I. Introduction 

Simulanis Solutions Ltd. ("Simulanis", "we", "our" or "us"), CIN U74900DL2013PLC260757,  with its registered office at 260, Defence Colony Flyover Market, New Delhi - 110024 is a multi-award winning Indian XR (extended reality) technology company that creates augmented-reality, virtual reality and mixed-reality training and education products for the manufacturing and industrial sectors.  We develop digital learning content, simulators and collaboration tools for clients in pharmaceuticals,  FMCG, automotive, engineering, oil and gas and other industries. 

This privacy policy explains how we collect, use, share and protect the personal data of users of our  websites, online store, mobile applications, XR applications, learning modules, software-as-a-service  platforms and any other services that link to or reference this policy (collectively, the "Services"). 

Simulanis complies with the data protection laws of India (including the Information Technology Act  2000, the SPDI Rules 2011 and the Digital Personal Data Protection Act 2023 as operationalised by the  Digital Personal Data Protection Rules 2025), the European Union General Data Protection Regulation  ("GDPR"), the UK Data Protection Act 2018 and UK GDPR, the California Consumer Privacy Act as  amended by the California Privacy Rights Act (together, the "CCPA/CPRA"), the US Children’s Online  Privacy Protection Act and the COPPA Rule as amended in 2025 ("COPPA"), and other applicable  laws. 

Where we refer to Data Principals we mean individuals whose personal data we process under India’s  DPDP Act; Data Subjects refers to individuals under the GDPR and UK GDPR; and Consumers refers  to California residents under the CCPA/CPRA. 

This policy is a transparency notice provided to you so that you can understand and exercise your rights.  It is not a contract. We may update it from time to time and will notify you of material changes as  described in Section XXI. 

II. Scope and Applicability 

This policy applies to personal data that we collect in the course of running our business, including  through: 

• Websites and web-based portals: our corporate site (simulanis.com), content libraries and client  dashboards. 

• Our online store: the Simulanis e-commerce platform through which products, licences and  subscriptions may be purchased. 

• Mobile and desktop applications: apps published by Simulanis on iOS, Android and Windows  for training, simulation or collaboration.

• Extended-reality (XR) experiences and hardware: AR, VR and MR applications, including  real-time audio and video functionality and device sensors. 

• Software development services: custom software or content we build for clients. 

• Third-party platforms: applications distributed through our learning management systems, app  stores or hardware providers. 

Please read this policy carefully before using our Services. This policy is provided for your  information and does not itself constitute your consent. Where we rely on consent as our lawful  basis, we obtain that consent separately through a clear affirmative action at or before the point of  collection, and you may withdraw it at any time as described in Section XVII. 

III. Definitions 

• Personal Data / Personal Information means any information relating to an identified or  identifiable individual. Examples include your name, email address, phone number, user ID, IP  address and, in some jurisdictions, voice recordings or biometric identifiers. 

• Sensitive Personal Data is defined differently in each jurisdiction that applies to us. Section VII  sets out those differences and explains how we treat each category. 

• Processing means any operation performed on personal data, such as collection, storage, use,  disclosure, transfer or deletion. 

• Data Fiduciary (India) / Data Controller (EU, UK) / Business (California) is an entity that  determines the purpose and means of processing personal data. 

• Data Processor / Service Provider is an entity that processes personal data on behalf of, and  under the instructions of, a Data Fiduciary, Controller or Business. 

• Data Principal (India), Data Subject (EU and UK), Consumer (California) are individuals  whose personal data is processed. 

• Consent Manager means a person registered with the Data Protection Board of India through  whom a Data Principal may give, manage, review and withdraw consent. 

IV. Types of Personal Data We Collect 

The specific data collected depends on how you interact with our Services. Generally, we collect: 

1. Identity and Contact Data: name, job title, company, telephone number, postal address and  email address you provide when registering for an account, placing an order, subscribing to our  newsletter or contacting support. 

2. Account Credentials: usernames, passwords and authentication tokens that you create or provide  to access the Services. Passwords are stored in hashed form and are not accessible to our staff. 

3. Professional and Employment Data: information about your role, training progress and  certifications, including scores or assessments for training modules. 

4. Audio Data: voice and audio communications captured during real-time sessions in our XR  applications (see Section IX).

5. XR, Sensor and Spatial Data: device motion, orientation and accelerometer data, headset and  controller position and pose, hand-tracking data and, where a feature requires it and you enable it,  eye or gaze tracking and spatial mapping of your physical surroundings (see Section X). 

6. Device and Technical Data: IP address, device identifiers, browser type, operating system, VR  and AR headset identifiers, network information, log files, app version and usage statistics  collected automatically when you use our Services. 

7. Usage Data: interactions with our websites, store or apps (pages viewed, features used, time  spent), crash reports and performance data. 

8. Payment and Transaction Data: billing address, transaction dates and amounts, order history  and partial payment card details when you make purchases. Payments are processed by third party providers and we do not store full payment card numbers. 

9. Customer Content: any information you upload or input into our Services, such as training  materials, messages, feedback, queries, photographs or attachments. 

10.Location Data: approximate location derived from your IP address or device settings. We do not  request precise geolocation unless it is strictly necessary for a feature and you have given separate  consent. 

11.Other Data: information required to fulfil legal obligations, respond to grievances or provide  requested services, including communications and support tickets. 

We do not intentionally collect biometric identifiers such as fingerprints, retina or iris scans, or scans  of facial geometry. We treat voice and audio recordings as personal data and do not derive voiceprints,  voice embeddings or other biometric templates from them (see Sections VII, IX and X). Note that under  the amended COPPA Rule, an audio recording of a child’s voice is itself treated as personal information;  we handle children’s audio accordingly (see Section VIII). 

