1. SCOPE OF THE PRIVACY POLICY

This Privacy Policy explains how Free Stream Technologies Private Limited (collectively “Free Stream”, "we", "us" or "our") collects, uses, stores, shares, and protects the personal data of individuals through D2M Application (ATSC 3.0 NextGen Broadcast Receiver App) (“Platform”).
This Privacy Policy (“Privacy Policy”) applies to all Users (“you” or “Users”) of the Platform who interacts with the Platform in any manner, whether through the application or other channels.

The Platform is available on Android devices. In certain Free Stream-branded smartphones, the Platform is available as pre-installed application and on other Android devices, it is available to be downloaded from authorized application stores. The core features of the Platform, including inter alia broadcasting, tuning, streaming and emergency alert features, do not require the User to log in or create an account.

In the context of this Privacy Policy, Free Stream is identified as a data fiduciary (“Data Fiduciary”) as Free Stream will determine the purpose and means of processing personal data collected through the Platform and associated services.

Further, Users whose personal data is being collected and processed by the Data Fiduciary shall be deemed to be data principals (“Data Principal”). In cases where the individual is a person with disability, the Data Principal includes the lawful guardian of such person.

2. DATA FIDUCIARY

As the Data Fiduciary, we determine the purpose and means of processing of your personal data.
Our details are as follows:

Company Name: Free Stream Technologies Private Limited
Company Registration Number: U61202DL2023PTC423749
Registered Address: E 13/29, First Floor, Harsha Bhawan, Connaught Place, Central Delhi, New Delhi - 110001
Website: www.freestream.ai
Contact Email: d2m_gp@freestream.ai

Any personal data collected and processed by us is in accordance with the applicable laws and regulations.
The processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, either automated or manual. It includes inter alia collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

3. DATA PROTECTION OFFICER AND GRIEVANCE OFFICER

In compliance with the Digital Personal Data Protection Act, 2023 (“DPDPA”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), we have appointed a Data Protection Officer / Grievance Officer to address your queries, concerns, and complaints regarding the processing of your personal data.

Data Protection Officer / Grievance Officer:
Name: Sumeet Nindrajog
Email: privacy@freestream.ai

4. HOW WE COLLECT YOUR PERSONAL DATA

We collect personal data through various means in connection with your use of the Platform and other allied services. The categories of personal data collected, and the methods of collection are described below:

1. Information You May Voluntarily Provide: You may choose to voluntarily provide certain personal data to us, including inter alia: your name, email address, age, genre preferences, and language preferences. This information is collected as optional profile information for specific purposes as set out in Clause 6 of this Privacy Policy, including inter alia: to provide personalized content and personalized advertisement. You are under no obligation to provide this information, and the provision of such data is entirely at your discretion.
2. Information Collected Automatically: When you use the Platform, certain information may be collected automatically, including: your location data (approximate and/or precise, subject to your device permissions), device information (such as device model, manufacturer, and unique identifiers), network information (such as network type and carrier), connectivity status, and tuner status (including ATSC 3.0 tuner availability and signal reception data). This data is collected to ensure the proper functioning of the Platform and for specific purposes as set out in Clause 6 of this Privacy Policy, including inter alia: to deliver broadcast content and emergency alerts relevant to your location.
3. Broadcast and Content Data: The Platform receives and processes broadcast-related data, including Electronic Service Guide (ESG) data, media segments, and locally cached content. This data is necessary for the delivery of broadcast content and is processed on your device to enable seamless reception and playback of broadcast services.
4. Crash and Diagnostics Data: We use Firebase Crashlytics to collect crash and diagnostic data for the purpose of improving the stability and performance of the Platform. This data may include inter alia: application version, device model, operating system version, timestamps of crash events, and stack traces. Crash and diagnostic data is collected automatically and is used for specific purposes as set out in Clause 6 of this Privacy Policy, including inter alia: for troubleshooting and improving the Platform.
5. Notifications and Emergency Alert Data: The Platform may collect information related to notification permissions granted by you on your device, as well as alert-display settings and preferences. This data is used for specific purposes as set out in Clause 6 of this Privacy Policy, including inter alia: to deliver notifications and emergency alerts (including disaster management and public safety alerts) in a timely and effective manner.
6. WebView Content: The Platform may display broadcast-related Broadcaster Application (BA) service content and Non-Real-Time (NRT) content, including images, GIFs, and videos, within a WebView component. Such content is delivered as part of the broadcast stream and is rendered locally on your device.
7. AI Processing Data: Certain data may be processed by AI-powered features within the Platform for the purposes of content recommendations and broadcast optimization. This process is designed to enhance your experience by providing personalized content suggestions and improving the quality of broadcast reception and delivery.
8. Communication Data: When you contact us via email, through the Platform, or through any other communication channel, we may collect and retain the content of your communications, your contact details, and any other information you provide in the course of such communication. This data is used to respond to your queries, resolve your concerns, and improve our services.

