Data Protection Policy

1. Purpose

This Data Protection Policy establishes the principles, responsibilities, and procedures governing the collection, use, storage, sharing, retention, and deletion of personal data and research information handled by NxtMarketIntel.com.

Its purpose is to protect research participants, consumers, business contacts, clients, employees, contractors, and other individuals whose information may be processed through the organisation’s activities.

2. Scope

This policy applies to:

• NxtMarketIntel.com and its market research and consumer intelligence operations.
• Relevant operations of NXT Global Ventures.
• Employees, contractors, consultants, field researchers, survey operators, and authorised service providers.
• Consumer panels, business panels, surveys, interviews, focus groups, product testing, and research projects.
• Client information, business contact details, research datasets, and internal operational records.
• Websites, applications, databases, cloud services, analytics systems, and AI-enabled tools used for business operations.

All covered personnel must follow this policy when handling information on behalf of the organisation.

3. Definitions

Personal Data: Information relating to an identified or identifiable individual.

Data Principal or Data Subject: An individual to whom personal data relates, as recognised under applicable law.

Research Data: Information collected or generated through surveys, interviews, observations, experiments, market studies, and related research activities.

Confidential Information: Information requiring protection because of its nature, contractual obligations, or the consequences of unauthorised disclosure.

Data Processing: Any operation performed on personal data, including collection, recording, storage, use, disclosure, modification, or deletion.

Data Breach: A security incident involving unauthorised access, disclosure, alteration, loss, destruction, or compromise of information.

Anonymised Data: Data processed so that individuals are not reasonably identifiable using means reasonably likely to be available.

Pseudonymised Data: Data in which direct identifiers are replaced or separated, but identification remains possible using additional information.

4. Data Protection Principles

NxtMarketIntel.com will follow these principles:

1. Lawfulness: Process information only where a valid legal basis or applicable permission exists.
2. Purpose limitation: Collect and use information for specified and legitimate purposes.
3. Data minimisation: Collect only information reasonably necessary for those purposes.
4. Accuracy: Take reasonable steps to keep information accurate and relevant.
5. Storage limitation: Retain information only as long as reasonably necessary or legally required.
6. Security: Apply appropriate technical and organisational safeguards.
7. Confidentiality: Restrict information access to authorised personnel.
8. Transparency: Explain relevant data practices through appropriate notices.
9. Accountability: Maintain appropriate procedures and records.
10. Individual rights: Handle valid requests in accordance with applicable law.

5. Categories of Information

Depending on the services and projects involved, the organisation may process the following categories.

5.1 Research Participant Information

• Contact details and communication preferences.
• General demographic information, such as age range, occupation, and relevant location.
• Eligibility and screening responses.
• Survey answers, interview responses, opinions, and feedback.
• Product-testing results and participation history.
• Reward eligibility and payment records, where applicable.

5.2 Client and Business Information

• Business names and professional contact details.
• Research briefs, objectives, project instructions, and budgets.
• Product, pricing, customer, sales, and market information supplied by clients.
• Reports, presentations, datasets, and correspondence.
• Contractual, invoicing, and payment records.

5.3 Technical and Operational Information

• Website and application usage records.
• Device, browser, diagnostic, and security information, where collected.
• Access logs and system activity.
• Cookies and similar technologies, subject to applicable requirements.

5.4 Sensitive Information

The organisation will avoid collecting highly sensitive personal information unless it is genuinely necessary, appropriately authorised, adequately protected, and permitted by applicable law. Additional safeguards will be implemented where required.

6. Data Collection and Project Approval

Information may be collected directly from individuals, through surveys and interviews, from clients, through authorised research partners, or from lawful public and licensed sources.

Before a research project begins, the responsible team should establish:

• The purpose and objectives of the project.
• The categories of information required.
• The participant recruitment and data collection methods.
• The appropriate privacy notice, consent process, or other lawful basis.
• The intended recipients and reporting format.
• Security measures and retention requirements.
• Applicable contractual, legal, and ethical restrictions.

Projects involving sensitive information, vulnerable participants, extensive profiling, or significant privacy risks must receive appropriate management review before collection begins.

7. Consent, Notices, and Individual Choice

Where consent is required, it must be obtained through an appropriate and understandable process before the relevant processing begins.

Participants should be informed about the purpose of the research, the nature of participation, relevant data uses, and any applicable incentives or withdrawal conditions.

Consent records should be maintained where appropriate.

Where applicable law provides a right to withdraw consent, requests will be handled through an appropriate process. Withdrawal does not automatically invalidate processing that lawfully occurred before withdrawal. Some records may also need to be retained for legal or legitimate operational reasons.

Research participation must not be presented as mandatory when it is voluntary.

