the Platform, and shall not undertake any such activity in respect of any individual who is or who may reasonably be identified as a minor.

21. Business Continuity and Change of Control

In the event of a change in control, merger, platform discontinuation, or bankruptcy, ImpactPlus undertakes to provide users with a reasonable notice period to retrieve all data and AI Outputs. Data survivability protocols shall be followed, and secure deletion will be carried out after disengagement, unless otherwise required by law.

22. Policy Updates

ImpactPlus may review and update this Policy from time to time to reflect changes in our practices, legal requirements, or for operational reasons. The following two-tier mechanism applies:

(a) For non-material amendments, we will post the updated Policy on our website and notify the Account Administrator by email at least 30 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the amendment.

(b) For material amendments affecting how your personal data is processed (including changes to lawful bases, retention periods, third-party processors, data transfer arrangements, or the scope of processing), we will require your active re-acknowledgement through a non-dismissible in-platform banner on your next login on or after the effective date. The effective date at the top of this Policy indicates when it was last updated.

We will not reduce your rights under this Policy without your explicit consent.

23. Governing Law and Dispute Resolution

This Policy shall be governed by and construed in accordance with the laws of India, without regard to conflict of law principles.

The parties shall attempt to resolve disputes in good faith through mutual discussions within 15 days. If unresolved, disputes shall be referred to arbitration under the Arbitration and Conciliation Act, 1996 (as amended). Arbitration shall be conducted by a sole arbitrator jointly appointed by the parties (or, failing agreement, as per the Act). The seat and venue shall be Ahmedabad, Gujarat, and proceedings shall be conducted in English.

For any matters not subject to arbitration (including interim relief), the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction.

24. Relationship with Master Services Agreement

This Privacy Policy is incorporated by reference into the Master Services Agreement. In the event of any conflict between this Policy and the Master Services Agreement on matters other than data protection, the Master Services Agreement shall prevail. For data protection matters, this Policy shall govern.

END OF PRIVACY AND DATA PROTECTION POLICY

GrowthMind is operated by ImpactPlus Ventures LLP

ImpactPlus Ventures LLP

Version History

v1.6.6, published 7 October 2026: named the analytics tools in Section 8.3 and added the platform sentence in Section 1. Non-material clarification, effective on acceptance.

v1.6.5, 17 May 2026: Added Section 7.4 (Service-Related Informational Communications). Material amendment under Section 22(b). In-platform re-acknowledgement required at next login.

v1.6.4 — prior published version. Superseded by v1.6.5.