5. SENSITIVE PERSONAL DATA OR INFORMATION (SPDI)

Under Rule 3 of the SPDI Rules, Sensitive Personal Data or Information includes inter alia: passwords; financial information such as bank account, credit card, or debit card details; physical and mental health condition; sexual orientation; medical records and history; and biometric information.

The Platform does not intentionally collect any Sensitive Personal Data or Information (“SPDI”) from its Users. The core functionality of the Platform does not require the collection or processing of SPDI.

In the event that SPDI is inadvertently collected through any feature of the Platform or through your interactions with our services, such data shall be handled with heightened security measures in full compliance with the SPDI Rules. We shall take all reasonable steps to identify and securely delete or anonymize any inadvertently collected SPDI as soon as practicable.

In accordance with Rule 5 of the SPDI Rules, we shall obtain explicit written consent from the Data Principal before collecting any SPDI, should such collection ever become necessary for the provision of our services. Such consent shall clearly state the purpose for which the SPDI is being collected and shall be obtained in a manner that is free, specific, informed, and unambiguous.

6. PURPOSES AND LEGAL BASES FOR PROCESSING

We process your personal data, including on an aggregated basis, for the specified purposes, including inter alia:

1. To provide broadcast reception, content streaming, and emergency alert services through the Platform;
2. To support services provided through Platform, including channel tuning, signal acquisition, and electronic service guide processing;
3. To operate hybrid broadband and broadcast features that combine over-the-air broadcast reception with internet-based content delivery;
4. To provide AI-powered content recommendations and broadcast optimization, enhancing your User experience and the quality of content delivery;
5. To store and apply optional profile preferences (such as genre preferences and language preferences) that you may choose to provide;
6. To troubleshoot application crashes and improve stability through crash reporting and diagnostics;
7. To maintain, improve, and secure the Platform and its underlying infrastructure, including through diagnostics, analytics, and product development;
8. To provide personalized promotional offers and updates or any form of personalized advertisements for enhanced User experience;
9. To deliver emergency alerts, including disaster management alerts and public safety notifications, in compliance with applicable regulations;
10. To conduct internal analytics and product improvement activities to enhance the quality, functionality, and performance of the Platform and our services;
11. To provide, operate, and support the core functionality of the Platform, including broadcast reception, content streaming, emergency alerts, and related services;
12. To personalize and enhance your experience on the Platform, including inter alia by applying any optional preferences you may choose to provide;
13. To use the data for internal research on our Users' demographics, interests, usage trends, and behavior to better understand and provide with enhanced User experience;
14. To comply with applicable rules and regulations; and
15. To fulfil any administrative or managerial obligations.

We process your personal data under the following legal bases as provided by the DPDPA framework:
Consent of Data Principal (Section 4(a) and Section 6 DPDPA): We process your personal data based on your freely given, specific, informed, unconditional, and unambiguous consent. Consent is obtained at or before the time of collection of your personal data.

