PRIVACY POLICY

This Policy applies when:

• ●You visit any BrandMagics website or web application.
• ●You register for or use a BMeX ID or list on the BMeX Exchange.
• ●You use any Magics module (freemium or paid) or related APIs.
• ●You engage BrandMagics for advisory or capital-access services.

Depending on the context, BrandMagics may act as:

• ●Data controller for account, platform, marketing, and product-usage data.
• ●Data processor for customer-controlled data processed on behalf of brands using our tools (for example, contact data in Essential CRM, HR data in HireMagics, or documents in LexMagics).

Your agreements and data processing addendum (if any) prevail over this Policy in case of conflict.

We may share personal data with:

• ●Service providers and subprocessors who support hosting, infrastructure, analytics, customer support, communications, KYC/KYB, payments, and security operations, under appropriate contractual safeguards.
• ●Financial institutions, banks, fintech partners, and financing or capital partners, when necessary to provide financing, payments, or other capital-access products requested by you.
• ●Professional advisors (lawyers, auditors, consultants) where reasonably necessary for legitimate business purposes and compliance.
• ●Other users or counterparties, where you instruct us to do so (for example, sharing contracts via SignMagics, proposals via SalesMagics, or brand information via BMeX Exchange).
• ●Authorities, regulators, or law enforcement when we believe disclosure is required by law, regulation, or legal process, or to protect rights, security, and property.

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, or as required by law. Our specific retention periods include:

• ●Active Accounts: Retained for the duration of the subscription/service.
• ●Closed Accounts: Deleted 2 years after account closure to handle potential disputes.
• ●Financial/Tax Records: Retained for 7 years (or as required by local tax authorities) for audit and compliance purposes.
• ●Marketing Data: Deleted immediately upon withdrawal of consent.

When data is no longer required, we will delete or anonymize it.

We implement technical and organizational measures designed to protect personal data, including:

• ●Secure infrastructure, access controls, and encryption in transit (TLS 1.3) and at rest where appropriate.
• ●Role-based access and least-privilege principles within the BrandMagics ecosystem.
• ●Monitoring, logging, and incident-response procedures, along with regular reviews of security posture and system status.

However, no system is entirely secure, and we cannot guarantee absolute security of data transmissions or storage.

Depending on your jurisdiction, you may have some or all of the following rights:

• ●Access: Request confirmation whether we process your personal data and obtain a copy.
• ●Rectification: Request correction of inaccurate or incomplete personal data.
• ●Erasure: Request deletion of personal data, subject to legal and contractual limits.
• ●Restriction: Request limitation of processing in certain circumstances.
• ●Portability: Receive personal data in a structured, commonly used format and have it transmitted to another controller where technically feasible.
• ●Objection: Object to certain processing, including direct marketing, where permitted by law.
• ●Withdrawal of consent: Where processing is based on consent, withdraw your consent at any time.

You may exercise these rights by contacting us using the details in the “Contact us” section. We may need to verify your identity before fulfilling your request.

We use cookies and similar technologies to:

• ●Keep you signed in and maintain sessions.
• ●Remember preferences and configurations across BrandMagics modules.
• ●Analyze traffic, usage, and performance to improve our services.
• ●Support security and fraud prevention.

Prior Consent: We will not place non-essential cookies (such as analytics or marketing trackers) on your device until you have provided explicit consent via our Cookie Banner. You can manage your preferences at any time via the "Cookie Preferences" link on our website.

• ●General: Our services are intended for use by businesses and professionals.
• ●India Compliance (DPDP Act): For users in India, a "child" is defined as anyone under the age of 18. We do not knowingly collect personal data from Indian users under 18 without Verifiable Parental Consent. If you are under 18, you must not use the Platform without a parent or guardian authorizing your account via our Family Consent flow.
• ●If you believe that a child’s data has been provided to us in violation of applicable law, please contact us immediately so we can take appropriate action.