Privacy
Policy.

Thriving Billions Private Limited, trading as Dehurdle ("Dehurdle," "we," "us," or "our"), is committed to responsible privacy practices and to complying with applicable data protection laws across all jurisdictions in which we operate, including the Digital Personal Data Protection Act, 2023 (India), the General Data Protection Regulation (EU/EEA), and applicable US state privacy laws.

This Privacy Policy sets out our policies on the management of personal data — how we collect it, the purposes for which we use it, and to whom it is disclosed. As a Data Fiduciary under the DPDP Act and a Data Controller under the GDPR, Dehurdle is committed to processing your personal data lawfully, fairly, and transparently.

We may change our Privacy Policy from time to time at our discretion. At any time, the latest version of our Privacy Policy is available from our website (“Site”) at dehurdle.com/privacy.

In this Privacy Policy, "personal data" (also referred to as "personal information") means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (India) and the General Data Protection Regulation (EU). This includes information such as your name, address, telephone number, email address, IP address, device identifiers, or any other information that could directly or indirectly identify you.

The types of personal information Thriving collects from you depend on the circumstances in which the information is collected.

Thriving may collect contact details including your name, address, email address and phone numbers.

Where relevant, Thriving may also collect your date of birth or age group, occupation, gender, job title, organization, answers you provide to questions we ask, coaching session data, and other information in relation to your dealings with Thriving or our enterprise clients (such as assessment results, development goals, and coaching interaction history).

If you are an individual engaged with Thriving to provide services (directly or indirectly), Thriving may collect information relevant to your engagement with Thriving including qualifications, length of engagement, resume and salary, bank details, feedback from supervisors, training records and logs of your usage of Thriving equipment (e.g. phones and computers). If you are employed by or contracted to a Thriving enterprise client, we may also collect and maintain coaching and training records about you.

When using the Site, we or our third party service providers may collect the Site usage information such as the IP address you are using, the name of your Internet service provider, your browser version, the Site that referred you to us and the next Site you go to, the pages you request, the date and time of those requests and the country you are in. Except where you provide it to us via the Site, we do not collect personal information such as your name, mailing address, email address or phone number when you are browsing our Site.

Thriving does not generally require customers to disclose any sensitive data or information (e.g. details of race, religious beliefs, sexual orientation, health information etc.) to us.

If you do provide sensitive data or information to us for any reason (for example, if you provide us with information about a disability you have), you consent to us collecting that information and to us using and disclosing that information for the purpose for which you disclosed it to us and as permitted by the Information Technology Rules, 2011 and other relevant laws.

In addition to the types of personal information identified above, Thriving may collect personal information as otherwise permitted or required by law.

Thriving collects personal information in a number of ways. The most common ways we collect your personal information are:

• Directly from you when you provide it to us or our enterprise clients or agents or contractors.
• Via enterprise clients who subscribe to the Dehurdle platform on your behalf.
• Via our Site or when you deal with us online (including through social media).
• Via our market research agencies.
• When you enter a competition or promotion or marketing campaign.
• If you are an individual engaged with Thriving (directly or indirectly), from your employer or recruitment agency.
• If you are employed by or contracted to an enterprise client, from that client.
• From publicly available sources.
• From our group or related companies.
• From third parties (for example, from referees if you apply for a position as an employee or contractor with us).

Interest-Based Advertising: On some pages of this site we may allow third-party advertising partners to set web tracking and storage technology tools (e.g., cookies, web beacons, pixels) to collect or receive information regarding your activities on those web pages (e.g., your IP address, page(s) visited, time of day). These third parties may use this information (and combine it with information collected from other websites, apps or other digital services) for purposes of delivering future targeted advertisements to you when you interact with other (non-Thriving) sites, mobile apps or digital services, and to provide measurement services. This practice is commonly referred to as "Interest-Based advertising".

Opting out of Interest-Based Advertising: You may learn about how to opt-out of this kind of collection and use of information for your browser or device by managing your settings, and for your social media accounts by managing your preferences in your account settings.

Opting out from Specific Advertisers: Meta (Facebook/Instagram): To learn more about how to opt out of Meta Interest-Based Advertising, go to the Privacy tab on the Meta website footer, and then select Ad Preferences.

The purposes for which we use and disclose your personal information will depend on the circumstances in which we collect it. Whenever practical we endeavor to inform you why we are collecting your personal information, how we intend to use that information and to whom we intend to disclose it at the time we collect your personal information.

We may use or disclose your personal information:

• For the purposes for which we collected it (and related purposes which would be reasonably expected by you).
• For other purposes to which you have consented.
• As otherwise authorized or required by law.