V. How We Collect Personal Data 

• Directly from you: when you create an account, complete a form, place an order, request  information, upload content or communicate with us by email, chat, telephone or in-app  messaging. 

• Automatically through the Services: we collect technical and usage data through cookies, pixel  tags, SDKs and similar technologies when you browse our websites or use our apps (see Section  XII). We also collect audio data and device sensor data when you use XR features (see Sections  IX and X). 

• Through third parties: we receive data from partners such as distributors, resellers, learning  management systems, payment processors and analytics providers. If you sign up through a  federated identity provider, we may obtain your name, email address and profile information from  that provider. We require such third parties to confirm that they are authorised to share your data  with us. 

• From clients and employers: when your employer or educational institution purchases our  Services for training, they may provide your contact information and role so that we can create  your user account. We process such data strictly in accordance with our contract with that client,  which acts as the Data Fiduciary, Controller or Business for that data.

VI. Purpose and Legal Basis for Processing 

We process personal data only where we have a lawful basis. For each purpose below we identify our  primary lawful basis rather than listing every basis that might conceivably apply. Where we rely on  legitimate interests we state the specific interest pursued, and you may request a copy of our balancing  assessment using the contact details in Section XVIII. Where we rely on consent, you may withdraw it  at any time, and withdrawing is as straightforward as giving consent. 

A note on India: the DPDP Act recognises consent and a defined set of "legitimate uses" under Section  7, rather than the six lawful bases available under the GDPR. Where this Section refers to contract  performance or legitimate interests, our corresponding position under the DPDP Act is either your  consent or the legitimate use of providing a service that you have voluntarily requested, or of complying  with a legal obligation, as applicable. 

VI.1 To provide and operate the Services 

Purpose 

Data Categories 

Lawful Basis

• Create and manage user accounts 

• Authenticate users 

• Deliver training modules 

• Maintain XR experiences 

• Process and fulfil  

orders 

• Provide customer support 

• Personalise learning content

• Identity and contact data • Account credentials 

• Usage data 

• Customer content 

• Payment and transaction  data 

• Device and technical  data 

• XR and sensor data

• Contract performance (GDPR Art.  6(1)(b)): processing is necessary to  enter into or perform a contract with  you. 

• Legitimate interests (Art. 6(1)(f))  where you are enrolled by an  

employer or institution rather than  contracting with us directly our  interest in administering the Services  we have agreed to provide to that  client. 

• Consent for optional features that  you switch on.

VI.2 To communicate with you

Purpose 

Data Categories 

Lawful Basis

• Respond to questions • Send administrative  and service messages 

• Send marketing  

newsletters where  

permitted 

• Provide product updates and security notices

• Identity and contact data • Communication data • Usage data

• Consent for marketing communications.

You may  unsubscribe at any time using the link  in every message or by contacting us. • Legitimate interests: our interest in  responding to enquiries you send us,  and in notifying users of service critical and security information they 

Purpose 

Data Categories 

Lawful Basis

need in order to use the Services  safely.

VI.3 To develop, monitor and improve the Services 

Purpose 

Data Categories 

Lawful Basis

• Troubleshoot faults • Measure performance • Analyse usage patterns 

• Conduct research 

• Enhance user experience

• Device and technical  data 

• Usage data 

• Analytics data 

• Aggregated or anonymised data

• Legitimate interests: our interest in  understanding how the Services are  used, diagnosing faults, improving  product quality and learning efficacy,  and maintaining the security of our  systems provided these interests are  not overridden by your rights. 

• Consent for non-essential cookies  and analytics, where required under  EU and UK e-Privacy rules and the  DPDP Act.

VI.4 To ensure safety and integrity 

Purpose 

Data Categories 

Lawful Basis

• Protect against fraud,  abuse or misuse 

• Enforce our terms 

• Maintain logs and  

investigate incidents 

• Perform audits

• Any data reasonably  necessary to verify  

identity, monitor session  integrity or investigate  misuse

• Legitimate interests: our interest in  preventing fraud and abuse of the  Services, and in protecting our users,  our clients and our systems from  harm. 

• Legal obligation: where we are  required to retain logs or report  

incidents to a regulator.

VI.5 To process payments

Purpose 

Data Categories 

Lawful Basis

• Collect payment for  subscriptions or purchases through third-party processors • Issue invoices

• Payment and transaction  data 

• Identity and contact data

• Contract performance: to provide  the paid Services you have ordered. • Legal obligation: tax, GST, accounting and audit compliance.

Purpose 

Data Categories 

Lawful Basis

• Manage refunds and  chargebacks

VI.6 To comply with legal obligations 

Purpose 

Data Categories 

Lawful Basis

• Meet requirements  under the DPDP Act,  GDPR and UK, GDPR, CCPA/CPRA,  COPPA and other applicable laws 

• Respond to lawful requests from authorities 

• Establish, exercise or  defend legal claims

• Any data subject to a  lawful request or obligation

• Legal obligation: we must comply  with applicable law, respond to valid  court orders and cooperate with regulators. 

• Legitimate interests where we act to  establish, exercise or defend legal  claims.

VI.7 To facilitate business transfers 

Purpose 

Data Categories 

Lawful Basis

• If we sell, merge or  transfer our business,  personal data may be  transferred to a successor entity subject to appropriate  safeguards

• All relevant data 

• Legitimate interests: our interest in  evaluating, negotiating and completing corporate transactions,  subject to confidentiality undertakings and controlled due diligence.

