Privacy Policy

Last updated 19 October 2026

1. Introduction and Scope

Ms. Khushi Mistry, carrying on business in India as the sole proprietor of the proprietorship concern "TingTong", having its principal place of business at Mumbai, Maharashtra, India ("TingTong", "we", "us" or "our"), owns and operates the mobile software application "TingTong" distributed through the Apple App Store, and the website at www.ting-tong.com (together, the "Service").

A proprietorship concern is not a legal person distinct from its proprietor. Accordingly, the Data Fiduciary and the controller in respect of all processing described in this Policy is Ms. Khushi Mistry, and the obligations undertaken in this Policy are her personal obligations.

TingTong is a doorbell. You tap the name of a person you are connected to, and that person’s device rings. The Service is designed to function on the smallest quantity of personal data that will permit it to work, and this Policy is written to record exactly what that quantity is.

We recognise that your personal data belongs to you, and that we hold it only for defined and lawful purposes. This Privacy Policy ("Policy") explains what personal data we collect, why we collect it, the lawful basis on which we process it, with whom we share it, how long we keep it, how we protect it, and the rights available to you in respect of it.

The Service is available for download and use in every territory in which the Apple App Store operates. This Policy is accordingly issued in compliance with, and is to be read in conjunction with, the following instruments, in each case to the extent that the instrument applies to the processing in question:

• the Digital Personal Data Protection Act, 2023 (Act 22 of 2023) ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified vide Gazette notifications G.S.R. 843(E) and G.S.R. 846(E) dated 13 November 2025. The DPDP Rules are being brought into force in phases, Rules 1, 2 and 17 to 21 having come into force on 13 November 2025, Rule 4 coming into force on 13 November 2026, and Rules 3, 5 to 16, 22 and 23 coming into force on 13 May 2027. We do not await the expiry of these transitional periods, and the substantive commitments recorded in this Policy are given by us with effect from the date stated above;

• the Information Technology Act, 2000 and, in particular, Section 43A thereof, together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), which continue to remain in force until Section 44(2) of the DPDP Act is brought into effect;

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, "GDPR"), together with the national implementing legislation of the Member State in which you are resident;

• the United Kingdom General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of Section 3 of the European Union (Withdrawal) Act 2018, read with the Data Protection Act 2018 (together, "UK GDPR");

• Federal Decree-Law No. 45 of 2021 of the United Arab Emirates on the Protection of Personal Data ("UAE PDPL"), which has been in force since 2 January 2022 and is administered by the UAE Data Office. We have no establishment, branch, office or other presence in the United Arab Emirates, and we are neither established in nor licensed by the Dubai International Financial Centre or the Abu Dhabi Global Market, with the consequence that the Data Protection Law, DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 do not apply to us. The UAE PDPL nevertheless extends to a controller outside the United Arab Emirates which processes the personal data of data subjects within it, and we therefore apply its substantive obligations to users resident in the United Arab Emirates. Article 28 of the UAE PDPL provides for the issue of Executive Regulations, and Article 29 allows controllers and processors a period of six months from the issue of those Regulations, extendable once by the Cabinet, within which to regularise their position. We shall align our procedures with those Regulations within the period so allowed;

• the Children’s Online Privacy Protection Act, 1998 of the United States of America (15 U.S.C. 6501 to 6506) and the Children’s Online Privacy Protection Rule made thereunder (16 C.F.R. Part 312) ("COPPA"), together with Section 5 of the Federal Trade Commission Act; and

• the Apple App Store Review Guidelines and the Apple Developer Program License Agreement, in so far as they govern the collection, use and disclosure of user data through an application distributed on the Apple App Store.

This Policy applies to every person who downloads, installs, registers for or uses the Service, to every person who visits the website, and to every person who otherwise communicates with us by electronic mail or through our social media channels.

2. Definitions

Terms used in this Policy that are defined in the DPDP Act carry the meaning assigned to them in that Act. Where the context concerns processing governed by the GDPR or the UK GDPR, the expression "Data Fiduciary" is to be read as "controller", the expression "Data Processor" is to be read as "processor", and the expression "Data Principal" is to be read as "data subject". In particular:

• "Personal data" means any data about an individual who is identifiable by or in relation to such data.

• "Data Principal" means the individual to whom the personal data relates, and where that individual is a child, includes the parent or lawful guardian of such child, and where that individual is a person with a disability, includes her lawful guardian acting on her behalf.

• "Data Fiduciary" means any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. For the purposes of this Policy, Ms. Khushi Mistry, sole proprietor of TingTong, is the Data Fiduciary and the controller.