Legitimate Uses (DPDPA): In certain circumstances, we may process your personal data without consent for legitimate uses in accordance with the DPDPA.

Compliance with Applicable Laws: We may process your personal data where such processing is necessary for compliance with obligations under the IT Act, TRAI regulations, the Indian Telegraph Act 1885, spectrum management regulations, and any other applicable law, rule, regulation, or direction issued by a competent authority.

7. SHARING AND DISCLOSURE

We do NOT sell your personal data.
We may share your personal data only in the following circumstances:

1. Third-Party Service Providers: We engage trusted third-party service providers (“Data Processor”), who process data on our behalf, under strict confidentiality obligations and Data Processor agreements executed in compliance with Section 8(2) of the DPDPA, for purposes as set out in Clause 6 of this Privacy Policy;
2. Group Companies and Affiliates: We may share data with our group companies and affiliates for processing of data for purposes as set out in Clause 6 of this Privacy Policy;
3. Government and Regulatory Authorities: We may disclose personal data when required by law, including requests from authorities under the IT Act, the Telecom Regulatory Authority of India (TRAI), spectrum licensing authorities, and law enforcement agencies;
4. Corporate Transactions: In the event of a merger, acquisition, or corporate restructuring, personal data may be transferred to the successor entity as permitted under the Section 17(1)(e) exemption of the DPDPA; and
5. With Your Consent: We may share your data in any other manner, for purpose as set out in Clause 6 of this Privacy Policy, for which you have provided your explicit consent by agreeing to this Privacy Policy.

Your profile information is currently not shared with any Data Processor for processing of personal data for the purposes of any personalized advertisement. If any personal data is shared with any Data Processor, for advertisement purposes, in the future, it shall be done in compliance with this Privacy Policy.

8. CROSS-BORDER DATA TRANSFERS

The Central Government may, by notification, restrict the transfer of personal data to certain countries or territories. We comply with all such restrictions as notified from time to time.

Firebase Crashlytics data may be processed on Google servers located outside India. Appropriate safeguards are applied to such transfers in accordance with applicable law and Google's data processing terms.

9. DATA RETENTION

We retain personal data only for as long as necessary to fulfill the specified purpose for which it was collected, in accordance with the applicable laws and obligations. Once the specified purpose is fulfilled, the data is erased or destroyed, as the case maybe.

10. SECURITY MEASURES

We implement reasonable security safeguards to protect your personal data in accordance with Section 8(4)-(5) of the DPDPA and Rule 6 of the DPDP Rules.
Notwithstanding the above, no method of electronic transmission or storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, absolute security cannot be guaranteed.

11. CHILDREN'S PRIVACY

In compliance with Section 9 of the DPDPA and Rule 10 of the DPDP Rules, the Platform is not directed to individuals under the age of eighteen (18) years (“Child”). We do not knowingly collect personal data from Children.

If we become aware that personal data of a Child has been collected inadvertently without appropriate parental consent, we will take immediate steps to delete such data.

For any concerns regarding Children's privacy, please contact us at: d2m_gp@freestream.ai

12. RIGHTS OF DATA PRINCIPALS

1. Right to Access (Section 11 of DPDPA): You have the right to obtain a summary of your personal data being processed by us, details of the processing activities undertaken, and the identities of all Data Fiduciaries and Data Processors with whom your personal data has been shared.
2. Right to Correction and Erasure (Section 12 of DPDPA): You have the right to request the correction of inaccurate personal data, completion of incomplete personal data, updating of outdated personal data, and erasure of personal data that is no longer necessary for the purpose for which it was collected.
3. Right to Nominate (Section 14 of DPDPA): You have the right to nominate another individual to exercise your rights under the DPDPA in the event of your death or incapacity.