VI.8 Whether you must provide your data 

Where you contract with us, or where your employer or institution enrolls you in a training programme,  providing the identity, contact and account data described in Section IV is necessary in order for us to  create your account and deliver the Services. If it is not provided, we will not be able to provide the  Services to you. All other data is optional, and we identify it as such at the point of collection. 

VI.9 Automated decision-making and profiling 

We do not carry out automated decision-making, including profiling, that produces legal effects  concerning you or that similarly significantly affects you. Where our Services adapt learning content to your progress and assessment results, that adaptation affects only the sequence and difficulty of the  material presented to you. Assessment results and certifications are made available to your employer or  educational institution, which remains solely responsible for any decision it takes on the basis of them. 

VII. Sensitive Personal Data 

The laws that apply to us define "sensitive" data differently: 

• Under GDPR and UK GDPR Article 9, special category data means data revealing racial or  ethnic origin, political opinions, religious or philosophical beliefs, trade union membership,  genetic data, biometric data processed for the purpose of uniquely identifying a person, health  data, and data concerning sex life or sexual orientation. 

• Under the SPDI Rules 2011, sensitive personal data or information includes passwords, financial  information, physical, physiological and mental health condition, sexual orientation, medical  records and biometric information. 

• Under the CCPA/CPRA, sensitive personal information includes government identifiers, account  log-in credentials, precise geolocation, racial or ethnic origin, the contents of communications,  genetic and biometric data, and health information. 

We do not intentionally collect or process any of these categories, with two exceptions: (a) account  passwords and authentication credentials, which we store in hashed form and use solely to authenticate  you; and (b) billing information and partial payment card details necessary to complete a transaction,  which are handled by our payment processors. If we ever need to collect other sensitive data, we will  tell you why, seek your explicit consent, and use it only for the disclosed purpose. 

Voice and biometrics. A voice recording can in principle be used to identify an individual, and  voiceprints are treated as biometric identifiers under several of the laws that apply to us. Simulanis does  not create voiceprints or other biometric templates from your voice, does not use your voice for  authentication, and does not perform speaker identification or emotion analysis. See Section IX. 

California. We do not use or disclose sensitive personal information for any purpose other than those  permitted by the CCPA regulations at § 7027(m). Accordingly, we are not required to provide, and do  not display, a "Limit the Use of My Sensitive Personal Information" link. 

VIII. Children’s Privacy and Use in Educational Settings 

Our XR and educational tools may be used by minors. Protecting children’s privacy is a priority and  we comply with COPPA, the GDPR and UK GDPR, India’s DPDP Act and other relevant laws. 

VIII.1 Our general position 

Our Services are intended for users aged 18 and above. We do not offer the Services directly to children,  and our online store is not directed to children. The Services are made available to learners under 18  only where an employer, school or educational institution deploys them for a defined training or  educational purpose under a written contract with us. In that situation we act as a processor on the  institution’s instructions, as described below. 

VIII.2 Age thresholds and parental consent

Under 13 (United States). We do not knowingly collect personal data from children under 13 without  verifiable parental consent as required by COPPA. Where we disclose a child’s personal information to  any third party for a purpose that is not integral to providing the Service, we obtain separate verifiable  parental consent for that disclosure. The amended COPPA Rule treats audio recordings and biometric  identifiers as personal information, and we handle them accordingly. The Rule permits an operator to  collect a child’s voice in order to respond to the child’s request without parental consent only where the  recording is used solely for that purpose, is not used for any other purpose, and is deleted immediately  afterwards. We rely on that limited exception only: real-time voice commands and audio interactions  from children are processed solely to fulfil the request and are neither retained nor used for any other  purpose. 

Under 16 (EU and UK). Under GDPR Article 8, parental consent is required to process the personal  data of children under 16, and member states may set a lower age down to 13. We obtain verifiable  parental or guardian consent before collecting personal data from a minor below the applicable  threshold. 

Under 18 (India). The DPDP Act treats every individual under 18 as a child. Before processing a  child’s personal data we obtain verifiable consent from a parent or lawful guardian, and we carry out  due diligence to confirm that the person giving consent is an identifiable adult, using reliable identity  details or a virtual token mapped to them, as contemplated by the DPDP Rules 2025. 

Where an educational institution deploys the Services, we rely on the exemption available to  educational institutions under the Fourth Schedule to the DPDP Rules 2025, but only to the extent and  for the purposes permitted by that Schedule. We require the institution to confirm in writing that it is  acting within the scope of that exemption or, where it is not, that it has obtained all necessary parental  consents. 

VIII.3 No tracking, monitoring or advertising directed at children 

Consistent with Section 9(3) of the DPDP Act, we do not track children, do not undertake behavioural  monitoring of children, and do not direct advertising at children. We never use a minor’s data for  marketing, behavioural advertising or profiling of any kind, and we do not disclose a minor’s data to  third parties for advertising purposes. 

VIII.4 Limited data collection 

We collect only the information necessary for the educational purpose, such as the learner’s first name  or alias, cohort identifier, course progress and performance. We do not collect sensitive personal data  about minors unless it is strictly required and explicit consent has been obtained. 

VIII.5 Children’s data retention policy 

As required by the COPPA Rule, the following is our published retention policy for children’s personal  information. We retain children’s personal information only for as long as reasonably necessary to fulfil  the specific purpose for which it was collected, and we never retain children’s personal information  indefinitely.

