Privacy Policy

‍

Effective date: April 2026

‍

G10X (“Company”, “we”, “us”, or “our”) is committed to protecting the personal data of individuals who register for and use the G10X Wishing Tree Website (“Website”). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights in relation to that data (“Privacy Policy”). This Privacy Policy form part of the Website Terms of Use.

‍

This Privacy Policy applies to all persons who create an account on the Website, regardless of where they are located, including in India, the United States, the United Kingdom, the European Economic Area (“EEA”), the Middle East, and other jurisdictions.

‍

Please read this Privacy Policy carefully before registering for an account. By accessing the Website and providing your personal data, you acknowledge that you have read and understood this, Policy.

‍

G10X is the operator of the Wishing Tree Website and is the data controller (or equivalent responsible entity under applicable law) in respect of personal data collected through the Website. Our contact details are set out in Section 13 below.

‍

The Website is operated from India. Personal data collected through the Website is processed and stored in India, subject to the safeguards described in this Policy.

‍

Data Collection

‍

We collect only the minimum personal data reasonably necessary to administer your account and facilitate your participation in the Program. This includes:

‍

• Registration Data: Your name and email address provided when you create an account on the Website.
• Authentication Data: verification data generated during account login (such as one-time password (OTP) verification).

• Participation Records: records of items you have viewed or for which a Purchase Link has been accessed, maintained for internal administrative and Program coordination purposes.

• Communications Data: records of any communications you send to G10X.
• Marketing Preferences: your preferences regarding Marketing Communications from G10X (see Section 7).

‍

We do not collect, receive, process, or store any financial or payment information. All payments for items purchased in connection with the Program are made directly by you on the Third-Party Platform (such as Amazon) and are processed solely by that platform.

We do not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data has been submitted by a person under 18, we will delete that information and suspend the relevant account.

‍

How we use your personal data

‍

We use the personal data we collect for the following purposes:

‍

• Account Administration: to register, manage, and authenticate your account on the Website.
• Program Facilitation: to make the wish list available to you, generate and provide Purchase Links, and coordinate receipt and distribution of items to beneficiary schools.

• Communication: to send you account-related notifications, Program updates, and, where you have not opted out and were permitted by law, acknowledgment of communications regarding the Program.

• Marketing: to contact you about G10X products, services, events, and commercial initiatives, subject to your consent or applicable opt-out rights

• Security and Fraud Prevention: to protect the integrity and security of the Website, detect and prevent misuse, and enforce our Terms of Use.
• Legal Compliance: to comply with applicable laws, regulations, legal processes, governmental requests, and internal audit and compliance requirements.

• Improvement of the Website: to analyze usage patterns and improve the functionality and user experience of the Website.

‍

Legal basis for processing

‍

We process your personal data only where we have a lawful basis to do so. The applicable lawful basis depends on the purpose for which we process your data:

‍

• Consent: where you voluntarily provide your personal data to create an account, where we send you acknowledgment or impact communications, and where we send you Marketing Communications (in jurisdictions where consent is required by law). You may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

• Performance of a contract or steps taken at your request: to register and administer your account and facilitate your participation in the Program.

• Legitimate Interests: to administer, secure, and improve the Website; to maintain participation records; to prevent misuse; and (in jurisdictions where legitimate interests may apply) to send Marketing Communications, provided our interests are not overridden by your rights and interests

• Legal Obligation:where processing is necessary to comply with applicable laws, regulations, or legal processes.

‍

For users located in India, we process personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDPA”) and other applicable Indian data protection laws.

‍

For users located in the EEA or the United Kingdom, we process personal data in accordance with the General Data Protection Regulation (“GDPR”) or UK GDPR, as applicable.

‍

For users located in the United Arab Emirates, we process personal data in accordance with applicable UAE data protection laws, including Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

‍

For users located in the United States, we process personal data in accordance with applicable US federal and state privacy laws, including where applicable the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”).

‍

Purchase links and third-party purchasers

‍

Where you access a purchase link with a third party and completes a purchase on the third-Party platform, please note that:

‍

• G10X does not collect, receive, or process any personal data relating to that third party through the Website; The third party’s purchase is a direct transaction with the Third-Party Platform, governed solely by that platform’s terms and privacy policy; and

• G10X has no visibility into the identity of the persons who use a shared Purchase Link to complete a purchase.

‍

You are responsible for ensuring that any person with whom you share a Purchase Link is aware that the transaction occurs directly on the Third-Party Platform and is not connected to or managed by G10X.

‍

Sharing and disclosure of personal data

‍

We do not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We may share your personal data in the following limited circumstances:

‍

• Service Providers: with trusted third-party service providers who assist us in operating and administering the Website and the Program, including website hosting and cloud infrastructure providers, email and communication service providers, authentication and OTP verification providers, IT support and maintenance providers, and professional advisers and auditors. Such providers are contractually bound to maintain the confidentiality and security of your personal data and may process it only for the specific purposes authorized by us.

• Legal Compliance: where required by applicable law, regulation, legal process, court order, or governmental request, or where reasonably necessary to enforce our Terms of Use or protect the rights, property, or safety of G10X, our users, or third parties.

• Corporate Transactions: in connection with any merger, acquisition, reorganization, or sale of assets of G10X, subject to appropriate confidentiality undertakings.

