Company Data & Privacy Policy

Scope‍

This Policy applies to all employees of the Company and, where applicable, to contractors, consultants, interns, or third-party vendors who have access to any Company data. This includes data of customers, employees, partners, vendors, and clients, whether in electronic, digital, or any other form (collectively referred to as “Employees” for ease of reference).

‍
Authority Concerned‍

For any questions or clarifications regarding this Policy, please contact the HR Team.

Conflict‍

This Policy should be read in conjunction with all other Company policies related to data confidentiality and privacy. In the event of any conflict with an employment or engagement agreement, the terms of that agreement shall prevail.

‍Purpose‍

The purpose of this Policy is to establish clear guidelines for handling, protecting, and maintaining the confidentiality of Company data, trade secrets, sensitive information, and personal data of customers, partners, and employees. It also outlines the rights and obligations of Employees with respect to their own personal data.

‍Definitions and General Obligations

Company Data refers to all information related to the Company and its stakeholders, created or accessed during the course of employment, including personal and confidential information.

Confidential Information includes proprietary and non-public information such as product roadmaps, source code, financial data, compensation details, personnel files, trade secrets, and business plans.

Personal Data includes personally identifiable information (PII) such as names, financial data, health records, passwords, and background verification details. Employees must not access or disclose such data without proper authorization.

Employees must maintain strict confidentiality of Company Data at all times and must not use or disclose such data unless specifically authorized. This obligation continues even after the end of employment.

Unauthorized use or disclosure of confidential information may result in disciplinary action, up to and including termination, and may also invite legal consequences. If an employee has any uncertainty as to whether someone is authorized to receive certain trade secret or Confidential Information, including colleagues at the Company, the employee should contact the Company’s CEO or Reporting Manager.

‍
Compliance with Related Policies

This Policy must be followed along with related Company policies, including but not limited to:

• Acceptable Use Policy
• Access Control Policy
• Asset Management
• Backup and Restoration Procedures
• Business Continuity
• Cloud Security
• Confidentiality and Data Breach Policies
• Disaster Recovery
• Encryption and Endpoint Security
• Incident Management
• Network and Physical Security
• Risk Management
• Vendor Management
• IT and HR Security Policies

‍

Inventions and Intellectual Property

All inventions, designs, documents, or intellectual property created during employment shall remain the sole property of the Company. Employees are required to sign a Confidentiality and Invention Assignment Agreement as a condition of employment.

Responsibilities of Employees

Data Handling

Handle data responsibly and only access what is required for your role.
Collect data only with explicit consent and use it solely for authorized purposes.
Store data securely on Company-approved platforms.

Access Control

Access to data must be based on job requirements.
Do not share login credentials.
Always log out from systems containing personal data when not in use.‍

Data Sharing

Personal data must not be shared with unauthorized third parties.
When required for business purposes, ensure secure transmission and consent from the data subject.

‍
Compliance

Follow all applicable data protection and privacy laws.
Process personal data lawfully, transparently, and for legitimate purposes only.

Prohibited Activities

Unauthorized copying, downloading, transferring, or deletion of Company Data.
Use of personal email or storage for Company Data.
Sharing credentials or granting unauthorized access to Company systems.

Offensive or Inappropriate Use

Use of Company systems for offensive, discriminatory, or illegal content is strictly prohibited.
Examples include but are not limited to: sexually explicit material, racial slurs, gender-based insults, or accessing pirated or pornographic content.

Monitoring and Compliance

The Company reserves the right to monitor Employee access and usage of Company Data to ensure policy compliance. Violations may result in disciplinary action, including termination, and may be legally actionable.

Incident Reporting

Employees must immediately report any suspected data breach, unauthorized access, or loss of Company Data to the HR or IT team. Do not attempt to handle breaches independently. Non-reporting will be treated as serious misconduct.

Training and Awareness

All Employees are required to attend data security and privacy training as part of onboarding and as per periodic schedules. Attendance in these sessions is mandatory.

Employee Personal Data and Privacy

Consent

By accepting employment, Employees consent to the collection, processing, and use of their personal data for lawful employment-related purposes, including:

• Recruitment and onboarding
  
• Payroll, taxation, and benefits
  
• Performance management
  
• IT and security monitoring
  
• Legal compliance and investigations

‍

Retention and Security

• Personal data will be retained only as long as necessary or as mandated by law.
  
  
• Upon termination, data will be archived or destroyed securely in compliance with Company policy and legal requirements.
  
  

Data Sharing

Personal data may be shared with third-party service providers (e.g., payroll processors, insurers) only for legitimate purposes and with appropriate safeguards.

No Expectation of Privacy

All data stored or transmitted on Company devices, systems, or platforms is Company property. The Company reserves the right to access, monitor, and review such data, including personal messages sent through Company systems.

Review and Amendment‍

This Policy may be reviewed and updated periodically at the Company’s discretion to reflect changes in Company practices or applicable laws, with reasonable notice of substantial changes to Employees.

‍