Category of  

children’s personal  data

Purpose of collection 

Business need for  

retention

Deletion timeline

Learner first name or  alias, cohort or class  identifier, account  credentials

Create and administer the learner account

Required to give the  learner continuous access to their course  for the duration of the  programme

Deleted within [30] days of the institution  confirming that the programme has ended,  or of account closure

Course progress, scores, assessment  results and certifications

Deliver the training  and report completion  to the institution

Required to issue  

certification and  

evidence completion  to the institution

Deleted within [90] days of the programme  ending, unless the institution instructs us to  retain certification records for a stated period

Real-time voice and  audio in XR sessions

Fulfil the child’s spoken request, or transmit speech to other participants in  the session

None there is no business need to retain  this data

Not retained. Processed  transiently in memory  and deleted immediately  once the request has been fulfilled

Device and technical  data needed to run  the session

Deliver, secure and  troubleshoot the XR  session

Required to operate the session and to  

investigate faults and security incidents

Deleted or irreversibly aggregated within [12] months

XR sensor, motion and spatial data

Render the XR experience on the device

None there is no business need to retain  this data

Not retained by Simulanis. Processed on  the device only

VIII. Children’s information security programme 

We maintain a written information security programme specific to children’s personal information, as  required by the COPPA Rule. The programme identifies the individual accountable for it, assesses the  internal and external risks to children’s personal information, sets out the safeguards we use to address  those risks, requires written security assurances from any third party to which children’s personal  information is disclosed, and is reviewed and tested at least annually. We are contactable at  connect@simulanis.com 

VIII. Child-friendly notices 

When our Services are used by minors, we provide information in clear, age-appropriate language so  that young users and their guardians can understand how their data is used. The UK Children’s Code  sets out 15 standards for online services likely to be accessed by children, including high privacy by default and avoiding "nudge" techniques that encourage children to provide more data than they need  to. We design our interfaces to meet these standards and to protect children’s best interests. 

VIII. Parental rights 

Parents and guardians may review their child’s personal information, request its correction or deletion,  refuse to permit any further collection or use of it, and withdraw consent at any time by contacting us  using the details in Section XVIII. We will not condition a child’s participation in an activity on the  child disclosing more personal information than is reasonably necessary for that activity. 

VIII. Educational institutions 

For ed-tech services used in schools, the UK Children’s Code applies to us as the provider rather than  to the school. Where we act as a processor on behalf of a school or employer, we process personal data  solely under their documented instructions and require them to obtain all necessary consents from  parents or guardians. We will refer any request we receive directly from a parent to the institution and  assist it in responding. 

IX. Audio Data and Real-Time Communications 

Our XR products and some mobile and desktop applications allow you to use voice commands, audio  chat or recorded narration. We treat audio data with particular care: 

• Microphone permission. We access your device’s microphone only after you grant permission  in the app or device settings. Without that permission, voice-based features will not function. You  may revoke the permission at any time. 

• Real-time processing. Voice and audio streams are processed in real time for the sole purpose of  delivering the functionality you have requested for example transmitting your voice to other  participants or interpreting a voice command. We do not store or listen to these communications  except transiently in memory to facilitate the service. We do not analyse audio to identify you or  to derive biometric data. 

• Limited retention. We do not retain audio recordings unless a feature you have opted into requires  it, such as recording a training session for later review. Where a recording is made we will clearly  inform all participants and obtain their consent, and the consent of a parent or guardian for any  minor, before recording begins. Recorded audio is stored securely and deleted once it is no longer  needed for the specified purpose (see Section XVI). 

• Children’s voices. If a child under 13 uses a voice feature, we rely on the COPPA limited  exception by processing the audio only to fulfil the request and deleting it immediately afterwards.  We do not use children’s voices for any other purpose and will not retain any recording of a child  without verifiable parental consent. 

• Security. Voice streams are encrypted in transit to prevent interception. We maintain strict access  controls and technical safeguards to protect audio data from unauthorised access. 

• Third-party providers. Where a third-party real-time communications provider carries the audio  stream, that provider is contractually bound to process the audio solely to deliver the service and  is prohibited from retaining or using it for any other purpose.

X. XR, Sensor and Spatial Data 

Our XR products run on head-mounted displays, handheld devices and PCs that incorporate a range of  sensors. Because this data can reveal information about your body, your movements and your physical  surroundings, we treat it as high-risk and describe it separately here. 

X.1 Motion, orientation and pose data 

Headset and controller position, rotation, accelerometer and gyroscope readings, and hand-tracking data  are generated continuously while an XR session is running. This data is used in real time to render the  experience and to position your viewpoint, hands and controllers correctly. It is processed on your  device. [Only aggregated telemetry about session stability and performance is transmitted to Simulanis,  and it is not linked to your identity. 

X.2 Eye and gaze tracking 

Some headsets support eye tracking. Where a device supports it, we use gaze data only for [foveated  rendering and interaction targeting] and only where the feature is enabled. Gaze data is processed on  the device, is not transmitted to Simulanis, is not stored, and is not used to profile you, to infer  your attention, interests, health or cognitive state, or for advertising. If we ever introduce a feature  that uses gaze data for training analytics, we will update this policy, obtain your separate consent, and  complete a data protection impact assessment first. 

X.3 Spatial mapping and environment data 

To place virtual objects correctly in your physical space, XR devices generate room-scale meshes, depth  maps and plane detection data, and where the device supports passthrough camera imagery of your  surroundings. This data can reveal the layout of your physical environment, including your workplace  or home. Simulanis does not receive, store or transmit spatial maps, depth meshes or passthrough  camera imagery. No images of your surroundings leave your device. 

X.4 Avatar and expression data 

Where a Service uses avatars, your avatar’s appearance and its movement are generated from the pose  and, where enabled, expression data described above. Avatar appearance settings you choose are stored  with your account. We do not create or store a facial-geometry template, and we do not use expression  data for emotion analysis or for any purpose other than animating your avatar during a session. 