• "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.

• "Child" means an individual who has not completed the age of eighteen years, subject to Clause 13, which records the differing age thresholds applicable in other jurisdictions.

• "Processing" means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

• "Board" means the Data Protection Board of India constituted under Chapter V of the DPDP Act.

• "Ring" means the notification despatched to the device of a person to whom you are connected upon your tapping that person’s name within the Service.

• "Connection" means a mutual link between two accounts established by the acceptance of a friend code, by reason of which each account holder may ring the other.

3. Identity and Contact Details of the Data Fiduciary and Representatives

Data Fiduciary and controller: Ms. Khushi Mistry, sole proprietor of the proprietorship concern TingTong

Principal place of business: Mumbai, Maharashtra, India

Electronic mail: hello@ting-tong.com

Website: www.ting-tong.com

Grievance Officer: Ms. Khushi Mistry. The particulars are set out at Clause 22 below.

4. Personal Data We Collect

We collect only such personal data as is necessary for the specified purposes set out in Clause 5. An itemised description of the personal data we collect is as follows:

4.1 Account identifier

When you sign in using Sign in with Apple, Apple furnishes to us an identifier for your account. That identifier is the means by which your profile, your connections and your settings are located when you sign in again. We do not receive your Apple ID password or any other Apple credential.

4.2 Name

Either the name furnished by Apple at the time of sign-in or the name that you type into the Service. Persons to whom you are connected are shown your first name only.

4.3 Electronic mail address

Your electronic mail address is collected only if you choose to share it. Apple permits you to conceal your electronic mail address at the time of sign-in and to substitute a private relay address. If you exercise that option, we never receive your actual electronic mail address.

4.4 Notification token

An identifier issued by the Apple Push Notification service, and conveyed through the Expo push notification service, which permits a Ring to reach your device. The token changes upon reinstallation of the Service.

4.5 Friend code and connection data

A six-character code generated for your account, which you may share, and a record of each Connection you have accepted or which has been accepted in respect of you.

4.6 Quiet hours and bell preference

A start time, an end time and your time zone, if you elect to set them, together with the bell tone selected by you and whether your bell is presently switched off.

4.7 Recent Rings

A record of who rang you and at what time. This record expires one day after the Ring is made and is then erased automatically, ordinarily within a further day.

4.8 Nicknames

The names you assign to persons to whom you are connected. These are stored privately under your own account and are not legible to any other user, including the person so renamed. This restriction is enforced at the level of the database and not merely within the application.

4.9 Groups

The names of any groups you create and the persons to whom you are connected whom you place in them. These are stored privately under your own account and are not legible to any other user.

4.10 Monthly recap

For each calendar month, the number of Rings you sent, the number of Rings you received, and the number of Rings you sent to each person to whom you are connected together with the time of the latest, so that the Service can show you the person you rang most. These figures are stored under your own account.

4.11 Feedback and correspondence

The content of any message you send to us through the Service or by electronic mail, together with your account identifier, so as to permit a reply, and the content of any message you submit through the feedback form on the website.

4.12 Personal data we do not collect

For the avoidance of doubt, and as a commitment on which you are entitled to rely, we do not at present collect, receive, record or store:

• your telephone number;

• your address book, contacts or any contact list held on your device;

• your location, whether precise or coarse, at any time;

• photographs, or access to your camera, microphone or photograph library;

• any analytics identifier, advertising identifier or tracking identifier, and we do not at present operate any third-party tracker within the Service;

• any payment instrument, card number, bank account particular or Unified Payments Interface identifier; and

• the content of any message, for the reason that the Service carries no messages. A Ring conveys a single item of information, namely that a person known to you is at your door.

We do not at present undertake, and the Service as presently constituted is not technically capable of undertaking, behavioural profiling, cross-application tracking, or the tracking of you across applications or websites owned by other companies within the meaning of the Apple App Tracking Transparency framework. Accordingly, no App Tracking Transparency authorisation is sought from you.

The Service carries no advertising and no analytics at present. We may in future introduce advertising, including advertising arising from collaborations with other businesses, or analytics. Before we do so, we shall amend this Policy to describe the personal data concerned, the purposes for which it is processed and the persons with whom it is shared, and we shall seek your consent, and your authorisation under the App Tracking Transparency framework, wherever either is required.

We do not knowingly seek, and we request you not to submit to us, any personal data beyond what is described above.

