Lotus365 Privacy Policy

Scope of This Privacy Policy

This Privacy Policy concerns personal information processed in connection with the Lotus365 website, digital services, communications, and other interactions with the relevant platform operator.

It does not automatically apply to external websites, applications, payment services, or other third-party platforms accessible through links. Those services may have their own privacy policies and data-handling practices.

Users should review the relevant policies before sharing personal information with an external service.

Information We May Collect

The information collected may depend on how users interact with the website and which services are available.

Personal and contact information: Information provided directly by users may include their name, email address, telephone number, date of birth, and other contact details.

Account information: Where account features are available, information may include usernames, account preferences, authentication details, and records associated with account activity.

Identity and eligibility information: Where legally required and applicable to a service, additional information may be requested to verify identity, age, or eligibility.

Technical information: When users access a website, technical information may be collected, such as IP address, browser type, device information, operating system, language settings, session data, and website usage records.

Communication records: Messages sent through available support channels may be processed to respond to enquiries, investigate reported issues, and maintain appropriate service records.

Transaction-related information: Where transaction functionality is lawfully available, relevant records may be processed for reconciliation, account administration, security, or legal compliance. Payment details may be handled by third-party payment providers, depending on the service.

The exact information collected depends on the features used and the practices of the relevant website operator.

How Personal Information May Be Used

Personal information may be processed for specific operational, administrative, security, and legal purposes, subject to applicable law.

Potential purposes include:

• Managing account-related requests and available services.
• Responding to questions and customer support enquiries.
• Maintaining website functionality and improving usability.
• Protecting accounts and systems against unauthorised access or misuse.
• Identifying suspicious activity and investigating security incidents.
• Maintaining necessary service and transaction records.
• Meeting applicable legal, regulatory, and record-keeping obligations.
• Understanding website performance through permitted analytics.
• Sending relevant service communications where appropriate.

Personal information should not be used for purposes that lack an appropriate legal basis. Where consent is required, it should be obtained in accordance with applicable requirements.

Cookies and Similar Technologies

The website may use cookies or similar technologies to support technical functionality, remember preferences, maintain sessions, improve performance, or understand how users interact with its pages.

Some technologies may be necessary for website operation, while others may support analytics or personalisation.

Users can generally manage cookies through their browser settings. Restricting certain cookies may affect the functionality of some website features.

Where applicable law requires consent for non-essential cookies or similar technologies, the relevant consent requirements should be followed.

How Information May Be Shared

Personal information should only be shared where there is an appropriate operational need, lawful basis, or legal requirement.

Depending on the services involved, information may be shared with:

• Technology, hosting, and website maintenance providers.
• Security and fraud-prevention service providers.
• Customer support or administrative service providers.
• Payment or identity-verification providers, where applicable.
• Professional advisers assisting with legitimate business matters.
• Regulators, courts, or law-enforcement authorities where disclosure is legally required.
• Relevant parties involved in a business transfer or corporate restructuring, subject to applicable legal requirements.

Third-party service providers should handle information in accordance with their authorised responsibilities and the relevant contractual and legal safeguards.

This policy does not establish that every listed category of provider is used by Lotus365.

International Data Processing

Digital services may involve infrastructure and service providers located in different countries. As a result, personal information may be processed or stored outside the country from which a user accesses the website, where this is applicable to the relevant operator's arrangements.

Any international transfer of personal data should comply with applicable legal requirements and relevant safeguards.

Users seeking details about the actual locations in which their information is processed should consult the current privacy disclosures of the responsible website operator.

Data Retention

Personal information should be retained only for as long as necessary for the purpose for which it was collected or for another purpose permitted by law.

Retention periods may depend on the nature of the information, account activity, security requirements, legal obligations, and the need to resolve disputes or investigate suspected misuse.

Where information is no longer required, it may be deleted, anonymised, or otherwise handled in accordance with applicable retention requirements.

Specific retention periods should be confirmed through the relevant operator's official privacy disclosures.

Data Security

Protecting personal information is an important consideration in online services.

Appropriate technical and organisational measures may include access restrictions, authentication controls, system monitoring, security procedures, and measures designed to reduce the risk of unauthorised access, alteration, loss, or disclosure.

However, no internet transmission or electronic storage system can guarantee absolute security.

Users should protect their passwords, avoid sharing verification codes, use secure devices, and be cautious of suspicious messages or links. If account access appears to have been compromised, users should contact the relevant official support channel where available.

Your Privacy Rights

Privacy rights depend on the laws applicable to the user and the status of relevant legal provisions.

Depending on those requirements, individuals may be entitled to:

• Request information about the processing of their personal data.
• Seek correction or updating of inaccurate information.
• Request erasure of personal data where legally available.
• Withdraw consent where processing relies on consent.
• Raise a complaint or grievance about personal data handling.
• Exercise other rights provided under applicable data protection law.

These rights may be subject to lawful limitations, including requirements to retain information for legal compliance, security, dispute resolution, or other permitted purposes.

Privacy requests should be directed to the verified privacy contact or official support channel of the responsible website operator. Additional information may be required to confirm the identity of the requester.

Privacy and Data Protection in India

Users in India should consider the applicable Indian data protection and information technology laws when reviewing online privacy practices.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 form part of India's framework for digital personal data protection. Their applicability depends on the relevant provisions, implementation timeline, and circumstances of processing.

The responsible website operator should review its data-handling practices against the legal requirements applicable to its activities and users.

Nothing in this policy is intended to remove or restrict rights that cannot lawfully be excluded under applicable legislation. Users should consult current official government publications for the latest legal and implementation information.

Children and Age Restrictions

The website should only be used by individuals who meet the applicable age and eligibility requirements for the relevant service.

Personal information relating to children must be handled in accordance with applicable legal requirements. Where required, appropriate safeguards and restrictions should be implemented to prevent unauthorised access or processing.

If information relating to an ineligible user is identified, the responsible operator should assess the situation and take appropriate action in accordance with applicable law.

Third-Party Websites and Services

The website may contain links to third-party websites, applications, or services. These external services may collect and process information under their own policies.

The responsible Lotus365 website operator may not control the privacy practices of independent third parties. Users should review an external service's privacy policy and terms before providing personal or financial information.

The presence of a link does not necessarily indicate that the linked service is operated, controlled, or endorsed by Lotus365.

Changes to This Privacy Policy

This Privacy Policy may be revised to reflect changes in website functionality, data-handling practices, service arrangements, security measures, or applicable law.

When a revised policy is published, the updated version should include an appropriate revision date. Additional notice may be provided where required by applicable law.

Users are encouraged to review this page periodically to remain informed about the privacy information available from the relevant website operator.

Contact Us

Questions or concerns about this Privacy Policy or the handling of personal information should be directed to the verified contact or privacy channel published by the responsible Lotus365 website operator.

Requests should include enough information to identify the issue without unnecessarily disclosing sensitive personal data. Additional verification may be necessary before a request involving account information can be processed.

Please consult the current website contact details for the appropriate communication channel.