PRIVACY POLICY

Effective Date: 23 March 2026

1. Introduction

Radha Exports Pte Ltd (“Company,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (“App”) and our official website (“Website”) (collectively, the “Services”).

Strictly B2B Operations: Our App and the password protected portions of our Website are Business to Business (B2B) e-commerce platforms intended for authorized business clients and partners. Access to these restricted areas requires valid credentials issued by us or our partners. The public areas of our Website (e.g., company information, product listings, store locations etc) are accessible to the general public, but any personal data collected from visitors (such as via cookies or contact forms) is handled in accordance with this Privacy Policy.

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We may collect information about you directly from you or from other sources. In addition, we may be required by laws or by our contractual obligations to collect certain information which may include your personal information.

a. Information You Provide

• Account Data: Business email address, company name, business address, contact phone number, and the name/job title of the authorized user.
• Transaction Data: Order details, purchase history, shipping information, and invoices.
• Communications: Any correspondence sent via customer support or email.

b. Information Collected Automatically

• Usage Data: Interactions with the Services (login timestamps, features used) to optimize user experience.
• Device & Identifier Data: To comply with App Store requirements and for fraud prevention, we collect device type, operating system version, unique device identifiers (e.g., IDFA/AAID), and IP addresses.

3. Legal Basis for Processing

We process data under the following frameworks:

• Contractual Necessity: To manage your account and process orders.
• Legitimate Interests: To secure our Services, prevent fraud, and improve the user experience. This is our primary basis for administrative functions to minimise compliance overhead.
• Legal Obligations: To comply with tax, anti money laundering (AML), and corporate governance laws (e.g., Singapore GST Act).
• Consent: We do not currently rely on consent as a legal basis for processing. If we introduce processing activities that legally require consent (e.g., non essential cookies, sensitive data), we will obtain your explicit consent before commencing those activities.

Singapore PDPA: We process data based on the “Business Contact Information” (BCI) exception (where data is used solely to communicate with you in a business context) and “Deemed Consent” by the nature of the B2B transaction.

Note on AI: We do not use your personal data to train generative AI models or for high risk automated decision making.

4. Disclosure & International Transfers

• Service Providers: Third party vendors who perform services on our behalf (e.g., cloud hosting, analytics, and logistics). These vendors are contractually bound to maintain the confidentiality and security of your data and may use it only to provide the contracted services.
• Legal Authorities: When required by law (e.g., Singapore PDPC or court order).
• Business Transfers: In the event of a merger or sale, you will be notified prior to any data transfer.

International Transfers: Your data may be stored in Singapore, the EU, or the US. We utilise Standard Contractual Clauses (SCCs) and the EU U.S. Data Privacy Framework to ensure a standard of protection equivalent to the GDPR and PDPA.

5. Data Retention

We retain transaction and account data for the duration of your business relationship plus 7 years to meet statutory requirements (e.g., Singapore GST Act). Usage logs are typically retained for 2 years. After these periods, data is securely deleted or anonymised.

6. Your Rights & Account Deletion (PDPA & GDPR)

• Access & Correction: Request a copy of your data or correct inaccuracies.
• Erasure (Right to be Forgotten): Request deletion of your data where no legal retention requirement exists.
• Data Portability: (GDPR specific) Receive your data in a machine readable format.
• App Store/Play Store Deletion: You may initiate full account deletion directly within the App by navigating to Settings > My Profile > Delete Account or by contacting our DPO. Requests will be processed within 30 days.

7. Notice for U.S. Residents

• No Sale or Sharing: We do not sell your personal information for monetary consideration, nor do we share it for cross context behavioral advertising.
• Global Privacy Control (GPC): Our website recognizes and honors GPC signals as a valid request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, no further action is required.
• Right to Appeal: If we decline a request to exercise your privacy rights (e.g., access, deletion, correction), you may appeal by contacting our DPO at dpo@radhaexports.com. We will respond to your appeal within 60 days. If your appeal is denied, you may contact the Attorney General in your state of residence.

Additional Rights for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to Know: Request details about the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to legal exceptions (e.g., to complete a transaction or comply with tax obligations).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out: We do not sell or share your personal information, so no opt out is needed.
• Right to Non Discrimination: We will not discriminate against you for exercising your rights.

• How to Submit a Request: Contact us at dpo@radhaexports.com or use the “Delete Account” feature in the App. We will verify your identity using the information associated with your account (e.g., business email, company name) before processing your request. We will respond within 45 days (or as required by applicable law).
• Authorized Agent: You may designate an authorized agent to submit requests on your behalf. The agent must provide written permission signed by you, and we may require you to verify your identity directly.
• Shine the Light: California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information for such purposes.

8. Data Security

We implement appropriate technical and organizational security measures, including encryption (TLS/SSL), access controls, and regular vulnerability assessments, to protect your data against unauthorized access, alteration, disclosure, or destruction. While we strive to protect your data, no transmission over the internet is 100% secure.

9. Cookies & Tracking

We use Essential Cookies for security and Analytics Cookies (e.g., Google Analytics / Firebase) to monitor performance. We do not engage in cross site tracking for advertising. You can manage preferences in your browser or “Do Not Track” settings.

10. Children’s Privacy

Our Services are strictly for users aged 18 and above. We do not knowingly collect information from minors.

11. Contact Us & Data Protection Officer (DPO)

In compliance with global laws, we have appointed a DPO to handle all inquiries:

• Company Name: Radha Exports Pte Ltd
• DPO Email: dpo@radhaexports.com
• Address: 118 Pioneer Road Singapore 639598
• Complaints: You have the right to lodge a complaint with the Singapore PDPC or your local Data Protection Authority (DPA).