SGNX Gold Privacy Notice

01

Scope and roles

This Notice explains how SGNX collects, uses, shares, stores and protects personal data when a person visits sgxmeta.ai, opens or uses an account, completes KYC, purchases physical gold, selects custody, requests delivery or buyback, receives support, or otherwise interacts with SGNX.

This Notice applies to personal data processed by SGNX in connection with its gold-only customer services, website, portal, customer support and related compliance operations. It does not govern an unrelated website, application or service merely because it links to SGNX.

SGNX acts as the person determining why and how customer personal data is processed for the activities described here. Vendors processing data only on SGNX instructions are required to use it for authorised purposes and apply appropriate safeguards.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have a phased commencement. SGNX applies this Notice as its stated privacy practice and will update it as legal requirements take effect or operations change.

02

Personal data we may collect

Identity and eligibility: Name, date of birth, photograph, signature, nationality, PAN, masked or permitted identity-document details, beneficial ownership and authority to act.
Contact and profile: Postal address, email, telephone number, language, account ID, communication preferences and profile details.
KYC, AML and risk: Identity-verification results, source-of-funds information, sanctions or fraud indicators, risk decisions and supporting records.
Payment and bank: Payment reference, amount, method, verified bank-account or UPI details, and refund or settlement details. The current SGNX Gold portal does not collect full payment-card credentials.
Gold transactions: Orders, quotations, invoices, purity, quantity, allocation or custody references, delivery instructions, buyback requests, charges, taxes and settlements.
Device and usage: IP address, device and browser information, timestamps, login and security events, cookie identifiers, portal activity and diagnostic logs.
Communications: Emails, support requests, complaint records, callback requests, notices and other communications with SGNX.

SGNX does not ask customers to provide account passwords or one-time passwords to support personnel. Customers should not send unnecessary sensitive documents or financial credentials through ordinary chat or email.

03

How we collect personal data

Directly from the customer, authorised representative or account user.
From identity-verification, KYC, fraud-prevention or compliance service providers used for an authorised check.
From banks, payment providers and verified settlement channels involved in a transaction.
From logistics, delivery, assay or custody-related service providers involved in a customer instruction.
Automatically from the website, portal, devices, cookies, logs and security systems.
From lawful public records, government systems or authorities where permitted and relevant to compliance.

04

Why we process personal data

For services requested by a customer, SGNX processes personal data based on consent or because the customer voluntarily provided it for that stated purpose. Separate processing may be permitted without consent where applicable law authorises it, including for legal compliance, fraud prevention, legal claims or investigation of unlawful activity. These grounds are applied only to the activity for which each ground is available.

Account and KYC: Create and administer accounts; verify identity, eligibility, beneficial ownership, bank details and source of funds.
Gold services: Quote and process physical-gold purchases; issue invoices; maintain allocation and custody records; arrange delivery; process buyback requests and settlements.
Security and fraud control: Authenticate users, protect accounts, detect suspicious activity, investigate discrepancies and maintain audit trails.
Legal and tax compliance: Meet accounting, GST, tax, AML, sanctions, court, regulatory, consumer-protection and record-keeping obligations.
Support and complaints: Respond to questions, callbacks, grievances, rights requests, disputes and service communications.
Service operation: Host, maintain, monitor, troubleshoot, improve and measure the website, portal and customer processes.
Marketing: Send promotional communications only where permitted and subject to the customer's consent or applicable preference and opt-out rules.

05

Consent and choices

Where consent is used, SGNX will seek a clear affirmative choice for the stated purpose and limit the request to data reasonably necessary for that purpose. Consent may be withdrawn through the relevant portal control or by emailing Support@sgxmeta.ai. Withdrawal does not invalidate earlier lawful processing and may prevent SGNX from continuing an optional service.

Consent is not required for processing that SGNX must continue under law or that is otherwise authorised without consent. SGNX may retain records needed for completed transactions, tax, fraud prevention, disputes, court orders or legal claims even after a customer closes an account or withdraws consent.

06

Cookies and similar technologies

SGNX may use cookies, local storage, pixels or similar technologies for account sessions, security, preferences, diagnostics, analytics and, where enabled, marketing. Strictly necessary technologies support core operation and security.

A customer may control cookies through the browser or device. Blocking necessary cookies can prevent login or other portal features from working correctly.

07

When personal data may be shared

SGNX does not sell customer personal data as a standalone product. Personal data may be disclosed only as reasonably necessary to the following categories of recipients:

KYC, identity-verification, AML, sanctions-screening and fraud-prevention providers.
Banks, payment processors and settlement providers participating in a transaction.
Gold sourcing, custody, storage, reconciliation, assay, logistics and delivery providers where needed for the customer service.
Cloud hosting, cybersecurity, communications, analytics, document, customer-support and other technology providers.
Professional advisers, accountants, auditors and insurers, if later engaged, under confidentiality duties.
Courts, regulators, law-enforcement, tax authorities or government bodies when disclosure is required or lawfully requested.
A genuine corporate transaction counterparty, subject to confidentiality and applicable legal safeguards.

SGNX remains responsible for selecting and overseeing processors as required by applicable law. A recipient acting independently for its own legal purposes may provide its own privacy notice.

