Data Privacy Policy

Policy Statement

The Company is committed to safeguarding the personal data of its employees, customers, vendors, and stakeholders in compliance with the General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection (DPDP) Act, 2023. This Data Privacy Policy outlines the principles and procedures for lawful collection, processing, storage, and protection of personal data.

Objectives

• Ensure compliance with GDPR, DPDP Act, and other applicable data protection laws.
• Protect the privacy rights of individuals and maintain data confidentiality.
• Establish clear roles and responsibilities for handling personal data.
• Build trust through transparent data management practices.

Scope and Applicability

This policy applies to all employees, contractors, vendors, and third parties who process personal data on behalf of the Company It governs the collection, processing, storage, transfer, and disposal of personal data in electronic or physical form.

Definition of Personal Data

Personal Data refers to any information that can directly or indirectly identify an individual, such as name, contact details, email address, identification number, financial data, or location data. Sensitive personal data includes biometric data, health information, financial details, or other data classified as sensitive by law.

Data Protection Principles

• Lawfulness, Fairness, and Transparency: Data must be processed lawfully, fairly, and in a transparent manner.
• Purpose Limitation: Data must be collected for specified, legitimate purposes and not used beyond those purposes.
• Data Minimization: Only the minimum amount of personal data necessary shall be collected and processed.
• Accuracy: Data must be accurate and updated regularly.
• Storage Limitation: Data shall be retained only as long as necessary for its intended purpose.
• Integrity and Confidentiality: Data must be protected using appropriate technical and organizational security measures.
• Accountability: The Company is responsible for demonstrating compliance with these principles.

Legal Basis for Data Processing

The Company shall process personal data based on one or more of the following lawful bases:

• Consent of the individual (Data Principal).
• Necessity for performance of a contract or provision of a service.
• Compliance with legal obligations.
• Legitimate interests pursued by the Company or a third party, provided such interests do not override individual rights.
• Protection of vital interests of the individual.

Rights of Data Subjects

• Right to Access: Individuals can request access to their personal data.
• Right to Rectification: Individuals can correct inaccurate or incomplete data.
• Right to Erasure ('Right to be Forgotten'): Individuals can request deletion of their data under certain conditions.
• Right to Restriction of Processing: Individuals can request limitation of data processing.
• Right to Data Portability: Individuals can request a copy of their data in a machine-readable format.
• Right to Withdraw Consent: Individuals can withdraw consent at any time without affecting prior lawful processing.
• Right to Lodge Complaints: Individuals can raise concerns with the Company's Data Protection Officer (DPO) or relevant authorities.

Data Collection and Processing

Personal data shall be collected only for legitimate business purposes, with clear consent where required. The Company shall maintain transparency regarding the purpose and duration of data processing.

Data Security

• Encryption and secure transmission of data during storage and transfer.
• Implementation of firewalls, antivirus systems, and intrusion detection tools.
• Restricted access based on job responsibilities and least privilege principle.
• Regular data security audits and vulnerability assessments.

Data Sharing and Cross-Border Transfers

Personal data shall not be shared with third parties unless necessary for business purposes and governed by data protection agreements. Cross-border data transfers shall occur only to jurisdictions with adequate data protection safeguards, as per GDPR and DPDP Act requirements.

Data Retention and Disposal

Personal data shall be retained only for as long as necessary for its intended purpose or as required by law. Upon expiration, data shall be securely deleted or anonymized using approved disposal procedures.

Roles and Responsibilities

• Board of Directors: Oversee data privacy governance and policy enforcement.
• Data Protection Officer (DPO): Ensure compliance with GDPR and DPDP Act; handle data subject requests and breach notifications.
• IT & Security Team: Implement and monitor data protection measures.
• Employees: Handle personal data responsibly and report privacy incidents immediately.

Data Breach Management

In the event of a data breach, the Company shall follow a structured incident response process, including immediate containment, investigation, and risk assessment. If required by law, the breach shall be reported to the Data Protection Board of India (DPBI) or relevant supervisory authority within the stipulated timeframe.

Training and Awareness

The Company shall provide regular data privacy and protection training to all employees. Training shall focus on handling personal data securely, recognizing risks, and ensuring compliance with privacy obligations.

Policy Review

This policy shall be reviewed annually or upon significant regulatory updates to ensure alignment with evolving data protection standards.

Employee Acknowledgment

I acknowledge that I have read and understood the Data Privacy Policy of the Company I agree to comply with the policy provisions and handle all personal data in accordance with the GDPR, DPDP Act, and Company procedures.

Employee Name: __________________________

Signature: ______________________________

Date: _________________________________