8. Access Control and Authorisation

Access to information will be granted according to business need and assigned responsibilities.

The organisation should implement:

• Individual user accounts wherever practicable.
• Role-based access permissions.
• Strong authentication and appropriate password controls.
• Multi-factor authentication for important systems where supported and appropriate.
• Prompt access removal when personnel leave or change roles.
• Periodic access reviews.
• Restrictions on downloading, exporting, printing, or sharing confidential datasets.

Shared credentials should be avoided. Administrative privileges must be limited to authorised personnel.

9. Technical and Organisational Security

Security measures will be selected according to the nature of the information, the risks involved, and the systems used.

Appropriate measures may include:

• Encryption in transit and, where appropriate, at rest.
• Secure hosting and database configuration.
• Firewalls, access monitoring, and vulnerability management.
• Secure software development and testing practices.
• Backup, recovery, and business continuity arrangements.
• Protection against malware, phishing, and unauthorised access.
• Secure file transfer procedures.
• Separation of production, testing, and development data where practicable.
• Secure disposal of physical documents and storage media.
• Logging and investigation of suspicious activity.

Security controls must be reviewed as systems, threats, and operational requirements change.

10. Research Participant Protection

All research activities must be conducted responsibly and without misleading participants.

Research teams must:

• Explain the purpose and expected nature of participation.
• Avoid collecting unnecessary personal information.
• Respect applicable consent and withdrawal requirements.
• Avoid coercive, deceptive, or unfair recruitment practices.
• Apply appropriate safeguards when working with minors or vulnerable participants.
• Avoid publishing information that could unnecessarily identify participants.
• Escalate complaints, suspected misconduct, and privacy concerns.
• Communicate incentive conditions accurately.

Audio recordings, photographs, video recordings, and identifiable quotations require appropriate authorisation and safeguards.

11. Anonymisation, Pseudonymisation, and Reporting

Where practical, reports and client deliverables should use aggregated, anonymised, or pseudonymised information.

Direct identifiers should be removed from analytical datasets when they are not necessary for the research purpose.

Pseudonymised information must continue to be protected as personal data where an individual remains identifiable using additional information or reasonably available means.

Before sharing findings, the responsible team should consider whether small sample sizes, distinctive responses, specific locations, quotations, or combinations of attributes could reveal an individual’s identity.

Anonymisation must not be claimed unless the process reasonably supports that conclusion.

12. Survey and Fieldwork Security

Field researchers, survey operators, interviewers, and recruitment partners must use approved methods and systems.

They must not:

• Share participant lists with unauthorised persons.
• Store research records on unapproved personal devices or accounts.
• Copy or export records without authorisation.
• Use participant information for personal marketing or unrelated purposes.
• Fabricate responses or improperly alter research results.
• Make unapproved promises about confidentiality, anonymity, or incentives.

Completed questionnaires, recordings, field notes, and participant contact lists must be transferred and stored securely.

13. Client Data and Confidentiality

Client information must be used only for authorised business and research purposes.

The organisation will take reasonable steps to protect confidential briefs, commercial information, customer datasets, product plans, pricing information, and unpublished research findings.

Client information must not be disclosed to other clients or used in unrelated projects without appropriate authorisation or another lawful basis.

Where a client supplies personal data, the parties should document their respective responsibilities, permitted uses, security obligations, retention requirements, and procedures for handling individual requests.

Client instructions must not be followed where they would require unlawful processing.

14. Artificial Intelligence and Automated Tools

AI-enabled systems may be used for permitted purposes such as research analysis, summarisation, categorisation, trend identification, report drafting, and operational assistance.

Before confidential or personal information is entered into an AI system, the responsible team must verify that the tool is approved for that data category and has appropriate terms and security arrangements.

The organisation should:

• Minimise or anonymise information before submitting it to AI tools where practicable.
• Avoid entering confidential client or participant information into unapproved public AI services.
• Review AI-generated findings for accuracy and misleading conclusions.
• Avoid fabricating survey responses, citations, or research results.
• Apply human review to consequential outputs where appropriate.
• Assess applicable restrictions on profiling and automated decisions.

AI-generated findings must not be presented as verified facts without suitable validation.

15. Vendors, Contractors, and Third Parties

Third parties processing information on behalf of the organisation must be assessed according to the nature and risks of the engagement.

Where appropriate, written agreements should address:

• Permitted processing purposes.
• Confidentiality obligations.
• Security requirements.
• Restrictions on further subcontracting.
• Incident notification and cooperation.
• Assistance with individual requests.
• Retention, return, and deletion of information.
• Audit or assurance requirements where appropriate.

Third-party access must be limited to the information required for the service and revoked when no longer necessary.