X.5 Legal basis and safeguards 

• Contract performance for sensor data that is strictly necessary to render the XR experience you  have requested; consent for optional sensor features such as eye tracking, which are off by default  and which you may disable at any time in the application or device settings. 

• We complete a data protection impact assessment before deploying any new sensor-based  feature, and again before any change that would cause sensor data to leave the device. 

• Retention is set out in Section XVI. In summary, Simulanis does not retain XR sensor, spatial or  gaze data.

• Device manufacturers. The manufacturer of your headset or device collects data under its own  privacy policy, over which we have no control. Please review the manufacturer’s policy in addition  to this one (see Section XX). 

XI. Artificial Intelligence and Machine Learning 

We do not use Customer Content, learner assessment data, audio recordings or XR sensor data  to train, fine-tune or otherwise improve any general-purpose artificial intelligence or machine learning model, whether our own or a third party’s.

Where a Service includes an AI-assisted feature, such as content generation or a conversational  assistant, we will identify that feature within the Service, tell you which provider supports it, and ensure  by contract that the provider does not use your inputs or outputs to train its models. We will not  introduce model training on personal data without updating this policy and, where required, obtaining  your consent. 

We may use aggregated and anonymised data from which you cannot be identified and which cannot  reasonably be re-identified to improve product quality and to study learning efficacy. 

XII. Cookies and Tracking Technologies 

We use cookies, local storage, device identifiers and similar technologies to recognise you and to  customise your experience. Cookies may be "session cookies", deleted when you close your browser,  or "persistent cookies", stored until they expire or you delete them. We use: 

• Strictly necessary cookies to authenticate users, maintain your shopping basket and enable secure  navigation of our Services. These do not require consent. 

• Performance and analytics cookies to understand usage patterns and improve functionality. • Functional cookies to remember preferences and settings, such as language choice. 

• Advertising cookies: we do not currently run targeted advertising or retargeting campaigns, and  we do not deploy third-party advertising or social-media tracking pixels on our websites or online  store. If we introduce them, we will update this policy, obtain consent where required, and provide  a "Do Not Sell or Share My Personal Information" link for California residents. 

Consent. We obtain your prior consent before placing any non-essential cookie or similar technology  on your device. This applies to users in the EU and UK under e-Privacy rules and to users in India under  the DPDP Act. Consent is collected through our cookie banner, and you may review or withdraw it at  any time through our cookie settings. Withdrawing consent does not affect the lawfulness of processing  carried out before withdrawal. 

Opt-out preference signals. Our websites recognise and honour the Global Privacy Control (GPC) and  equivalent opt-out preference signals sent by your browser or extension. 

A full list of the cookies we use, their purpose and their duration is set out in our Cookie Notice. XIII. How We Share Personal Data. We do not sell personal data, and we have not sold or shared personal information as those terms  are defined under the CCPA/CPRA in the preceding twelve months. We share your data with third  parties only for the purposes described in this policy and subject to appropriate safeguards. Categories  of recipients include: 

1. Service providers and processors: companies that provide services on our behalf, such as  hosting, content delivery networks, cloud infrastructure, payment processing, analytics, customer  support, real-time communications, identity verification and security. These providers process  personal data only under our documented instructions and are contractually obliged to implement  appropriate security measures and confidentiality commitments. 

2. Business partners and resellers: if you purchase our Services through a reseller or partner, we  may share your contact information, usage data and billing information with that partner to enable  account management, technical support and licence compliance. The partner’s own privacy policy  applies to its own processing of your data. 

3. Professional advisers: lawyers, auditors, accountants and insurers who assist us in running our  business and complying with legal obligations, subject to confidentiality obligations. 

4. Academic or research institutions: where we collaborate on anonymised research projects to  improve XR technologies or learning efficacy. Any published results are aggregated and will not  identify you. 

5. Corporate transactions: if we are involved in a merger, acquisition, financing, reorganisation or  sale of all or part of our business, personal data may be transferred as part of that transaction but  will remain subject to the commitments in this policy. 

6. Authorities: regulators, courts, government agencies and law enforcement, where required to  comply with a legal obligation, respond to a lawful request, or protect the rights, property or safety  of Simulanis, our users or others. On becoming aware of a personal data breach, the DPDP Rules  2025 require us to notify each affected Data Principal and the Data Protection Board of India  without delay, and to file a detailed report with the Board within 72 hours; we may need to share  certain data in those notifications. 

We do not permit third parties to collect personal data about your online activities across different  websites for their own purposes, and we prohibit our service providers from using personal data for any  purpose other than providing services to us. A jurisdiction-specific breakdown of the categories of  personal information disclosed, and the categories of recipients, is set out in Annexure A. 

XIV. International Data Transfers 

Simulanis is based in India but operates globally. We may transfer your personal data to jurisdictions  outside your home country, including the United States, the European Economic Area, the United  Kingdom, where our servers, affiliates or service providers are located. 

• DPDP Act (India). The DPDP Act applies to the processing of digital personal data within India  and, extraterritorially, to processing outside India where it relates to offering goods or services to  individuals in India. Section 16 of the Act permits the Central Government to restrict transfers of  personal data to specified countries or territories by notification. We monitor for and will cowith any such notification, and we ensure that cross-border transfers comply with the DPDP Rules  2025. 

• GDPR and UK GDPR. When transferring personal data from the EEA or the UK to a country  that has not been the subject of an adequacy decision, we rely on the European Commission’s  Standard Contractual Clauses or the UK International Data Transfer Agreement or  Addendum, as applicable. We carry out a transfer risk assessment for each such transfer and  implement supplementary technical and organisational measures where necessary. You may  request a copy of the safeguards we rely on by contacting us using the details in Section  XVIII. 