5. Purposes for Which We Process Your Personal Data

We process your personal data only for the following specified purposes, and each item of personal data described in Clause 4 is processed only to the extent necessary for the purpose against which it is listed:

• Account creation and authentication: to create, maintain, authenticate and secure your account. Personal data used: account identifier, name, electronic mail address where shared.

• Delivery of Rings: to transmit a Ring from you to a person to whom you are connected, and to transmit to you a Ring sent by such a person. Personal data used: account identifier, first name, notification token, connection data.

• Establishment and maintenance of Connections: to generate your friend code, to give effect to the acceptance of a code, and to display to you the persons to whom you are connected. Personal data used: friend code, connection data, first name.

• Giving effect to your settings: to suppress Rings during your quiet hours, to apply your selected bell tone, and to indicate to persons connected to you that your bell is switched off. Personal data used: quiet hours, time zone, bell preference.

• Display of recent activity: to show you who rang you and when, for a period of one day. Personal data used: recent Rings.

• Private naming and grouping of contacts: to display to you the nickname you have assigned to a person connected to you, and the groups in which you have placed such persons. Personal data used: nicknames, groups.

• Monthly recap: to show you, for each month, how many Rings you sent and received and the person you rang most. Personal data used: monthly recap.

• Support and grievance redressal: to respond to your queries, requests, complaints and grievances and to give effect to your rights under Clauses 16 to 19. Personal data used: account identifier, electronic mail address, the content of your communication.

• Security, integrity and prevention of abuse: to detect, investigate and prevent unauthorised access, the abuse of friend codes, unsolicited or harassing use of the Ring function, and other harm to us, to you or to the Service. Personal data used: account identifier, connection data, Ring records, technical logs.

• Legal and regulatory compliance: to comply with applicable law and to respond to lawful requests from courts, tribunals and statutory or investigating authorities. Personal data used: as required by the applicable law or lawful request.

We do not process your personal data for any purpose other than those set out in this Clause. We do not undertake automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 of the GDPR, and we do not undertake profiling.

6. Lawful Basis of Processing

6.1 Under the DPDP Act

For the purposes listed at Clause 5, other than those covered by Clause 6.2, we process your personal data on the basis of your consent under Section 6 of the DPDP Act. Your consent is sought through a clear affirmative action, and is free, specific, informed, unconditional and unambiguous, and is limited to such personal data as is necessary for the specified purpose. The notice accompanying the request for consent is given in the manner required by Section 5 of the DPDP Act and Rule 3 of the DPDP Rules, and is made available in English and in each language specified in the Eighth Schedule to the Constitution of India, at your option.

Mere downloading or opening of the Service is not treated by us as consent to processing beyond what is strictly necessary for the Service to function.

We do not presently engage a Consent Manager registered with the Board. Consent is obtained and managed directly by us.

6.2 Certain legitimate uses

In accordance with Section 7 of the DPDP Act, we may process your personal data without separate consent where you have voluntarily provided your personal data to us for a specified purpose and have not indicated that you do not consent to its use for that purpose, and where processing is necessary for compliance with any judgment, decree or order issued in India, or for compliance with any law for the time being in force in India, or for responding to a medical emergency, or for such other legitimate uses as are specified in Section 7.

6.3 Under the GDPR and the UK GDPR

Where the GDPR or the UK GDPR applies to the processing, we rely on the following lawful bases:

• Article 6(1)(b), performance of a contract: for account creation and authentication, the delivery of Rings, the establishment and maintenance of Connections, giving effect to your settings, the display of recent activity, the private naming and grouping of contacts, the monthly recap, and support. Without this processing the Service cannot be provided to you at all.

• Article 6(1)(f), legitimate interests: for security, integrity and the prevention of abuse. The legitimate interest pursued is the protection of the Service and of its users from unauthorised access and from harassment. We have assessed that this processing is necessary for that interest and that it does not override your interests or fundamental rights and freedoms, having regard to the very limited categories of personal data involved. You may object to this processing under Article 21 and we shall cease it unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

• Article 6(1)(c), compliance with a legal obligation: for legal and regulatory compliance and the response to lawful requests.

• Article 6(1)(a), consent: where we seek your consent for any processing not falling within the bases above, and in respect of the transfer described at Clause 10 where we rely on Article 49(1)(a).

We do not process any special category of personal data within the meaning of Article 9 of the GDPR, nor any sensitive personal data or information within the meaning of Rule 3 of the SPDI Rules, nor any sensitive personal data within the meaning of Article 1 of the UAE PDPL.