08

Processing outside India

Some technology or service providers may process or make personal data accessible from locations outside India. SGNX will use such arrangements only where permitted and will apply contractual, access-control and security measures appropriate to the processing. Transfers remain subject to any country restrictions or other directions issued by the Government of India.

09

Retention and deletion

SGNX keeps personal data only for as long as reasonably necessary for the stated purpose, an active customer relationship, a completed transaction, custody or delivery obligations, security and fraud controls, grievance handling, or a legal, tax, accounting, AML, regulatory or evidentiary requirement.

KYC and compliance: For the period required by applicable KYC, AML, tax, regulatory and evidentiary rules, including any period measured after the relationship ends.
Transaction and custody: For the period needed to evidence title, allocation, custody, delivery, buyback, settlement, tax and customer claims.
Security logs: For a proportionate security and investigation period, extended where an incident or legal hold applies.
Support and grievances: Until the matter and reasonable follow-up or limitation period have ended.
Marketing preferences: Until consent is withdrawn or the customer opts out, while retaining a minimal suppression record where needed to honour that choice.

When retention is no longer justified, SGNX will delete, anonymise or securely isolate the data. Erasure may be refused or limited where continued retention is required by law or necessary for a legal claim, fraud investigation or unresolved transaction.

10

Security

SGNX uses reasonable technical and organisational safeguards appropriate to the nature and risk of the processing. Controls may include access restriction, authentication, encryption in transit, logging, backups, environment separation, vendor review, staff confidentiality, incident response and periodic testing.

No electronic system is completely secure. Customers should use a strong unique password, protect their device and OTPs, verify communications, and promptly report suspected account compromise to Support@sgxmeta.ai.

11

Personal-data breach response

SGNX will investigate suspected personal-data breaches, contain and remediate the incident, preserve relevant evidence and notify affected individuals and the competent authority when required by applicable law. A notice may describe the nature and likely consequences of the breach, measures taken, safety steps for the customer and a contact channel for questions.

12

Customer rights and requests

Subject to the law in force, verification of identity and permitted exceptions, a customer may request:

A summary of personal data being processed and relevant processing activities.
Correction of inaccurate or misleading data, completion of incomplete data and updating of changed data.
Erasure of personal data that is no longer necessary and is not required to be retained.
Withdrawal of consent where consent is the basis of processing.
Information about significant recipients or categories of recipients, where required.
Grievance redressal concerning SGNX processing practices.
Nomination of another individual to exercise applicable rights in the event of death or incapacity, when that statutory right applies.

Requests may be sent from the registered email address to Support@sgxmeta.ai and should state the customer name, account or order reference, the right requested and enough detail to locate the relevant records. SGNX may ask for proportionate identity verification.

13

Children

SGNX gold services are intended for adults who are legally competent to transact. SGNX does not knowingly open a customer account for a person under 18. If SGNX learns that a child's personal data was submitted without valid authority, it will restrict the account and take appropriate deletion or compliance steps. Any exceptional minor-related processing must follow applicable guardian-verification and child-protection requirements.

14

Automated checks and account holds

SGNX may use rules, matching or risk indicators to detect account compromise, sanctions concerns, fraud, duplicate identity, unusual payment or transaction patterns and custody discrepancies. A flag may lead to additional verification or a temporary hold. Customers may ask Support@sgxmeta.ai for human review of a disputed flag, subject to restrictions on disclosure of confidential fraud, security or legal controls.

15

Communications and marketing

SGNX may send service, transaction, security, legal and grievance communications needed to operate an account or complete a customer instruction. Promotional email, SMS, messaging or calls will be subject to applicable consent and preference requirements. A customer may use the unsubscribe mechanism or email Support@sgxmeta.ai to opt out of marketing; essential service or legal notices may continue.

16

Grievances and contact

A privacy grievance should include the customer name, registered contact detail, account or order reference, description of the issue, requested resolution and supporting information. SGNX may first verify identity. SGNX aims to acknowledge a grievance within 48 hours and resolve it within one month; if resolution takes longer, SGNX will communicate the reason and current action in writing. A shorter mandatory legal period will apply where required.

If the matter is not resolved, the customer may use the complaint route available before the Data Protection Board of India when the relevant statutory provisions apply, without limiting other mandatory remedies.

Desk: Telebeli Customer Support and Grievance Desk
Designation: Customer Support and Grievance Intake Desk
Email: Support@sgxmeta.ai
Callback: No public telephone number is listed. A customer may request a human callback by email or through the portal.
Postal correspondence: SGNX Gold Bullion Private Limited, principal place of business stated in the company information.

17

Updates to this Notice

SGNX may update this Notice to reflect changes in law, guidance, technology, vendors or services. The current version and effective date will be displayed on sgxmeta.ai. Material changes will be communicated through the portal, registered email or another effective channel before or when they take effect, as required.

18

Legal framework and interpretation

This Notice is intended to operate with applicable Indian privacy, information-technology, consumer, KYC, AML, tax and record-keeping law, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 according to their notified commencement timetable. If this Notice conflicts with a mandatory legal requirement, the mandatory requirement prevails.

Official references include the Digital Personal Data Protection Act, 2023 published by India Code and DPDP materials published by the Ministry of Electronics and Information Technology.