16. Data Sharing and International Transfers

Information may be shared with authorised clients, research partners, service providers, technology providers, payment providers, professional advisers, or public authorities where permitted and necessary.

Before sharing information, the responsible team should verify the recipient, purpose, permitted scope, security arrangements, and applicable contractual or legal requirements.

International transfers must comply with applicable Indian law and any other relevant legal requirements, including restrictions or conditions applicable to the data or destination.

Publicly available information must not automatically be treated as unrestricted for every use.

17. Data Retention, Archiving, and Deletion

Information must not be retained indefinitely without a legitimate reason.

Each major information category should have an appropriate retention period or documented retention criteria, considering legal obligations, contractual commitments, research requirements, security needs, and dispute resolution.

When information is no longer required, the responsible team should arrange for secure deletion, anonymisation, or other appropriate disposal.

Retention procedures should address:

• Participant contact lists.
• Screening and survey records.
• Interview recordings and transcripts.
• Client datasets and project files.
• Research reports and working documents.
• User accounts and access credentials.
• Local downloads, removable media, and paper records.

Backup copies may remain until overwritten or securely removed through the applicable backup lifecycle. Such information must remain protected during that period.

Records subject to a legal hold, regulatory requirement, or legitimate dispute must not be deleted until the restriction is resolved.

18. Privacy Requests and Individual Rights

Requests concerning personal information may be submitted to info@nxtglobalventures.com.

Depending on applicable law and the circumstances, individuals may have rights to request access, correction, completion, updating, erasure, withdrawal of consent, grievance redressal, or other remedies.

The organisation will:

1. Record and acknowledge requests as appropriate.
2. Verify the requester’s identity proportionately.
3. Determine whether the request falls within applicable legal rights.
4. Refer it to the appropriate responsible function.
5. Respond within the applicable legal timeframe.
6. Document the decision and any lawful reason for limitation or refusal.

Information must not be disclosed to an unverified requester. Requests must not be rejected solely because they are inconvenient.

19. Participant Rewards and Payment Records

Where research participation involves rewards or incentives, the organisation may maintain records needed to administer participation, verify eligibility, prevent duplicate claims, process payments, and meet accounting or legal obligations.

Only information reasonably required for these purposes should be collected.

Reward terms must be communicated accurately. Participation does not guarantee selection for every study, a particular number of future opportunities, or a specific level of earnings unless expressly stated in the applicable offer.

Payment information must be accessible only to authorised personnel and service providers. Financial records must be retained and disposed of in accordance with applicable requirements.

20. Data Breach and Security Incident Response

Any suspected or confirmed loss, unauthorised disclosure, unauthorised access, alteration, or compromise of information must be reported promptly through info@nxtglobalventures.com.

The incident response process should include:

1. Reporting: Record the suspected incident and the information potentially affected.
2. Containment: Take reasonable steps to prevent further exposure or damage.
3. Assessment: Determine the nature, scope, likely consequences, and affected individuals or systems.
4. Preservation: Preserve relevant evidence and incident records.
5. Notification: Make legally required notifications to affected individuals, authorities, clients, or other parties within applicable timelines.
6. Remediation: Correct the cause, restore affected systems, and strengthen safeguards.
7. Documentation: Record the incident, actions taken, decisions, and follow-up measures.

Personnel must not conceal incidents or make unauthorised public statements about them. External communications should be handled by authorised management or designated personnel.

21. Employee, Researcher, and Contractor Obligations

All personnel handling information must:

• Follow this policy and relevant procedures.
• Use approved systems and access methods.
• Protect credentials and confidential information.
• Complete required training.
• Report suspected incidents and policy violations promptly.
• Access information only for authorised purposes.
• Avoid unauthorised copying, disclosure, or personal use.
• Return company information and equipment when access ends.
• Follow secure deletion and record-handling instructions.

Breaches of this policy may result in access restrictions, contractual action, disciplinary measures, or other appropriate action consistent with applicable law and agreements.

Confidentiality obligations may continue after employment or engagement ends.

22. Training and Awareness

The organisation should provide appropriate data protection and information security training to personnel whose responsibilities involve personal data, confidential information, research operations, or technology systems.

Training may cover:

• Privacy principles and consent.
• Secure handling of research data.
• Phishing and social engineering.
• Access control and password security.
• Incident reporting.
• Responsible use of AI tools.
• Participant confidentiality and research ethics.
• Retention, deletion, and secure file transfer.

Training should be refreshed when material risks, systems, responsibilities, or legal requirements change.

23. Monitoring, Audit, and Compliance Review

The organisation should periodically assess whether its data protection procedures are effective and consistently followed.