13. DUTIES OF DATA PRINCIPALS

As a Data Principal, you have certain duties under Section 15 of the DPDPA. Data Principals shall:

1. Comply with all applicable laws while exercising their rights under the DPDPA.
2. Not impersonate another person while providing personal data for any specified purpose.
3. Not suppress any material information while providing personal data for the issuance of documents, unique identifiers, or proof of identity or address.
4. Not register false or frivolous grievances or complaints with Free Stream or the Data Protection Board of India.
5. Furnish only verifiably authentic information when exercising rights under the DPDPA.

14. PERSONAL DATA BREACH NOTIFICATION

Per Section 8(6) of the DPDPA and Rule 7 of the DPDP, we are committed to promptly addressing any personal data breach involving your information, including inter alia any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of, or loss of access to personal data, that compromises the confidentiality, integrity, or availability of personal data. We shall inform you and Data Protection Board of India with regards to any personal data breach, within the timelines provided under the applicable laws.

15. THIRD-PARTY WEBSITES AND SERVICES

The Platform may contain links to or integrations with third-party websites, platforms, or services that are not operated or controlled by Free Stream.
We are not responsible for the privacy practices, data collection methods, or content of any third-party websites or services. The inclusion of any link or integration does not imply endorsement or responsibility for such third-party services.

We recommend that you review the privacy policies of any third-party websites or services before sharing your personal information with them.

16. CONSENT MANAGER PROVISIONS

A Consent Manager is an entity registered with the Data Protection Board of India that acts on behalf of and is accountable to the Data Principal in managing their consent preferences.

We will honor all consent actions including inter alia the granting, modification, and withdrawal of consent taken through a duly registered Consent Manager in accordance with applicable law.

If a registered Consent Manager will be appointed for the Platform, details will be published at www.freestream.ai.

17. ADVERTISING POLICY

We use the personal data provided by the User voluntarily for personalized advertisement purposes to enhance the User experience. However, we ensure that no tracking or behavioral monitoring and targeted advertising is directed at Children, in compliance with Section 9(3) of the DPDPA.

Further, if any advertising features, in addition to the features presently available, are added in the future or if any Data Processor is engaged for either collection or processing of personal data for advertisement purposes:

1. This Privacy Policy and all required app store disclosures will be updated prior to the introduction of any such advertising features;
2. The Data Processor shall be bound under strict confidentiality obligations and Data Processer agreements in compliance with DPDPA; and
3. Opt-out mechanisms will be provided to allow Users to decline personalized advertising at any time.

18. GRIEVANCE REDRESSAL

We are committed to promptly addressing the grievances of the Users. We shall endeavor to redress the grievance within the timelines provided under the applicable laws.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of such changes.

We recommend reviewing this Privacy Policy periodically to stay informed about how we are protecting your personal data.

Previous versions of this Privacy Policy are available upon request.

20. CONSENT MECHANISM

In accordance with Section 6(1) of the DPDPA, the consent is obtained from the Data Principal before collection of any personal data. By clicking on the ‘I Accept’ button while registering on the Platform and providing personal data, you acknowledge and confirm the following:

1. You have read this Privacy Policy;
2. You understand the specific purpose for which your personal data is being collected;
3. You understand that your personal data may be used for processing of personal data, for the reasons as set out in this Privacy Policy;
4. You understand that your personal data may be shared and disclosed to third parties, for the reasons as set out in this Privacy Policy; and
5. You are providing your free, specific, informed, unconditional, unambiguous, explicit and affirmative consent.

Pursuant to Section 6(4) of the DPDPA, every Data Principal has the right to withdraw their consent at any time. Withdrawal of consent may be effected by contacting us at: d2m_gp@freestream.ai.

In accordance with Section 6(5) of the DPDPA, the withdrawal of consent shall not affect the legality of any processing of personal data that was carried out on the basis of consent before its withdrawal. Upon withdrawal of consent, we shall, subject to applicable legal requirements, cease to process the personal data of the Data Principal for the specified purpose, unless another legal basis for processing exists.