PRIVACY POLICY & DATA PROTECTION NOTICE Last Updated: January 20, 2026 Entity: Restofit.in (“Company”, “We”, “Us”, or “Our”)

1. LEGAL COMPLIANCE & ACCEPTANCE This Privacy Policy is an electronic record under the Information Technology Act, 2000 and the Digital Personal Data Protection Act (DPDPA), 2023. By accessing Restofit.in, creating an account, or purchasing a product, you provide your affirmative, unconditional, and itemized consent to the collection and processing of your personal data as described herein.

2. DATA WE COLLECT (THE "ITEMIZED LIST") In compliance with Section 5 of the DPDPA, we collect only the data necessary to provide our sleep solutions:

• Identity & Contact Data: Name, shipping/billing address, email, and phone number.
• Sleep Profile (Voluntary): To recommend the right mattress, we may collect data on your height, weight, gender, age, and sleeping preferences.
• Transaction Data: Details about payments to and from you and other details of products you have purchased.
• Technical Data: IP address, browser type, and device identifiers (collected via cookies) to prevent fraud.
• Sensitive Personal Data: We do NOT store your credit card/debit card PINs or CVV. These are processed via PCI-DSS compliant payment gateways.

3. HOW WE USE YOUR DATA We process your data for the following "Specified Purposes":

• Contract Fulfillment: Processing orders, shipping products, and managing the 100-night trial/warranty.
• Customer Communication: Sending order updates, invoices, and service alerts via WhatsApp, SMS, and Email.
• Marketing (Opt-in): Sending promotional offers and sleep research. You may withdraw consent for marketing at any time.
• Legal Obligation: Maintaining records for GST audits and tax compliance (minimum 8 years).

4. DATA DISCLOSURE & THIRD-PARTY SHARING To ensure no loopholes regarding data sharing, we disclose your data only to:

• E-commerce Platform: Shopify Inc., which hosts our store.
• Logistics Partners: We share your name, address, and phone number with 3rd-party couriers (e.g., Delhivery, BlueDart) to fulfill your delivery.
• Legal Requirement: If mandated by a court order or government agency under Indian law.

5. DATA SECURITY & THE "SHIELD" CLAUSE

• Limitation of Liability: While we take every precaution, Restofit.in shall not be liable for data breaches arising from factors beyond our control, including but not limited to vulnerabilities in third-party software (Shopify/Apps) or unauthorized access to your personal device.
• User Responsibility: You are responsible for maintaining the confidentiality of your account password.

6. YOUR RIGHTS (DPDPA RIGHTS) As a "Data Principal" in India, you have the following enforceable rights:

• Right to Access: Request a summary of your data being processed.
• Right to Correction & Erasure: Update inaccurate data or request deletion (subject to legal retention for tax/warranty).
• Right to Withdraw Consent: You may withdraw consent at any time.
• Right to Nominate: You may nominate an individual to exercise your rights in case of death or incapacity.

7. DATA RETENTION POLICY

• Warranty Data: Retained for up to 11 years to honor mattress warranties.
• Tax/Audit Data: Retained for 8 years as per the Companies Act and GST Act.

8. GRIEVANCE REDRESSAL MECHANISM If you have any concerns, you must contact our Grievance Officer:

• Name: Bikash Prasad
• Designation: Grievance Officer
• Email: admin@restofit.in
• Address: 10/1 Gangappa Farm, Kondashethalli, Shivkote Post, Hesarghatta Hobli, Near Gopalan National School, Bangalore, KA, 560089, India.
• Timeline: Acknowledgment within 24 hours; Resolution within 15 days.

9. JURISDICTION & DISPUTES This policy is governed by Indian Law. Any disputes arising shall be subject to the exclusive jurisdiction of the Courts in Bangalore, Karnataka.