PRIVACY POLICY

Effective from: 1st June 2021

Introduction

Your privacy is important to us. We believe it is important for you to know what personal data we, MRTICS SERVICES PRIVATE LIMITED ("MRTICS" or "MSPL" or "we"), collect from you (and third parties), why we collect it, how we use it and what rights you might be entitled to as a data subject or consumer.

For residents (data subjects) of the European Union, when we collect and use personal data (information) about you, we may be subject to the General Data Protection Regulation ('GDPR') of the European Union and responsible as a 'data controller' for such personal data.

For residents (consumers) of the United States, when we collect and use personal information about you, we may be subject to the California Consumer Protection Act (CCPA) and responsible as a 'business' or 'service provider' for such personal data.

Please note: all information in this privacy notice is applicable to you unless otherwise indicated based on your residency status. If you are a resident of the European Union, references to GDPR will be applicable to you. If you are a resident of the Unites States, references to the CCPA will be applicable to you.

We are required under data protection legislation to notify you of the information contained in this privacy notice. It is important that you read this notice, together with any additional and more specific information we may provide to you on various occasions when we are collecting or processing personal data on certain specific websites, products or applications, events and initiatives so that you are aware of how and why we are using such information. (We issue a different privacy statement which applies where there is an employment relationship between MRTICS and its employees.)

How we will use your personal information

We may collect different kinds of personal information in a number of different ways and use it for a number of different purposes:

• To ensure access to our website and online services.
  In general, you can visit MRTICS on the World Wide Web without telling us who you are. Our web servers or Affiliates who provide analytics and performance enhancement services may collect:
  • IP addresses,
  • operating system details,
  • browsing details,
  • device and connectivity details, and/or
  • language settings.

This information is aggregated to measure the number of visits, average time spent on the site, pages viewed and similar information. MRTICS uses this information to measure the site usage, improve content and to ensure safety and security as well as enhance performance and user experience of the website. In few situations, you are required to register to access a reserved area of the website: in these cases, we will also collect your username and the password.

We may also obtain data from third parties including:

• Social networks, when you grant permission to us to access your data on one or more networks through our website.
• Service providers that help us determine a location based on your IP address in order to customize offerings and content to your location.
• Partners with which we offer co-branded services or engage in joint marketing activities.

MRTICS uses cookies (small text files placed on your device) and similar technologies to facilitate proper functioning of our websites and to help collect data: please read here our full cookie policy. Please note that our websites may include links to websites of third parties whose privacy practices differ from those of MRTICS; if you provide personal data to any of those websites, your data is governed by their privacy statements.

Under the GDPR, the lawful basis for this processing is our legitimate interest in enabling and improving our website and online services, or consent, where requested and obtained.

• To answer your queries, support and contact requests.

If you contact us with queries, requests for more information about initiatives or products or other generic support inquiries, we will need to collect information about you such as:

• personal and contact details, like full name, company and role, email address,
• demographic data,
• qualifications and profession, and/or
• the content of your messages to us.

For information about managing your contact data, email subscriptions and promotional communications, please use the form at the bottom of this page or contact our Data Protection Officer (see contact details below).

Under the GDPR the lawful basis for this processing may be for the performance of a contract with you or to take steps at your request before entering into a contract with you, or for our legitimate interests in behaving as a responsible organization in dealing with these matters, or consent, where requested and obtained.

• Subscriptions to our promotional communications

If you sign up to receive promotional communications from MRTICS we may send these by email, SMS/text messages, post, telephone or any other means of communication. For information about managing your contact data, you may reach out to the contact details provided in the event privacy notice or in the emails you receive, use the form at the bottom of this page or contact our Data Protection Officers (see contact details below).

Under the GDPR the lawful basis for this processing is the consent, where requested and obtained.

• To administer events and activities.
  MRTICS frequently organizes events and initiatives, either free to join or by invitation only; in these cases, this privacy statement applies to both participants and speakers, together with any other supplementary information that is provided in relation with each event. To allow participants to join the events (including communications pre and post event), we are required to collect and process a limited amount of information, such as:
  • full name,
  • company, job title and business email address,
  • telephone number,
  • location, and/or
  • pictures and video of you.