6.4 Under the UAE PDPL

Where the UAE PDPL applies to the processing, we rely upon your consent under Article 4 of the UAE PDPL, save where the processing is necessary for the performance of a contract to which you are a party, or is necessary to protect the public interest, or is necessary for the controller to perform its obligations, or falls within another of the cases specified in Article 4 in which consent is not required.

6.5 Withdrawal of consent

You may withdraw your consent at any time, and the ease of withdrawing consent shall be comparable to the ease with which it was given. You may withdraw your consent:

• by using the Delete account option within the Service, under "My door";

• by switching off the relevant setting within the Service, where the processing relates to a setting; or

• by writing to the Grievance Officer at the contact details set out at Clause 22.

Upon withdrawal of consent, we shall, within a reasonable time, cease processing your personal data for the purpose to which the withdrawn consent relates and shall cause our Data Processors to do likewise, unless such processing is required or authorised under any law for the time being in force. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. The consequence of withdrawal is that the Service will cease to function for you, as the Service cannot operate without an account identifier and a notification token.

7. How We Collect Your Personal Data

• Directly from you: when you sign in, choose a name, set your quiet hours or bell, assign a nickname, create a group, share or accept a friend code, or write to us.

• From Apple: your account identifier, and the name and electronic mail address which you authorise Apple to disclose at the time of sign-in, through the Sign in with Apple mechanism, and your notification token through the Apple Push Notification service and the Expo push notification service.

• Generated by the Service: your friend code, the record of each Ring sent or received, and your monthly recap.

We do not acquire personal data about you from data brokers, from publicly available sources, or from any third party other than as described above.

8. Cookies and Similar Technologies

The Service does not deploy cookies, software development kits for analytics or advertising, pixels, web beacons, device fingerprinting or any similar technology for the purpose of tracking. The website at www.ting-tong.com deploys only such storage as is strictly necessary for the website to be served to you, and accordingly falls within the exemption in Article 5(3) of Directive 2002/58/EC as amended by Directive 2009/136/EC. No consent banner is presented to you because no non-essential storage is placed on your device. The fonts used by the website are served from the website itself, and no request is made to any third-party font service.

9. Sharing of Personal Data

We do not sell your personal data. We do not share, rent or license your personal data to advertisers or to data partners, and we have none at present. We share your personal data only as set out below, and in each case only to the extent necessary:

9.1 Data Processors engaged by us

• Google LLC and its affiliates, in respect of the Google Firebase platform, which stores the personal data described at Clause 4 and provides the underlying database and authentication infrastructure;

• Apple Inc. and its affiliates, in respect of the Sign in with Apple service and the Apple Push Notification service, the latter of which receives the text of a Ring in order to deliver it. That text consists of a first name and the words that a person is at your door.

• 650 Industries, Inc. (Expo), in respect of the Expo push notification service, which receives your notification token and the text of a Ring from the device of the person ringing you, and conveys them to the Apple Push Notification service for delivery;

• Netlify, Inc., which hosts the website and receives the content of any message submitted through the feedback form on the website.

Our contracts with these Data Processors require them to process your personal data only on our documented instructions, only for the purposes for which we have disclosed it, to maintain appropriate technical and organisational security measures, to engage no sub-processor without authorisation, to assist us in giving effect to your rights, to notify us of any personal data breach, and to erase or return the personal data upon completion of the purpose or termination of the contract. Each such contract contains the particulars required by Article 28(3) of the GDPR and of the UK GDPR. We remain responsible under the DPDP Act, the GDPR, the UK GDPR and the UAE PDPL for compliance in respect of any processing undertaken by a Data Processor on our behalf.

9.2 Disclosure to other users

A person to whom you are connected is shown your first name, the bell you have chosen, and whether your bell is presently switched off. That is the entirety of what such a person is shown. No other user of the Service is able to see the persons to whom you are connected, the nicknames you have assigned, your groups, your monthly recap, your quiet hours or the record of who has rung you.

9.3 Disclosure required by law

We may disclose your personal data where we are required to do so in order to comply with any law for the time being in force, or in response to any judgment, decree, order, summons, notice or lawful direction issued by a court, tribunal, or judicial, quasi-judicial, regulatory, statutory or investigating authority of competent jurisdiction. Where we are permitted by law to do so, we shall inform you of any such request before complying with it.

9.4 Business transfer

If the whole or any part of our business or its assets is transferred, merged, amalgamated, demerged or sold, your personal data may form part of the transferred assets. In such an event, the transferee shall be bound to process your personal data in accordance with this Policy, and we shall inform you of such transfer through the Service or by written intimation before your personal data becomes subject to a different privacy policy.