‍

We do not share your personal data with Third-Party Platforms (such as Amazon). When you click on a Purchase Link and access a Third-Party Platform, any personal data you provide on that platform is collected and processed solely by that platform in accordance with its own privacy policy.

‍

Marketing Communications

‍

By creating an account on the Website, you acknowledge that G10X may contact you from time to time to inform you about G10X’s products, services, events, and commercial initiatives.

The basis on which we send Marketing Communications varies by jurisdiction:

‍

• EEA and UK Users: we will send Marketing Communications only where we have obtained your prior opt-in consent, or where we are permitted to do so on the basis of our legitimate interests and you have not opted out.

• UAE Users: we will send Marketing Communications in compliance with applicable UAE laws and regulatory requirements. We will seek your consent where required.

• US Users: we will send Marketing Communications in compliance with applicable law, including the CAN-SPAM Act and applicable state laws. You may opt out at any time.

• India and Other Jurisdictions: we will send Marketing Communications in accordance with applicable laws and, where consent is required, only after obtaining it.

‍

You may opt out of Marketing Communications at any time by clicking the “unsubscribe” link in any Marketing Communication or by emailing wishingtree@oneg10x.com with the subject line “Marketing Opt-Out”. Opting out will not affect transactional and administrative communications relating to your account.

‍

International Data Transfers

‍

The Website is operated from India, and your personal data will be processed and stored in India. If you access the Website from outside India, your personal data will be transferred to and processed in India.

‍

Where your personal data is transferred from the EEA or the UK to India or another country that has not been recognized as providing an adequate level of data protection, we will implement appropriate safeguards, such as standard contractual clauses approved by the European Commission or the UK Information Commissioner’s Office, as applicable, to protect your personal data.

‍

For UAE users, transfers of personal data outside the UAE will be conducted in accordance with applicable UAE data protection law requirements, including the implementation of appropriate transfer mechanisms.

‍

By using the Website and providing your personal data, you acknowledge that your data may be processed in India in accordance with this Privacy Policy.

‍

Data Retention

‍

We retain your personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

‍

• administering your account and your participation in the Program;
• maintaining internal administrative and participation records;
• ensuring the security and integrity of the Website; and
• complying with applicable legal, regulatory, audit, and compliance obligations.

‍

Where processing is based on your consent, we will retain your personal data until you withdraw consent or until it is no longer required for the stated purpose, whichever is earlier.

‍

When your personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable data protection laws and our internal data retention procedures.

‍

Security

‍

We implement reasonable administrative, technical, and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include access controls, authentication mechanisms, secure data storage, and internal administrative controls.

‍

Personal data collected through the Website is accessible only to authorized G10X personnel and service providers who require access for legitimate operational or compliance purposes and who are subject to confidentiality obligations.

‍

While we take reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of information transmitted to or through the Website.

‍

Your Rights

‍

Subject to applicable data protection laws, you may have certain rights in relation to your personal data. Depending on your jurisdiction, these may include:

‍

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete personal data.

• Right to erasure: to request deletion of your personal data, subject to applicable legal requirements and legitimate retention grounds.

• Right to withdraw consent: where processing is based on consent, to withdraw consent at any time without affecting the lawfulness of prior processing.

• Right to restrict processing: to request that we restrict processing of your personal data in certain circumstances.
• Right to object: to object to processing based on our legitimate interests, including processing for Marketing Communications.

• Right to data portability: where applicable, to receive your personal data in a structured, commonly used, machine-readable format.

• Right to opt out of sale/sharing (California): if you are a California resident, you have the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined under the CCPA/CPRA.

‍

To exercise any of your rights, please contact us at wishingtree@oneg10x.com. We may request reasonable verification of your identity before processing your request and will respond in accordance with applicable data protection laws.

‍

If you are dissatisfied with how we handle your personal data or any request you have made, you have the right, subject to applicable law, to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. In the EEA, this is the supervisory authority in your country of residence. In the UK, this is the Information Commissioner’s Office (ICO). In India, this is the Data Protection Board of India (once established under the DPDPA).

‍

Protection of Beneficiary Information

‍

The wish lists on the Website are presented in generalized form and do not include the names, photographs, or personally identifiable information of individual beneficiary children. G10X does not disclose personal information identifying individual beneficiaries to Program participants or any third party.

‍

Information relating to beneficiary children that G10X receives from participating schools is handled in strict confidence and used solely for the purpose of coordinating distribution of donated items. Participating schools are responsible for obtaining any necessary parental or guardian consent for sharing information about children with G10X in connection with the Program.

‍

Cookies and Tracking Technologies

‍

The Website may use cookies and similar tracking technologies to enable authentication, maintain session security, and improve the functionality of the Website. We do not use tracking technologies for behavioral advertising or profiling.

‍

Where required by applicable law, we will seek your consent before placing non-essential cookies on your device. You may manage your cookie preferences through your browser settings; however, disabling certain cookies may affect the functionality of the Website.

‍

Changes to this Privacy Policy

‍

G10X reserves the right to update or modify this Privacy Policy from time to time. Any changes will be posted on the Website with a revised effective date. Where required by applicable law, we will provide you with advance notice of material changes. Your continued use of the Website following any update constitutes your acceptance of the revised Policy.

‍

We encourage you to review this Privacy Policy periodically.

‍