In general we collect, use and disclose your personal information so that we can do business together and for purposes connected with our business operations.

Some of the specific purposes for which we collect, use and disclose personal information are as follows:

• To facilitate your request for a demo or trial, to add you to a mailing list or to respond if you request information (including via the Site or via an email you send to us).
• To record and maintain the details of your subscription to the Dehurdle platform for administration purposes.
• To facilitate the provision of coaching services and other services you acquire from us or our agents or contractors.
• To inform you in the event of important platform updates or changes affecting your usage.
• To improve our products and services.
• To contact you (directly or through our service providers and marketing research agencies) to obtain your feedback and to find out your level of satisfaction with our products and services through surveys.
• To verify your identity.
• To facilitate your entry and participation in a competition or campaign or trade promotion.
• To consider you for a job at Thriving (whether as an employee or contractor) or other relationships with us.
• To provide goods or services to you or to receive goods or services from you.
• To address any issues or complaints that we or you have regarding our relationship.
• To contact you regarding the above, including via electronic messaging such as SMS and email, by mail, by phone or in any other lawful manner.
• We may also use and disclose your personal information for the purpose of direct marketing to you where you have consented to us doing so; or it is otherwise permitted by law.

Direct marketing involves communicating directly with you for the purpose of promoting goods or services to you and to provide you with special offers from Thriving. Direct marketing can be delivered by a range of methods including mail, telephone, email or SMS. You can unsubscribe from our direct marketing, or change your contact preferences, by contacting us (see section 16 of this Privacy Policy).

Generally, you have no obligation to provide any personal information requested by us. However, if you choose to withhold requested personal information, we may not be able to provide you with the products and services that depend on the collection of that information. As an example, if you did not provide your email address, we would be unable to notify you of important platform updates, security alerts, or changes to your coaching program.

We may disclose your personal information to third parties in connection with the purposes described in this Privacy Policy. This may include disclosing your personal information to the following types of third parties:

• Enterprise clients who subscribe to the Dehurdle platform.
• Our group or related companies.
• Our contractors or service providers (including mailing houses, marketing agencies, insurance providers, site and data hosting providers and other IT suppliers).
• Other persons who perform services for, or in connection with, us (including for electronic direct mailing, for credit card payment authorization, for trend analysis, for market research, for promotions and for the provision of statistical information to industry bodies).
• Companies who may use your personal information in order to tailor electronic advertising to you in relation to our products and services.
• Our accountants, insurers, lawyers, auditors and other professional advisers.
• If you are an individual engaged with Thriving (directly or indirectly), to your employer or agency in relation to the performance of your work with Thriving.
• If you are a prospective employee, to our medical service providers for any medical assessments or in relation to any health or safety incidents and to HR related service providers (e.g. for background checks, screening or aptitude testing).
• Any third parties to whom you have directed or permitted us to disclose your personal information.
• Statistical information shared with industry bodies. This may comprise data collected about you and other customers to form aggregate results but we will not provide any information that identifies you individually.
• Third parties that require the information for law enforcement or to prevent a serious threat to public safety.
• Otherwise as permitted or required by law.

If you post information to certain public parts of our Site or to our social media pages, you acknowledge that such information may be available to be viewed by the public. You should use discretion in deciding what information you upload to such sites.

Dehurdle offers regional data residency to meet compliance requirements across jurisdictions. Persistent user data — including databases, object storage, authentication, and caching — resides within the customer's designated region:

• European Union: Frankfurt, Germany (eu-west-1). For European clients, all persistent data remains within the EU.
• Asia-Pacific: Mumbai, India (ap-south-1).

Some of the third parties to whom we disclose personal data may be located outside your designated region. For example, certain AI processing services operate transiently through providers in the United States. All such processing is transient — no data is stored, retained, or used for model training by these providers. This is contractually guaranteed under applicable Data Processing Addenda.

EEA/UK Transfers: Where we transfer personal data outside the European Economic Area or United Kingdom, we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs) approved by the European Commission (Module 2: Controller-to-Processor), supplemented by technical measures including encryption and access controls.

India Transfers: Cross-border transfers from India are conducted in compliance with the Digital Personal Data Protection Act, 2023, including applicable transfer controls and contractual safeguards.

For a full list of our subprocessors and their locations, please visit our Subprocessors page. For further information regarding data transfers, you may email us at reach@dehurdle.com.