Where a hospitality service is provided, we may also collect, store and process "special categories" of more sensitive personal data, such as information regarding any dietary requirements or personal disabilities. This will be done only and to the extent permitted by the law. Events might be recorded hence pictures and video of you may be collected too; in such case, you will be informed via a specific notice at the location of recording. This material can be used later by MRTICS for further compatible purposes if you don't object to it. In the course of these events we may collect your personal data and contact you again in order to receive feedback and provide further commercial information about MRTICS; this will be done with your consent, when necessary.

We may also obtain data from third parties including:

• Third party event organizers where the event is sponsored by MRTICS. Organizers might provide the attendee list. In such cases the privacy policy of those third parties to which you provide your personal data will apply to you.

Under the GDPR the lawful bases for this processing is our legitimate interest in organizing and running such events, or consent, where requested and obtained.

• To manage, administer and fulfill the obligations under contracts, and regulations
  Where MRTICS is in a contractual relationship with you (other than an employment relationship), your employer, your company or we are taking steps to enter into such a contractual relationship, we will need to process your personal information, usually limited to name, business contact details and job title in order to enter into and/or fulfill the obligations arising from the same contract, such as providing you or your employer or company with the services you have requested or make use of the services that you or your employer or company are offering to us. We will also process such personal data for ancillary tasks related to our daily business activities, such as accounting, auditing, reporting (to regulators and authorities) and to comply with applicable regulations.

Under the GDPR and depending on the processing activity, the lawful bases for this processing may be for the performance of a contract with you or to take steps at your request before entering into a contract with you, our legitimate interest in providing services to your company or employer, or legal obligation.

• To promote the MRTICS brand, products, initiatives and values with marketing communications.
  MRTICS has a strong interest in promoting its brand, products, initiatives and values. We may send you marketing communications through different channels, such as email, texts, phone calls or regular mail; to do so, we might use your contact details which were previously collected in the context of an event, a query sent by you or through the navigation on our websites. We may also obtain your personal information from third parties, such as business partners, data brokers, social networks, publicly available sources and marketing companies. In such cases, we will also comply with any additional restrictions imposed by the source of the data. If required by applicable legislation, we will ask for your consent separately before sending any marketing communications. You can opt-out of receiving such communications at any time using the form at the bottom of this page, writing to our Data Protection Officer (see section below) or by any other given method provided from time to time (for example: unsubscribe link included at the bottom of emails).

From time to time, we may use your name, quotes, pictures or videos to promote and amplify MRTICS' brand and activities. In any such case, you will receive appropriate additional information about the usage of your personal data.

Under the GDPR the lawful basis for this processing are MRTICS' legitimate interests in promoting its brand, products, initiatives and values, or consent, where requested and obtained.

If you do not provide certain information when requested, it may delay or prevent us from administering a service you requested from us, replying to your queries and/or letting you join our initiatives.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose and applicable law. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we will share your personal information

We may share your data with third parties, including third-party service providers and other entities in the MRTICS. Please note, MRTICS has not in the past, nor does it currently, under any circumstances buy or sell your personal data from or to any third party. Further, MRTICS does not use your personal data for any other purpose (as outlined below) unless required to fulfill a legitimate business purpose.

Why might you share my personal data with third parties?

We may share your personal data with third parties where required by law, where it is necessary for one of the activities mentioned above or where we have another legitimate legal basis in doing so. We require third parties to respect the security of your data and to treat it in accordance with the law. Where required by the law, we will request your consent before transferring data to third parties which are not part of the MRTICS.

Which third-party service providers process my personal data?

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities within our group. The following activities may be carried out by third-party service providers: hosting and other internet services, data storage and analytics, marketing research and campaign management, event organizers and caterers. All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. We may also need to share your personal data with regulators or to otherwise comply with the law.

When might you share my personal data with other entities in the group?

We may share your personal data with other entities in the MRTICS as part of our regular reporting activities on company performance, in the context of a business reorganization or group restructuring exercise, for system maintenance support and hosting of data and when it is required to do so in order to perform one of the activities listed above (see "How we will use information about you"). Other entities in the MRTICS are required to take appropriate security measures to protect your personal data in line with our policies.