10. Storage Location and International Transfers

Your personal data is held on Google Firebase servers located in Mumbai, India. Your notification token and the text of each Ring pass through the servers of the Expo push notification service in the United States of America, and the Apple Push Notification service transmits Rings through Apple infrastructure which may be located in any territory in which Apple operates that service. Messages submitted through the feedback form on the website are held by Netlify, whose infrastructure is located principally in the United States of America.

The Service is available worldwide, and personal data collected from you will therefore ordinarily be transferred to India for storage, and the limited personal data described above will pass through the United States of America. The following provisions govern such transfers, and the provisions of Clause 10.1 apply to the passage of personal data through the United States of America as they apply to its transfer to India:

10.1 Transfers from the European Economic Area and the United Kingdom

India is not the subject of an adequacy decision of the European Commission under Article 45 of the GDPR, nor of adequacy regulations of the Secretary of State under the UK GDPR. We state plainly, and without qualification, that we have not at the date of this Policy concluded standard contractual clauses or put in place any other appropriate safeguard of the kind contemplated by Article 46 of the GDPR or of the UK GDPR in respect of the transfer of your personal data to India. We make no representation that any such safeguard is in place, and you should not assume that one is.

In the absence of an adequacy decision and of appropriate safeguards, a transfer to India may presently be made only upon one of the derogations in Article 49. We rely upon Article 49(1)(a), namely your explicit consent to the proposed transfer after having been informed of the possible risks of the transfer to you by reason of the absence of an adequacy decision and of appropriate safeguards. That consent is sought from you separately, before your personal data is transferred, and may be withdrawn at any time, the consequence of withdrawal being that the Service cannot be provided to you.

The possible risks of which you are so informed are these. Once your personal data is held in India, it is subject to the law of India, which includes powers of access by public authorities that are not identical to those examined by the Court of Justice of the European Union in Case C-311/18. Those powers include Section 69 of the Information Technology Act, 2000, which permits the interception, monitoring or decryption of information in certain circumstances, and Section 91 of the Code of Criminal Procedure, 1973, as re-enacted by Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, which permits a court or officer in charge of a police station to require the production of a document or thing. Judicial redress in India in respect of such access may not in every case be equivalent to that available to you within the Union or the United Kingdom. The categories of personal data transferred are those at Clause 4, they do not include any special category of data, and they are encrypted in transit and at rest.

We consider the present position unsatisfactory and we are taking steps to conclude the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 of 4 June 2021, together with the International Data Transfer Addendum issued by the Information Commissioner under Section 119A of the Data Protection Act 2018, and to carry out and document a transfer impact assessment. This Clause shall be amended to record the position as soon as those steps are complete, and the amended Clause shall be notified to you. You may at any time ask the Grievance Officer for the current position.

10.2 Transfers under the DPDP Act

Where personal data is transferred by us outside India, we do so in accordance with Section 16 of the DPDP Act, which permits such transfer to any country or territory other than a country or territory that the Central Government may by notification restrict, and subject to such terms and conditions as the Central Government may specify. We do not transfer your personal data to any country or territory in respect of which a restriction is in force.

10.3 Transfers under the UAE PDPL

We hold no personal data within the United Arab Emirates, since all personal data is collected directly by us and stored in India. Where a user resident in the United Arab Emirates uses the Service, and to the extent that Articles 22 and 23 of the UAE PDPL apply to the resulting transfer, that transfer is made with your express consent, given after you have been informed that India has not been the subject of a determination of adequate protection, and on the footing that the transfer does not prejudice the public interest of the United Arab Emirates. We shall, upon the issue of the Executive Regulations, put in place such contractual arrangement as those Regulations require.

11. Security Safeguards

We implement reasonable and appropriate technical and organisational security safeguards to prevent a personal data breach, having regard to the nature of the personal data we hold and to the risk of varying likelihood and severity to your rights and freedoms. These include:

• encryption of personal data in transit by means of transport layer security, and encryption of personal data at rest on the Firebase platform;

• access control to the computer resources on which personal data is processed, and role-based restriction of access to personal data on a need-to-know basis;

• database-level security rules which enforce, independently of the application, that a user may read only her own connections, her own nicknames, her own quiet hours and her own record of Rings received;

• the use of such logs as are made available by the platforms on which personal data is processed, and the monitoring and review of access, to enable the detection and investigation of unauthorised access;

• measures for the continued processing of personal data in the event of the compromise of confidentiality, integrity or availability, including data backup;

• the storage of no payment instrument, no telephone number, no location and no contact list, so that the consequences of any compromise are correspondingly confined; and

• contractual arrangements with our Data Processors requiring them to implement equivalent security safeguards.