We take appropriate technical and organisational measures to ensure that your data receives a level of  protection consistent with applicable privacy laws wherever it is processed. 

XV. Data Security 

We maintain a written information security programme and implement appropriate technical and  organisational measures to protect personal data from unauthorised access, disclosure, alteration or  destruction. These include: 

• Encryption in transit and at rest, and the use of secure protocols (HTTPS and TLS) for data  transmission. 

• Access controls including role-based permissions, least-privilege access, multi-factor  authentication and secure credential management. 

• Segmentation and pseudonymisation of data where practicable. 

• Regular security assessments, penetration testing and vulnerability scanning, conducted on a  regular cycle. 

• Logging of access to personal data, with logs retained for at least one year as required by Rule 6  of the DPDP Rules 2025. 

• A separate written information security programme covering children’s personal information, as  required by the COPPA Rule (see Section VIII.6). 

• Training and awareness for employees and contractors on data protection and information security. 

• Contractual obligations requiring our processors to implement security measures at least  equivalent to our own, and to provide written security assurances where they receive children’s  personal information. 

Breach notification. We maintain an incident response procedure to detect, investigate and respond to  personal data breaches. On becoming aware of a breach we will: 

• notify each affected Data Principal without delay through their registered communication  channel, describing the nature of the breach, its likely consequences, the measures we have taken,  and the steps they can take to protect themselves; 

• give the Data Protection Board of India an initial intimation without delay, followed by a  detailed report within 72 hours of becoming aware of the breach, or within such longer period  as the Board may permit;

• notify the relevant EU or UK supervisory authority within 72 hours where the GDPR or UK GDPR  applies and the breach is likely to result in a risk to individuals, and notify affected individuals  without undue delay where the risk is high; and 

• notify affected individuals and regulators under any other applicable law, including US state  breach notification statutes. 

Despite our efforts, no method of transmission or storage is completely secure. If we learn of a security  breach affecting your personal data, we will notify you in accordance with applicable law. 

XVI. Data Retention 

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected,  or for as long as required by law. The following table sets out our retention periods and the criteria we  apply.

Category of data 

Retention period 

Criteria and legal basis

Account and profile  data

For the lifetime of the  account, then [12] months  after closure

To allow reactivation and to resolve  disputes; erased or irreversibly  

anonymised thereafter

Transaction, invoicing  and tax records

8 years from the end of the  relevant financial year

Section 128, Companies Act 2013; 6 years  for GST records under Section 36, CGST  Act 2017; equivalent tax rules in other  jurisdictions. The longest applicable  period applies

Training results,  

assessments and  

certifications

For the duration of the  client contract, then [12]  months, or until the client  instructs deletion

Contractual. The client acts as Data  Fiduciary, Controller or Business for this  data and may set a different period

Customer Content 

For the duration of the  client contract, then [90]  days

To allow retrieval on exit; deleted  thereafter

Access and security logs 

At least 1 year 

Rule 6, DPDP Rules 2025. Extended only  where required for an active investigation

Audio recordings 

Not retained, unless you  opt in to a recorded  

session, in which case [30]  days or the period notified  to you at the time

Consent-based; deleted once the specified  purpose has been fulfilled

XR sensor, motion, gaze  and spatial data

Not retained by Simulanis 

Processed transiently on the device; no business need for retention

Category of data 

Retention period 

Criteria and legal basis

Children’s personal data 

See the retention schedule  in Section VIII.5

COPPA § 312.10 and the DPDP Act.  Never retained indefinitely

Marketing contact data 

Until you withdraw  

consent, or after [24]  

months of inactivity,  

whichever is earlier

Consent-based

Support tickets and  

correspondence

[24] months 

To maintain service history and to  establish, exercise or defend legal claims

General principle. Under Section 8(7) of the DPDP Act we erase personal data as soon as it is  reasonable to assume that the specified purpose is no longer being served, or you withdraw your  consent, whichever is earlier, unless retention is required by law. Where we are required to give advance  notice before erasure, we will contact you at least 48 hours beforehand so that you can re-engage with  the Service if you wish to. 

Third Schedule assessment. We have assessed whether the fixed three-year retention ceiling in the  Third Schedule to the DPDP Rules 2025 applies to us as an e-commerce entity. It does not, because we  do not meet the registered-user threshold specified in that Schedule. We will re-assess this position if  our user numbers change. 

We may retain anonymised or aggregated data, from which you can no longer be identified and which  cannot reasonably be re-identified, indefinitely for research and statistical purposes. 

XVII. Your Rights and Choices 

XVII.a Rights under India’s DPDP Act 

As a Data Principal under the DPDP Act, you have the following rights: 

• Right to access and confirmation: obtain confirmation of whether we process your personal data,  a summary of that data, the processing activities carried out, and the identities of other Data  Fiduciaries and processors with whom it has been shared. 

• Right to correction, completion, updating and erasure: correct inaccurate or misleading data,  complete incomplete data, update it, and request erasure of data that is no longer required or for  which consent has been withdrawn. We may retain data where required by law or to establish,  exercise or defend legal claims. 

• Right to withdraw consent: where we process your data on the basis of your consent, you may  withdraw it at any time. Withdrawal is as easy as giving consent or  by contacting us. Withdrawal does not affect the lawfulness of processing carried out before  withdrawal, and we will cease processing and erase the relevant data within a reasonable time  unless retention is required by law.