Thriving will take reasonable steps to keep any personal information we hold about you secure. However, except to the extent liability cannot be excluded due to the operation of statute, we exclude all liability (including in negligence) for the consequences of any unauthorized access to, disclosure of, misuse of or loss or corruption of your personal information. Nothing in this Privacy Policy restricts, excludes or modifies or purports to restrict, exclude or modify any statutory consumer rights under any applicable law. Please notify us immediately if you become aware of any breach of security.

Your personal information will not be “sold” by Thriving to any other organization for that organization's unrelated independent use. Further, we will not share your personal information with any organizations, other than those engaged by us to assist us in the provision of our products and services (as described above).

We endeavor to ensure that our employees are aware of, and comply with their obligations in relation to the handling of personal information. Only properly authorized employees are permitted to see or use personal information held by Thriving and, even then, only to the extent that it is relevant to their roles and responsibilities.

If you submit a job application to Thriving, we will use the information provided by you to assess your application. Thriving may disclose the information contained in your application to contracted service providers for purposes such as screening, aptitude testing, medical testing and human resources management activities.

Thriving will handle health information in accordance with applicable laws.

Internet users may decide to send Thriving personally identifying information, for example, in a message containing information about your Thriving product or service. Thriving will only use this information to identify the user as a Thriving customer and to determine how to respond to the electronic mail. We will not use this information other than to resolve the matter identified in the email.

We endeavor to maintain your personal information as accurately as reasonably possible. However, we rely on the accuracy of personal information as provided to us both directly (from you) and indirectly (e.g. from an enterprise client or authorized partner).

We encourage you to contact us if the personal information we hold about you is incorrect or to notify us of a change in your personal information. Our contact details are set out in this Privacy Policy.

When using the Site, we or our third party service providers may collect Site usage information such as the IP address you are using, the name of your Internet service provider, your browser version, the Site that referred you to us and the next Site you go to, the pages you request, the date and time of those requests and the country you are in. Except where you provide it to us via the Site, we do not collect personal information such as your name, mailing address, email address or phone number when you are browsing our Site.

Thriving and its third-party service providers use cookies, pixel tags, and similar technologies on the Site. The specific tracking technologies we use include:

You can manage your cookie preferences through your browser settings. Disabling cookies may affect the functionality of certain parts of the Site. For more details, please see our Cookie Policy

You may seek access to personal information which Thriving holds about you by contacting us. We will provide access to that information in accordance with the applicable laws, subject to certain exemptions which may apply. We may require that the person requesting access provide suitable identification and where permitted by law we may charge an administration fee for granting access to your personal information.

If you become aware that any personal information we hold about you is incorrect or if you wish to update your information, please contact Thriving.

If you have any questions, concerns or complaints about our collection, use or disclosure of personal information, or if you believe that we have not complied with this Privacy Policy, please contact us.

When contacting us please provide as much detail as possible in relation to your question, concern or complaint.

Thriving will take any privacy complaint seriously and any complaint will be assessed by an appropriate person with the aim of resolving any issue in a timely and efficient manner. We request that you cooperate with us during this process and provide us with any relevant information that we may need.

You have the right to:

• Access your personal data
• Correct inaccurate or outdated information
• Erase data when no longer necessary or upon withdrawal with consent
• Nominate another person in the event of incapacity
• Grievance Redressal in case of misuse or violation

If you use Dehurdle through an enterprise subscription provided by your employer, the following principles govern how your data is handled:

• Coaching Conversation Privacy: Your individual coaching conversations with the AI coach are strictly confidential. Your employer cannot access, view, or retrieve the content of your individual coaching sessions. This privacy is a foundational design principle of the platform and cannot be overridden by enterprise administrators.
• Aggregated Insights Only: Enterprise clients may receive anonymized, aggregated organizational insights (such as team-level engagement trends or capability heatmaps). These insights are derived from de-identified, statistical data and cannot be used to identify individual employees or their coaching content.
• Data Ownership: You retain ownership of your personal data and coaching interactions. Your employer acts as the data controller for the purposes of platform provisioning, while Dehurdle acts as the data processor. The content of your coaching sessions belongs to you.

Dehurdle retains your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy:

• Active Accounts: Your personal data is retained for the duration of your active account or the applicable enterprise subscription period.
• Account Deletion: Upon account deletion (whether initiated by you, your employer, or Dehurdle), all personal data associated with your account is permanently deleted within 30 days.
• Anonymized Data: After deletion, certain data may be retained in fully anonymized and aggregated form for the purposes of improving the platform and generating organizational benchmarks. This anonymized data cannot be linked back to any individual.
• Legal Obligations: Where required by law or regulation, we may retain certain records beyond the 30-day deletion period (for example, financial transaction records required for tax compliance).