These safeguards are in addition to the reasonable security practices and procedures required under Section 43A of the Information Technology Act, 2000 read with the SPDI Rules, to the extent applicable to us.

No method of transmission over the internet and no method of electronic storage is entirely secure. While we take the safeguards described above, we cannot guarantee absolute security. You are responsible for maintaining the security of the Apple ID with which you sign in and of the device on which the Service is installed.

12. Personal Data Breach

In the event of a personal data breach affecting your personal data, we shall, on becoming aware of the breach:

• intimate you, without delay, through the Service or through any other mode of communication registered with us, describing the nature, extent and timing of the breach, its likely consequences relevant to you, the measures we have taken or propose to take to mitigate the risk, the safety measures you may take to protect your interests, and our contact details for further information;

• intimate the Data Protection Board of India without delay, and furnish to the Board within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may on written request allow, the detailed particulars required under the DPDP Rules, including the events and circumstances leading to the breach, the mitigation measures taken, our findings regarding the person who caused the breach, the remedial measures taken to prevent recurrence, and a report on the intimations given to affected Data Principals;

• notify the competent supervisory authority under Article 33 of the GDPR, and the Information Commissioner under Article 33 of the UK GDPR, without undue delay and, where feasible, not later than seventy-two hours after having become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and communicate the breach to you under Article 34 where it is likely to result in a high risk to your rights and freedoms; and

• notify the UAE Data Office and the affected data subjects in accordance with Article 9 of the UAE PDPL, treating a period of seventy-two hours from discovery as the operative standard for notification without undue delay.

We maintain a record of every personal data breach, comprising the facts relating to the breach, its effects and the remedial action taken, in accordance with Article 33(5) of the GDPR.

13. Personal Data of Children and Persons with Disabilities

The Service is directed at adults. The age thresholds applicable to the Service differ by jurisdiction, and we apply the threshold applicable to your jurisdiction as follows:

13.1 India

A child is an individual who has not completed the age of eighteen years. Where we process the personal data of a child, or of a person with a disability who has a lawful guardian, we shall, before such processing, obtain verifiable consent from the parent or, as the case may be, the lawful guardian, in the manner prescribed under the DPDP Act and the DPDP Rules. For that purpose, we shall observe due diligence to verify that the individual identifying herself as the parent or lawful guardian is an identifiable adult, by reference to reliable identity and age details already available with us, or to identity and age details voluntarily provided by such individual, or to a virtual token mapped to such details and issued by an entity entitled to issue it, including a Digital Locker service provider.

13.2 European Economic Area and United Kingdom

Article 8 of the GDPR fixes the age at which a child may herself consent to the offer of information society services at sixteen years, and permits a Member State to provide by law for a lower age, which shall not be below thirteen years. We apply the age fixed by the law of the Member State in which the child is resident. In the United Kingdom, the age so fixed is thirteen years. Below the applicable age, processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child, and we shall make reasonable efforts to verify that such consent has been so given or authorised, taking into consideration available technology.

13.3 United States of America

COPPA applies to the personal information of a child under the age of thirteen years. The Service is not directed to children under the age of thirteen, and we do not knowingly collect personal information from a child under that age. If we learn that we have collected personal information from a child under thirteen without verifiable parental consent, we shall erase that information. A parent or guardian may review the personal information we hold concerning her child, direct us to erase it, and refuse to permit its further collection, by writing to the Grievance Officer at the contact details set out at Clause 22.

13.4 Provisions applicable in every jurisdiction

We shall not undertake any processing of a child’s personal data that is likely to cause any detrimental effect on the well-being of the child. We shall not undertake tracking or behavioural monitoring of children, and we shall not direct any targeted advertising at children. The Service carries no advertising at present.

If you believe that a child has provided personal data to us without the consent required by this Clause, please write to the Grievance Officer at the contact details set out at Clause 22, and we shall erase such personal data.

14. Retention and Erasure of Personal Data

We retain your personal data only for so long as is necessary for the specified purpose for which it was collected, or for such longer period as retention is necessary for compliance with any law for the time being in force, whichever is later. Accordingly:

• the record of recent Rings expires one day after the Ring is made and is then erased automatically, ordinarily within a further day;

• your account identifier, name, electronic mail address where shared, notification token, friend code, connection data, quiet hours, bell preference, nicknames, groups and monthly recap are retained for so long as your account subsists, and are erased upon deletion of your account;

• feedback and correspondence is retained for so long as is necessary to resolve the matter to which it relates, after which it is erased;

• security and access logs, to the extent we hold any, are retained for the period prescribed by the DPDP Rules, and are thereafter erased; and

• personal data required for the establishment, exercise or defence of a legal claim, or for compliance with a direction of a court, tribunal or authority, is retained until the conclusion of the relevant proceeding and the expiry of the applicable limitation period.

