Privacy Notice

1. Who we are and what this notice covers

Data Safeguard India Private Limited ("Data Safeguard", "DSG India", "we", "us" or "our"), CIN U72900KA2022PTC165719 with its registered office at 297, 1st Floor, 35th Cross, 7th C Main, 4th Block, Jayanagar, Bengaluru – 560 011, Karnataka, India, provides privacy management and data protection technology and services.

This notice explains, in plain language, what personal data we process, why we process it, who we share it with, how long we keep it, how we protect it and what choices and rights you have. It applies to personal data processed through our website (www.datasafeguard.ai), our products and services, our sales, marketing and events activities, our supplier and partner relationships, and our recruitment process.

Separate notices apply to our own employees and contractors. Where a product or service has its own specific notice, that notice supplements this one.

2. Our role: controller or processor

Whether we decide how your personal data is used depends on the context. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act") a controller is called a Data Fiduciary and a processor a Data Processor; ISO/IEC 27701 uses the terms PII controller and PII processor.

3. Personal data we collect

We collect only what we need for the purposes described in section 4. We collect personal data directly from you, automatically when you use our website or services, and occasionally from third parties such as recruitment platforms, referees, event organisers, business partners and publicly available professional sources.

We do not intentionally collect sensitive categories of personal data (such as health, biometric, religious, financial account credentials or sexual orientation data) for our own purposes. If such data is processed within our platform on a customer's behalf, it is processed as a processor under section 2.

4. Why we use personal data and on what basis

We identify and document a specific purpose for every processing activity before it starts, and we do not use personal data for a purpose incompatible with the one for which it was collected without telling you and, where required, obtaining fresh consent.

If you are located in the European Economic Area or the United Kingdom, we additionally rely on the corresponding bases under the GDPR / UK GDPR: consent (Art. 6(1)(a)), contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) and our legitimate interests in running and securing our business (Art. 6(1)(f)), which we balance against your rights.

5. Consent

Where we rely on consent, we ask for it through a clear, separate request that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. We present this notice, or a summary of it, before or at the time we ask, in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India.

You can withdraw consent at any time, as easily as you gave it, by using the unsubscribe link in our emails, changing your cookie settings, or writing to privacy@datasafeguard.ai. Withdrawal does not affect processing that took place before it. Once you withdraw, we and our processors will stop processing the data for that purpose within a reasonable time unless another lawful basis applies. Where available, you may also give, manage, review or withdraw consent through a Consent Manager registered with the Data Protection Board of India.

6. Children and persons with disabilities

Our website and services are intended for business users and are not directed at children (persons under 18 years under the DPDP Act). We do not knowingly collect children's personal data for our own purposes. If we learn that we have collected such data without verifiable consent from a parent or lawful guardian, we will delete it promptly. We do not undertake tracking, behavioral monitoring or targeted advertising directed at children. Where a person with a disability has a lawful guardian, we will obtain verifiable consent from that guardian where required.

7. Who we share personal data with

• Service providers acting as our processors, such as cloud hosting, IT and security services, CRM and marketing tools, email delivery, video conferencing, recruitment systems and professional advisers. Each is selected after a privacy and security assessment and bound by a written contract that limits use to our instructions and requires appropriate safeguards, confidentiality, breach notification and return or deletion at the end of the engagement. Our current list of sub-processors is available on request.
• Group companies and affiliates of Data Safeguard, under intra-group data protection terms, for business administration and service delivery.
• Professional advisers, auditors, insurers and certification bodies, under duty of confidentiality.
• Government, regulatory, law-enforcement or judicial authorities, where required by law or a binding order. We verify every such request, disclose no more than is legally required and, where legally permitted, inform the affected individual or customer.
• A successor entity in a merger, acquisition, restructuring or sale of assets, subject to equivalent protections.

We keep a record of disclosures of personal data to third parties, including what was disclosed, to whom and when.

8. International transfers

Our primary processing location is India. Some of our service providers, affiliates or customers are located in, or provide support from, other countries, currently the United States. We transfer personal data outside India only to countries not restricted by the Central Government under section 16 of the DPDP Act, and in compliance with any other applicable law.

For each transfer we document the basis for the transfer and the receiving country, and we apply safeguards appropriate to the destination, such as contractual data protection clauses (including the EU Standard Contractual Clauses where GDPR applies), encryption in transit and at rest, and access restrictions. You may request details of the safeguards that apply to your data by contacting us.

9. How long we keep personal data

We keep personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law, in line with our documented retention schedule (summarized in section 4). Under the DPDP Act, we erase personal data when you withdraw consent or when it is reasonable to assume the specified purpose is no longer being served, unless retention is required by law; where the DPDP Rules prescribe a minimum retention period for logs or a notice before erasure, we follow it.