To request deletion of your data, please contact us at reach@dehurdle.com.

Dehurdle uses artificial intelligence (AI) and machine learning to provide personalized coaching, behavioral insights, and developmental recommendations. We are committed to transparency about how AI processes your data:

• Transient Processing: All AI API calls are transient processing only. Your coaching conversations and behavioral data are processed in real-time to generate responses but are not stored by third-party AI providers, retained in their systems, or used to train any AI model.
• Zero-Payload Architecture: Dehurdle's privacy architecture analyzes structural workflow patterns — such as interaction timing, cross-platform communication density, context-switching frequency, and collaboration cadence — without ever reading, recording, or transmitting the actual content of your private communications. The lawful basis for this processing is our legitimate interest in providing effective coaching services (GDPR Art. 6(1)(f)) or the performance of the contract between your employer and Dehurdle (GDPR Art. 6(1)(b)). We have conducted a Legitimate Interest Assessment confirming that these interests are not overridden by your rights and freedoms, given the non-invasive, metadata-only nature of this processing.
• No Model Training: Your personal data is never used to train, fine-tune, or improve any third-party or proprietary AI models.
• Anonymized Usage Analytics: Dehurdle collects anonymized, aggregated tool usage patterns (such as feature engagement and session frequency) to improve the platform. This data cannot be used to identify any individual user.
• Automated Decision-Making: Dehurdle uses automated processing to generate coaching recommendations and behavioral insights. These outputs are advisory in nature and do not result in legal or similarly significant decisions being made about you without human involvement. Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. If you wish to object to automated processing, you may contact us at reach@dehurdle.com.
• EU AI Act Compliance: Dehurdle's AI subsystems are classified under the EU AI Act risk framework, with appropriate safeguards applied per risk tier. High-risk components include mandatory human-in-the-loop escalation protocols. For full details, see our Trust Center.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply to you under the General Data Protection Regulation (GDPR):

Legal Bases for Processing: We process your personal data based on one or more of the following legal bases under GDPR Article 6: (a) your consent (Art. 6(1)(a)); (b) the performance of a contract with you or your employer (Art. 6(1)(b)); (c) compliance with a legal obligation (Art. 6(1)(c)); or (d) our legitimate interests, provided such interests are not overridden by your rights and freedoms (Art. 6(1)(f)). For workflow telemetry and behavioral metadata processing, we rely on legitimate interests and/or contract performance — see the "AI and Automated Processing" section above for details.

Your Rights: In addition to the rights described elsewhere in this Privacy Policy, you have the following rights under the GDPR:

• Request access to the personal data we hold about you (Art. 15)
• Request rectification of inaccurate personal data (Art. 16)
• Request erasure of your personal data — "right to be forgotten" (Art. 17)
• Request restriction of processing of your personal data (Art. 18)
• Request data portability in a structured, commonly used, machine-readable format (Art. 20)
• Object to processing of your personal data, including profiling (Art. 21)
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you (Art. 22)
• Withdraw consent at any time, where processing is based on consent (Art. 7(3))
• Lodge a complaint with your local supervisory authority (Art. 77)

Cross-Border Transfers: Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs) approved by the European Commission (Module 2: Controller-to-Processor), supplemented by technical measures including encryption and access controls. A copy of the applicable SCCs is available upon request.

If you are located in the United States, specifically in California, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale or sharing of personal information. Dehurdle does not sell personal information. To exercise these rights, please contact us at reach@dehurdle.com.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Dehurdle will:

• Notify the relevant supervisory authority or Data Protection Board within 72 hours of becoming aware of the breach, as required under applicable law.
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• Notify enterprise clients in accordance with the terms of the applicable Data Processing Agreement.
• Document the breach, its effects, and the remedial actions taken.

In accordance with the Digital Personal Data Protection Act, 2023, Thriving Billions Private Limited has designated a Grievance Officer to address any concerns or complaints regarding the processing of personal data. For any privacy-related inquiries, data subject access requests, or complaints, please contact:

• Grievance Officer: Vishal Verma
• Email: vishal.verma@dehurdle.com
• Response Time: We will acknowledge your request within 48 hours and endeavor to resolve it within 30 days.

If you wish to seek access to or correct or update any personal information we hold about you, or to unsubscribe from or change your contact preferences in relation to our direct marketing, you can also contact us as follows:

• Phoning the Thriving Customer Relationship Centre on +91 99716 29973
• Emailing us at reach@dehurdle.com
• Writing to us at: Thriving Billions Private Limited, Tower C, Apartment No 802 Ireo Uptown, Sector 66, Haryana, Gurgaon 122018 India.