Upon the expiry of the applicable retention period, or upon your withdrawal of consent, or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earliest, we shall erase your personal data and shall cause our Data Processors to erase it, unless retention is necessary for compliance with any law for the time being in force.

15. Deletion of Your Account

The Service contains, under "My door", an option to delete your account. Exercising that option removes your profile, your friend code, your connections, your pending connection requests, your nicknames, your groups and your monthly recap. Deletion cannot be undone, and nothing is retained afterwards save the record of recent Rings, which is erased as described at Clause 4.7, feedback and correspondence, which is retained as described at Clause 14, such records, if any, as we are required by law to retain, and backups, which are overwritten in the ordinary course within 30 days.

16. Your Rights as a Data Principal under the DPDP Act

Subject to the DPDP Act, you have the following rights in respect of personal data processed by us on the basis of your consent or for a legitimate use:

• Right to access information: to obtain from us a summary of the personal data of yours being processed and the processing activities undertaken by us, the identities of all other Data Fiduciaries and Data Processors with whom we have shared such personal data along with a description of the personal data so shared, and any other related information.

• Right to correction, completion, updating and erasure: to have inaccurate or misleading personal data corrected, incomplete personal data completed, personal data updated, and personal data erased, save where retention is necessary for the specified purpose or for compliance with any law for the time being in force.

• Right of grievance redressal: to have readily available means of registering a grievance with us in respect of any act or omission regarding the performance of our obligations or the exercise of your rights, as set out at Clause 22.

• Right to nominate: to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act in accordance with the DPDP Rules.

17. Your Rights as a Data Subject under the GDPR and the UK GDPR

Where the GDPR or the UK GDPR applies to the processing of your personal data, you have the following rights:

• Right of access (Article 15): to obtain confirmation as to whether personal data concerning you is being processed, access to that personal data, and the information specified in Article 15(1).

• Right to rectification (Article 16): to obtain the rectification of inaccurate personal data concerning you and the completion of incomplete personal data.

• Right to erasure (Article 17): to obtain the erasure of personal data concerning you where one of the grounds in Article 17(1) applies.

• Right to restriction of processing (Article 18): to obtain the restriction of processing in the circumstances specified in that Article.

• Right to data portability (Article 20): to receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format, and to transmit that data to another controller, where the processing is based on consent or on contract and is carried out by automated means.

• Right to object (Article 21): to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f).

• Right to withdraw consent (Article 7(3)): to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• Right to lodge a complaint (Article 77): to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, or, in the United Kingdom, with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

The exercise of these rights is without prejudice to your right to an effective judicial remedy under Articles 78 and 79 of the GDPR.

18. Your Rights under the UAE PDPL

Where the UAE PDPL applies to the processing of your personal data, you have the rights conferred by Articles 13 to 19 of that Decree-Law, namely the right to request information concerning the processing, the right to request the transfer of your personal data to another controller in a structured and machine-readable format, the right to correction or erasure of your personal data, the right to restrict processing, the right to cease processing, the right to object to processing for the purposes specified in Article 18, the right to object to automated processing, and the right to lodge a complaint with the UAE Data Office.

19. Users in the United States of America

There is at present no general federal statute in the United States of America governing the processing of personal information by a private entity of the kind operating the Service. The following disclosures are made to users in the United States:

• we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so;

• we do not process sensitive personal information as that expression is used in the privacy statutes of the several States;

• the categories of personal information we collect, the purposes of collection, the categories of recipients, and the periods of retention are stated at Clauses 4, 5, 9 and 14 respectively;

• the position in respect of children under the age of thirteen years is stated at Clause 13.3; and

• we shall not discriminate against you for exercising any right conferred upon you by the law of your State.

Several States, including California, Virginia, Colorado, Connecticut, Utah and Texas, have enacted comprehensive consumer privacy statutes which confer rights of access, correction, deletion, portability and opt-out upon residents of those States. Those statutes apply only to a business which meets the thresholds of annual gross revenue or of volume of consumer data prescribed in each such statute. We do not presently meet any of those thresholds, and accordingly none of those statutes presently applies to us. We shall keep that position under review and shall amend this Policy if it changes.