Reviews may include:

• Access permission checks.
• Security and configuration reviews.
• Vendor and service-provider assessments.
• Retention and deletion checks.
• Review of participant notices and consent records.
• Incident and complaint analysis.
• Research project compliance checks.
• Verification of corrective actions.

Monitoring must itself be lawful, proportionate, and limited to legitimate business, security, or compliance purposes.

Identified deficiencies should be documented, assigned for correction, and reviewed until appropriately resolved.

24. New Research Projects and Technology Changes

New projects, features, surveys, technologies, and third-party integrations should be assessed for privacy and security implications before launch where appropriate.

The assessment should consider:

• Whether the proposed information collection is necessary.
• Whether less intrusive methods are available.
• Participant expectations and potential harm.
• Data access, sharing, and retention.
• AI or automated processing.
• Third-party and cross-border processing.
• Security risks and incident response.
• Required notices, consent, contracts, or approvals.

Higher-risk projects should receive appropriate management review before processing begins.

Privacy and security safeguards should be considered during planning and development, rather than added only after deployment.

25. Governance and Responsibilities

Management, NXT Global Ventures

Responsible for approving the policy, providing appropriate resources, overseeing implementation, and ensuring that significant risks receive suitable attention.

Research and Operations Teams

Responsible for following approved research procedures, minimising unnecessary collection, protecting participant confidentiality, and maintaining appropriate records.

Technology and System Administrators

Responsible for implementing and maintaining approved access controls, security measures, backups, system monitoring, and deletion processes within their assigned responsibilities.

Sales and Client Services Teams

Responsible for protecting client information, using approved communication channels, and sharing information only with authorised recipients.

Employees, Contractors, and Research Partners

Responsible for complying with this policy, maintaining confidentiality, completing required training, and reporting suspected incidents.

Authorised Management or Designated Personnel

Responsible for coordinating privacy requests, complaints, incident escalation, and external communications as assigned.

These role descriptions establish internal responsibilities and do not, by themselves, designate a statutory Data Protection Officer or other legally prescribed role.

26. Regulatory Alignment

This policy is intended to support responsible data handling and alignment with applicable legal requirements, including relevant Indian data protection and information technology laws and rules.

The organisation must assess the laws applicable to each activity, including requirements relating to consent, notices, individual rights, security safeguards, breach reporting, children’s data, retention, and cross-border transfers.

Where the law imposes a requirement that is stricter than this policy, the applicable legal requirement takes precedence.

This policy does not, by itself, certify or guarantee legal compliance. It must be implemented alongside appropriate notices, contracts, operational controls, and legal review.

27. Policy Exceptions

Exceptions to this policy must be justified, documented, and approved by authorised management before implementation wherever practicable.

An exception request should identify:

• The requirement for which an exception is sought.
• The business or operational reason.
• The information and systems affected.
• The risks introduced.
• The proposed safeguards.
• The duration of the exception.
• The person or role responsible for monitoring it.

No exception may authorise conduct prohibited by applicable law. Emergency exceptions must be documented and reviewed as soon as reasonably practicable.

28. Policy Review and Amendments

This policy should be reviewed periodically and whenever significant changes occur in:

• Applicable legal or regulatory requirements.
• Research services or data collection practices.
• Technology platforms or AI tools.
• Security risks or incident findings.
• Client, participant, or contractual obligations.
• Organisational structure or operational responsibilities.

Amendments must be reviewed and approved by authorised management. Updated versions should be communicated to relevant personnel and made available through the appropriate internal document repository.

Where a change materially affects individuals, appropriate privacy notices or other communications should be updated as necessary.

29. Approval and Document Control

Document Title: Data Protection Policy Platform: NxtMarketIntel.com Operating Initiative: NXT Global Ventures Version: 1.0 Approval Authority: Authorised Management, NXT Global Ventures Classification: Internal Policy — Controlled Document

The policy is considered approved for internal implementation only after the organisation’s authorised management has reviewed and adopted it. This document does not represent approval by a regulator or independent certification.

The controlled version should be maintained by the organisation. Superseded copies should be withdrawn from active use or clearly marked as obsolete.

Implementation Statement

NxtMarketIntel.com and the relevant operations of NXT Global Ventures are expected to handle personal data, research information, and confidential business records responsibly, lawfully, and securely.

Management is responsible for putting the policy into practice through appropriate notices, contracts, access controls, training, retention procedures, incident response arrangements, and periodic reviews.

For privacy requests, data protection questions, or concerns, contact:

info@nxtglobalventures.com

Implementation note: Policy draft for organisational adoption and legal review. Before publication or implementation, confirm that the procedures reflect actual systems and practices, and obtain appropriate legal review of applicable obligations.