Transferring EU Data Subject information outside the EU/EEA for GDPR

We may transfer the personal data we collect about you to one of more countries outside the EU/EEA, including India, in order to perform one of the activities listed above (see "How we will use information about you"). Where there isn't an adequacy decision by the European Commission in respect of those countries - meaning that these are not deemed to provide an adequate level of protection for your personal data - we have put in place the appropriate measures to ensure that your personal data will be secure. These measures include Data Transfer Agreements based on the European Commission's Standard Contractual Clauses. If you require further information about these protective measures, you can request it from our Data Protection Officer (see contacts below).

How we will keep your information safe

We have put in place appropriate technical, organizational and security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long we will keep your information

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal data are available in our retention policy upon request from our Data Protection Officer (see contact details below). To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

How to contact us

If you have a privacy concern, complaint or a question regarding this privacy statement, please direct it at privacy@mrtics.com or contact us through the form at https://mrtics.com/contact-us.

For the purposes of the your data processed under this statement, the controller (under GDPR) or business/service provider (under CCPA) for the data processing of your personal information collected through our websites is MRTICS SERVICES PRIVATE LIMITED, Survey no. 55, Plot no. 108, NYN Arcade, 3rd Floor, Lumbini Society, Opp, Hitech City Main Road, Gachibowli, Hyderabad - 500 032, India. For all the other purposes indicated above, the controller (under GDPR) or business/service provider (under CCPA) is the same entity unless indicated otherwise in other privacy statement communicated in each situation.

Rights of EU data subjects under GDPR

If the processing of your personal information is subject to the EU General Data Protection Regulation ("GDPR") (or any United Kingdom replacement legislation), you are entitled to the rights listed below.

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Your rights in connection with personal data

Under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you. This enables you ask us to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data. This enables you to ask us, in certain situations, to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the restriction of processing of your personal data. This enables you to ask us, in certain circumstances, to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Data portability: This enables you to ask us, in certain circumstances, to provide you with the personal data you have provided to us in a structured, commonly used and machine-readable format or to transmit the personal data that you have provided to us to another party.
• Automated decision-making: The right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

If you are an EU or United Kingdom resident and want to exercise a data subject right in connection to your personal data, please contact our Data Protection Officer for the EU or United Kingdom (see contacts below).

Rights of US Consumers under the CCPA

If the processing of your personal information is subject to the CCPA, you are entitled to the rights listed below.

Changes to your personal data

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Your rights in connection with personal data

Under certain circumstances, by law you have the right to:

• Request access to your personal data. This enables you to receive a copy of the personal data we hold about you.
• Request erasure of your personal data. This enables you to ask us, in certain situations, to delete or remove personal data unless our processing is specifically permitted under the CCPA.
• Right of disclosure for sale of data or use for business purpose. This enables you to ask us, in certain circumstances, to provide you with the categories personal data and third parties we disclose for sale or business purposes. As MRTICS does not sell your personal data under any circumstances, this right may only apply where MRTICS discloses your personal data for a business purpose.
• Data portability: This enables you to ask us, in certain circumstances, to provide you with the personal data you have provided to us in a structured, commonly used and machine-readable format or to transmit the personal data that you have provided to us to another party.
• Right to opt-out: This enables you to opt-out of the sale of your personal data by a business to other third parties. As MRTICS does not sell your personal data under any circumstances, this right does not apply to your personal data with MRTICS.
• Right to non-discrimination: This specifies that MRTICS will not discriminate against you in any way or under any circumstance for exercising your rights to your data under the CCPA.
• Right to withdraw consent: In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Privacy Officer (see contacts below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legal basis for doing so.

If you are a US resident and want to exercise one of the above rights in connection to your personal data, please contact our Data Privacy Officer (see contacts below).

What we may need from you

If you exercise one of the above rights, we may need to request specific information from you to help us confirm your identity and that you are entitled to make such a request. This is to ensure that personal data is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Protection Officer (see contacts below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legal basis for doing so.

Data Protection Officer

We have appointed Data Protection Officer (DPO) to oversee compliance of MRTICS with applicable data protection laws and with this privacy notice. If you have any questions about this privacy notice or how we handle your personal data, please contact the DPO:

Data protection supervisory Authority under GDPR

If you're not satisfied of how we process your personal data and the processing of your personal information is subject to the EU GDPR, you can lodge a complaint at any time to our Data Protection Officer or to the relevant data protection supervisory Authority; you can find the complete list of the European Authorities here.

Changes to this privacy statement

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

(Last Updated: 01 June 2021)