Irrespective of whether any such threshold is met, and as a matter of contract between you and us, we shall give effect to any request by you for access to, correction of, deletion of, or a portable copy of your personal data on the same terms as those set out at Clauses 16, 17 and 20.

20. How to Exercise Your Rights

You may exercise any of the rights set out at Clauses 16 to 19 by writing to the Grievance Officer at the contact details set out at Clause 22, from the electronic mail address registered with us, or through the Service. We may require you to furnish such particulars as are reasonably necessary to identify you and to locate the personal data in question, and we shall not require more.

We shall respond to your request without undue delay and in any event within one month of its receipt, which period may be extended by two further months where necessary, taking into account the complexity and number of the requests, in which case we shall inform you of the extension and of the reasons for it within one month of receipt. No fee is charged for giving effect to your rights, save that we may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive, and in particular because of its repetitive character. Requests made under the DPDP Act shall be responded to within the period prescribed under the DPDP Rules.

21. Your Duties as a Data Principal

Section 15 of the DPDP Act imposes certain duties upon you. In particular, you shall:

• comply with the provisions of all applicable laws while exercising your rights under the DPDP Act;

• not impersonate another person while providing your personal data to us for a specified purpose;

• not suppress any material information while providing your personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;

• not register a false or frivolous grievance or complaint with us or with the Board; and

• furnish only such information as is verifiably authentic while exercising the right to correction or erasure.

Breach of these duties may attract a penalty under the DPDP Act.

22. Grievance Redressal and Contact

You may address any question, request or grievance in relation to the processing of your personal data, or the exercise of your rights under Clauses 16 to 19, to our Grievance Officer, who is the person able to answer, on our behalf, questions raised by you about the processing of your personal data. We are not presently required to designate a Data Protection Officer under Article 37 of the GDPR or of the UK GDPR, our core activities consisting neither of processing operations requiring regular and systematic monitoring of data subjects on a large scale, nor of processing on a large scale of special categories of data. Should that position change, a Data Protection Officer shall be designated and this Clause amended accordingly. Nothing in this paragraph affects the designation of the representatives named at Clause 3.

Name: Ms. Khushi Mistry

Designation: Proprietor, and Grievance Officer

Address: Mumbai, Maharashtra, India

Electronic mail: hello@ting-tong.com

We shall acknowledge the receipt of your grievance within twenty-four hours of its receipt and shall redress it within a period of fifteen days from the date of its receipt.

If you are not satisfied with the response of the Grievance Officer, or if your grievance is not redressed within the period stated above, you may:

• in India, make a complaint to the Data Protection Board of India in the manner provided under the DPDP Act and the DPDP Rules. Exhausting the grievance redressal mechanism set out in this Clause is a pre-condition to approaching the Board;

• in the European Economic Area, lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement;

• in the United Kingdom, lodge a complaint with the Information Commissioner’s Office; and

• in the United Arab Emirates, lodge a complaint with the UAE Data Office.

23. Third-Party Services

The Service depends upon the services of Apple Inc., Google LLC, 650 Industries, Inc. (Expo) and Netlify, Inc. as described at Clause 9.1, and our website carries a link to our page on the Instagram service. The processing of your personal data by Apple, by Google, by Expo, by Netlify and by Instagram in their own capacity and for their own purposes is governed by the privacy policies of those entities and not by this Policy. We do not control, and are not responsible for, the privacy practices of those entities. We encourage you to read their privacy policies.

24. Amendments to this Policy

We may amend this Policy from time to time to reflect changes in our processing activities or in applicable law, including as the remaining provisions of the DPDP Rules are brought into force on 13 November 2026 and 13 May 2027 respectively, and as the Executive Regulations to the UAE PDPL are issued. Any amended Policy shall be published within the Service and on the website with a revised date at the head of this Policy. Where an amendment materially affects the purposes for which your personal data is processed, we shall issue a fresh notice to you within the Service and, where required, seek your fresh consent before the amendment takes effect in respect of you.

25. Governing Law and Jurisdiction

This Policy is governed by the laws of India. The courts at Mumbai, India shall have exclusive jurisdiction in respect of any dispute arising out of or in connection with this Policy. Nothing in this Clause deprives you of the protection of the mandatory provisions of the law of the country in which you are habitually resident, nor of your right to bring proceedings before, or to complain to, the supervisory authority or court identified at Clause 22, nor of the jurisdiction of the Data Protection Board of India under the DPDP Act.