At the end of the retention period, personal data is securely deleted, destroyed or irreversibly de-identified using methods appropriate to the medium, including the deletion of temporary files and back-up copies on their normal rotation cycle.

10. How we protect personal data

We operate a Privacy Information Management System (PIMS) aligned with ISO/IEC 27701:2025, supported by our information security management system certified to ISO/IEC 27001:2022. Reasonable security safeguards, as required by section 8(5) of the DPDP Act, include:

• encryption of personal data in transit and at rest, and masking, tokenisation or pseudonymisation where practicable;
• role-based access on a least-privilege and need-to-know basis, multi-factor authentication and periodic access reviews;
• logging and monitoring of access to personal data, with logs retained to detect and investigate unauthorised access;
• privacy and security risk assessments, including privacy impact assessments for new or changed processing;
• secure development practices, vulnerability management, back-ups and business continuity arrangements;
• confidentiality obligations and regular privacy and security training for our personnel; and
• contractual and audit controls over our processors and sub-processors.

11. Privacy by design and by default

We build privacy into our processes, products and services from the outset. By default we collect the minimum personal data needed, restrict processing to the stated purpose, limit access, apply the shortest practical retention, and use de-identification wherever the purpose can be achieved without identifying individuals. We take reasonable steps to keep personal data accurate, complete and up to date, particularly where it is used to make decisions that affect you or is shared with others.

12. Cookies and similar technologies

Our website uses strictly necessary cookies, which are required for the site to function and do not need consent, and, only with your consent, analytics and marketing cookies. You can accept, reject or change your choices at any time using the cookie settings link in the website footer or your browser settings. Rejecting non-essential cookies does not affect your ability to use the site.

13. Automated decision-making and AI

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing, including profiling. Where our products use artificial intelligence or machine learning to discover, classify or redact personal data on our customers' behalf, this is done as a processor under our customers' instructions, and model training on customer personal data takes place only where the customer has authorised it in writing. If we introduce automated decision-making that affects you, we will tell you in advance, explain the logic involved and the likely consequences, and give you the means to obtain human review and contest the decision.

14. Your rights

Subject to applicable law, you have the right to:

• Access: obtain a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, together with a description of the data shared;
• Correction, completion and updating of inaccurate, incomplete or outdated personal data;
• Erasure of personal data that is no longer necessary for the purpose, unless retention is required by law;
• Withdraw consent at any time, as described in section 5;
• Grievance redressal: have a complaint about our handling of your personal data addressed by us;
• Nominate another individual who may exercise your rights in the event of your death or incapacity; and
• where the GDPR / UK GDPR applies, also object to processing based on legitimate interests or for direct marketing, restrict processing, and receive your data in a portable format (data portability).

When we correct, complete, update or erase your personal data at your request, we will inform the third parties to whom we disclosed it, unless this proves impossible or involves disproportionate effort.

15. How to make a request or complaint

Send your request to privacy@datasafeguard.ai or by post to the address in section 1, marked "Attention: Data Protection Officer". Please describe your request and how we can contact you. To protect your data, we will verify your identity before acting and may ask for limited additional information for that purpose only.

We will acknowledge your request within 3 working days and respond within 30 days, and in any event within the period prescribed under applicable law (for grievances under the DPDP Rules, 2025, not more than 90 days). If a request is complex we will tell you why more time is needed. We do not charge a fee unless the request is manifestly unfounded or excessive, in which case we will explain why. If we decline a request, we will give our reasons and explain how you can challenge the decision.

You must first use our grievance redressal mechanism. If you are not satisfied with our response, you may complain to the Data Protection Board of India. If the GDPR / UK GDPR applies to you, you may also complain to your local supervisory authority.

16. Personal data breaches

We maintain a documented incident response procedure. If a personal data breach occurs, we will contain and investigate it and notify the Data Protection Board of India and each affected individual without delay, in the form and within the time required by the DPDP Act and Rules, describing the breach, its likely consequences, the steps we have taken to mitigate risk, the safety measures you can take, and how to contact us. Where we act as a processor, we notify the relevant customer without undue delay so that they can meet their obligations. Breaches are recorded and reviewed to prevent recurrence.

17. Changes to this notice

We review this notice at least annually and whenever our processing changes materially. The effective date and version at the top show when it was last updated, and previous versions are available on request. If we make a material change, such as a new purpose or a new category of recipient, we will notify you through our website or by email before the change takes effect and, where required, seek your consent.

18. Contact us