• Right to nominate: under Section 14 of the DPDP Act, you may nominate another individual to  exercise your rights on your behalf in the event of your death or incapacity. Contact us using the  details in Section XVIII to record a nomination. 

• Right to grievance redressal: raise a complaint with our Grievance Officer and, if you remain  dissatisfied, escalate it to the Data Protection Board of India. 

• Right to designate a Consent Manager: appoint a Consent Manager registered with the Board  to give, manage, review and withdraw your consents on your behalf. 

We will respond to requests under this Section within 90 days, and in practice we aim to respond  considerably sooner. 

XVII.b Rights under the EU and UK GDPR 

If you are in the European Economic Area or the United Kingdom, you have the following rights in  relation to your personal data, subject to the conditions and exemptions in the legislation: 

• Right to be informed receive clear information about how we use your personal data. • Right of access obtain a copy of your personal data and information about our processing. • Right to rectification request correction of inaccurate or incomplete data. 

• Right to erasure request deletion of your data where there is no lawful reason for us to continue  processing it (the "right to be forgotten"). 

• Right to restrict processing request that we limit our processing of your data in certain  circumstances. 

• Right to data portability receive your data in a structured, commonly used and machine-readable  format and transmit it to another controller. 

• Right to object object to processing based on our legitimate interests, and object at any time to  processing for direct marketing. 

• Right to withdraw consent where we rely on your consent, withdraw it at any time under Article  7(3). Withdrawal does not affect the lawfulness of processing carried out before withdrawal. 

• Rights in relation to automated decision-making you have the right not to be subject to a  decision based solely on automated processing, including profiling, that produces legal effects  concerning you or similarly significantly affects you. As set out in Section VI.9, we do not carry  out such decision-making. 

• Right to lodge a complaint complain to your local supervisory authority (see Section XVIII). 

We will respond to requests within one month, and may extend that period by up to two further months  where the request is complex or numerous, informing you of the extension and the reason for it within  the first month. We will not charge a fee unless a request is manifestly unfounded or excessive. 

XVII.c Rights under California’s CCPA/CPRA 

If you are a California resident, you have the following rights: 

• Right to know. Request that we disclose the categories or specific pieces of personal information  we have collected about you, the categories of sources, the business or commercial purposes for collection, the categories of third parties to whom we disclose it, and whether we disclose or sell  it. The disclosure covers the twelve months preceding your request, and you may request  information beyond that period unless doing so would be impossible or involve disproportionate  effort. Annexure A sets out this information for the preceding twelve months. 

• Right to delete. Request deletion of personal information we collected from you, subject to the  exceptions in the statute. 

• Right to correct. Request correction of inaccurate personal information. 

• Right to opt out of sale or sharing. Direct us not to sell or share your personal information. We  have not sold or shared personal information in the preceding twelve months and do not do  so. If this ever changes, we will provide a "Do Not Sell or Share My Personal Information" link  and will honour opt-out preference signals, including the Global Privacy Control. We do not sell  or share the personal information of consumers we know to be under 16 years of age. 

• Right to limit the use and disclosure of sensitive personal information. As explained in Section  VII, we do not use or disclose sensitive personal information for any purpose beyond those  permitted by § 7027(m), and so no "Limit the Use" link is required. 

• Right to non-discrimination. We will not deny you services, charge you a different price or  provide a different level of quality because you exercise your CCPA rights. 

• Notice at collection. You have the right to be informed, at or before the point of collection, of the  categories of personal information we collect, the purposes, and the retention period. This policy,  together with the short notices displayed at each point of collection, serves as that notice. Retention  periods are set out in Section XVI. 

We will confirm receipt of a request within 10 business days and respond to a verified request within  45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell  you why. You may use an authorised agent to submit a request, provided the agent produces written  permission signed by you; we may also ask you to verify your own identity with us directly and to  confirm that you gave the agent permission. 

XVII.d How to exercise your rights 

To submit a request to access, correct, delete or port your data, to object to or restrict processing, to  withdraw consent, or to record a nomination, please contact us  using the details in Section XVIII. Please specify which right you are exercising and provide enough  information for us to verify your identity. We will acknowledge your request promptly and respond  within the timeframes required by law. If we are unable to act on your request, we will tell you why. 

XVIII. Contact Information, Grievance Officer and Representatives 

XVIII.1 Grievance Officer and data protection contact (India) 

We have appointed a Grievance Officer to oversee compliance with this policy and to answer questions  about our processing of personal data. This is the contact point published under Rule 13 of the DPDP  Rules 2025. 

• Name: Shivam Krishnam

• Designation: Grievance Officer, Simulanis Solutions Limited. 

• Address: 260, Defence Colony Flyover Market, New Delhi 110024, India 

• Email: shivamkrishnam@simulanis.com 

We will acknowledge your grievance promptly and respond to it within 90 days, as required by Rule  14(3) of the DPDP Rules 2025. If you are not satisfied with our response, you may complain to the Data  Protection Board of India. 

XVIII.2 Consumer grievances relating to our online store 

Where your complaint relates to a purchase from our online store, the Consumer Protection (E Commerce) Rules 2020 apply in addition to the above. We will acknowledge such complaints within  48 hours of receipt and redress them within one month. Complaints of this kind may be sent to the  Grievance Officer named above, or to our Nodal Officer. 

XVIII.3 Supervisory authorities 

If you have concerns about how we handle your personal data, we encourage you to contact us first.  You also have the right to lodge a complaint with your data protection authority: 

• India: Data Protection Board of India. 

• EU: your national supervisory authority. 

• UK: the Information Commissioner’s Office (ICO). 

• California: the California Privacy Protection Agency (CPPA) or the Attorney General. 

XIX. Data Controller and Processor Roles 

Simulanis acts as a Data Fiduciary, Controller or Business when we determine the purposes and means  of processing, for example for our own marketing, analytics, order fulfilment or account administration.  We act as a Data Processor or Service Provider when we process personal data on behalf of a client, for  example when a company uses our platform to train its employees or a school deploys our learning  modules. 

When acting as a processor we process personal data only under the client’s documented instructions  and our contractual terms. Our data processing agreements incorporate the terms required by Article 28  of the GDPR and the service-provider terms required by the CCPA/CPRA, and impose equivalent  obligations on any sub-processor we engage. If you send us a rights request relating to data we process  on a client’s behalf, we will refer it to that client without undue delay and assist them in responding. 

XX. Third-Party Sites and Services 

Our Services may contain links to, or operate on, websites, products, devices or services operated by  third parties for example partner training platforms, payment gateways, app stores, social media and  XR hardware manufacturers. This policy does not apply to those third parties, and we are not  responsible for their privacy practices. We encourage you to review the privacy policy of any third 

party service or device before providing it with your personal data.

XXI. Changes to This Privacy Policy 

We may update this policy from time to time to reflect changes in our practices or in applicable law.  We will revise the effective date at the top of the policy and, where the change is material, provide  additional and conspicuous notice for example by email to registered users, or by a banner or pop-up in our apps and on our websites. For California residents, the Attorney General advises that businesses  should not rely solely on updating the policy but should give conspicuous notice of any material change,  and we follow that guidance. 

Where a change materially affects processing that we carry out on the basis of your consent, we  will obtain fresh consent before the change takes effect. For other changes, the revised policy applies  from its stated effective date, and we will give you advance notice of material changes so that you have  time to consider your options. 

We maintain an archive of previous versions of this policy, each marked with its effective date. You  may view the archive or request a copy from us. 

XXII. Publication and Accessibility 

We publish this policy prominently on every digital platform on which we collect personal data: 

1. Corporate website, online store and microsites: a link labelled "Privacy Policy" appears in the  footer of every page, and the policy is linked from the cookie banner, from the account registration  flow and from checkout. 

2. Notice at collection: a short notice appears at each form or point at which we collect personal  data, stating what we collect and why, and linking to this policy. 

3. Mobile and desktop apps: the policy is accessible from within app settings, during account  registration, and in the app store listing. 

4. XR applications and VR/AR devices: an abbreviated privacy notice appears during initial setup,  explaining microphone, sensor and spatial data collection and linking to the full policy. 

5. Third-party platforms: where our Services are offered through our LMS, a partner’s platform  or a hardware platform, we require the partner to display or link to this policy. 

6. Email communications: a link to this policy is included in our marketing emails and newsletters. 

Accessibility. We design this policy to be reasonably accessible to individuals with disabilities and aim  to conform to the Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA. If you need this  policy in an alternative format, please contact us at connect@simulanis.com and we will provide one. 

Language. This policy is published in English. Where we publish a translation, the English version  prevails in the event of any conflict.

Annexure A: California Disclosure of Personal Information Categories 

This Annexure sets out, for the twelve months preceding the effective date of this policy, the categories  of personal information we have collected, the sources, the business purposes and the categories of third  parties to whom we have disclosed it, as required by the CCPA/CPRA. Retention periods for each  category are set out in Section XVI.

Statutory category 

What we collect 

Business purpose 

Categories of recipients

A. Identifiers 

Name, email address,  telephone number,  

postal address, IP  

address, device  

identifier, account  

username

Account creation,  authentication,  

order fulfilment,  support, security

Hosting and cloud  

providers; payment  

processors; support and  communication tools;  

resellers

B. Customer  

records (Cal. Civ.  Code § 1798.80(e))

Billing address, partial  payment card details,  order history

Payment,  

invoicing, refunds,  tax compliance

Payment processors;  

accountants and auditors

C. Protected  

classification  

characteristics

Not collected

D. Commercial  

information

Purchase and  

subscription records,  licence entitlements,  products considered

Order processing  and account  

management

Payment processors;  

resellers; hosting providers

E. Biometric  

information

Not collected. We do  not derive voiceprints  or facial-geometry  

templates

F. Internet or other  network activity

Pages viewed, features  used, time spent, crash  reports, cookie and  

SDK data

Analytics,  

troubleshooting,  security, service  improvement

Analytics providers; hosting  providers

G. Geolocation data 

Approximate location  derived from IP address  only. We do not collect  precise geolocation

Security,  

localisation,  

regulatory  

compliance

Hosting and security  

providers

H. Sensory or audio  data

Voice and audio in  

real-time XR sessions.  Recordings only where  you opt in

Delivering voice  and collaboration  features

Real-time communications  provider only

Statutory category 

What we collect 

Business purpose 

Categories of recipients

I. Professional or  employment  

information

Job title, employer,  

role, training progress,  assessment scores,  

certifications

Delivering  

training and  

reporting  

completion to your  employer or  

institution

Your employer or  

institution; LMS providers

J. Non-public  

education  

information

Course records, where  we act on behalf of an  educational institution

Delivering  

training under the  institution’s  

instructions

The institution

K. Inferences 

Not created. We do not  build profiles or draw  inferences about your  characteristics,  

preferences or  

behaviour

Sensitive personal  information

Account log-in  

credentials only, stored  in hashed form

Solely to  

authenticate you  and secure your  account

Hosting and identity  

providers. Not used or  

disclosed for any purpose  beyond § 7027(m)

We have not sold or shared any category of personal information in the preceding twelve months,  and we have not sold or shared the personal information of consumers under 16 years of age.