Data Protection & Privacy Policy

1. Purpose and Scope

1.1 The purpose of this Data Protection Policy (this Policy) is to set out the framework within which Group Rhine collects, uses, stores, shares and protects Personal Data. It states how Group Rhine processes the Personal Data it holds, in accordance with the Digital Personal Data Protection Act, 2023 (the DPDP Act), the Digital Personal Data Protection Rules, 2025 (the DPDP Rules) and other applicable Data Protection Law.

1.2 This Policy applies to all employees (permanent, fixed term or temporary), directors, officers, managers, consultants, contractors, interns, trainees, volunteers, home workers, part-time workers and agency workers of Rhine group companies and its subsidiaries, affiliates, group companies, successors and permitted assigns (together, Group Rhine), referred to collectively as Individuals.

1.3 This Policy covers Personal Data of Individuals, job applicants, customers, suppliers, business contacts and visitors, in digital form or in non-digital form that is later digitised.

2. Key Terms

Capitalised terms used in this Policy are defined in Annexure A.

3. Data Protection Principles

3.1 Group Rhine shall apply the following principles to all Personal Data it processes:

• (a) Lawfulness, fairness and transparency: Personal Data shall be processed lawfully, fairly and transparently, only on the basis of valid Consent or a Legitimate Use permitted under the DPDP Act.
• (b) Purpose limitation: Personal Data shall be collected only for specified, clear and lawful purposes stated in a Notice, and not processed in a manner incompatible with those purposes.
• (c) Data minimisation: Personal Data shall be adequate, relevant and limited to what is necessary for the stated purpose.
• (d) Accuracy: Group Rhine shall make reasonable efforts to keep Personal Data accurate, complete and up to date, particularly where it is used to make decisions about a Data Principal or is shared with another Data Fiduciary.
• (e) Storage limitation: Personal Data shall be retained only as long as necessary for the stated purpose or as required by law, and then erased.
• (f) Security: Reasonable Security Safeguards shall be implemented to prevent Personal Data Breaches, including unauthorised processing, accidental loss, destruction, damage or theft.
• (g) Accountability: Group Rhine shall be responsible for compliance with this Policy, including for processing carried out on its behalf by Data Processors.

4. Collection, Use and Processing of Personal Data

4.1 Group Rhine shall process Personal Data only for a lawful purpose and only in connection with employment or engagement, the provision of goods and services, or the operation of its business. Processing shall be in ways a Data Principal would reasonably expect and shall not have unjustified adverse effects on them.

4.2 Consent: Where processing is based on Consent, the Consent shall be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the Personal Data necessary for the specified purpose. Every request for Consent shall be accompanied or preceded by a Notice in the form set out in Annexure E. Consent may be withdrawn at any time, as easily as it was given.

4.3 Legitimate Uses: Group Rhine may process Personal Data without Consent for the Legitimate Uses permitted under Section 7 of the PDPP Act, including:

• For the purposes of employment, or to safeguard Group Rhine from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets and intellectual property, or provision of any service or benefit sought by an employee;
• For a specified purpose for which the Data Principal has voluntarily provided their Personal Data and has not indicated that they do not consent to its use;
• To fulfil any obligation under any law in force in India, or to comply with any judgment, decree or order;
• To respond to a medical emergency, or to ensure safety during any disaster or breakdown of public order;
• The prevention, detection or investigation of offences, and the assessment or collection of any tax or duty, as permitted by law.

4.4 Further standards for collection and processing are set out in Annexure B.

5. Security and Personal Data Breaches

5.1 Group Rhine shall implement Reasonable Security Safeguards in accordance with the PDPP Rules, including encryption, obfuscation or masking of Personal Data; access controls on a need-to-know basis; logs and monitoring to detect unauthorised access; backups to ensure continuity; retention of logs for at least one year; and appropriate contractual safeguards with Data Processors. Group Rhine may additionally align its controls with IS/ISO/IEC 27001.

5.2 Every Individual shall comply with the security measures in Annexure C.

5.3 Breach intimation: On becoming aware of a Personal Data Breach, Group Rhine shall, without delay, inform each affected Data Principal of its nature, extent, likely consequences, mitigation measures and the contact point for queries; and shall inform the Data Protection Board of India without delay, followed by a detailed report within seventy-two (72) hours, or such longer period as the Board may allow.

6. Use of Personal Data

The purposes for which Group Rhine uses Personal Data are set out in Annexure D.

7. Sharing with Third Parties

7.1 Group Rhine does not sell Personal Data. It may share Personal Data, only to the extent necessary and in compliance with Data Protection Law, with:

• Other members of Group Rhine, including their employees, directors and officers;
• Data Processors such as IT, cloud hosting, payroll, HR, background verification, insurance and benefits providers, engaged under a valid written contract;
• Clients and customers of Group Rhine, where necessary for the performance of services;
• Professional advisers, auditors, banks and financial institutions;
• Regulators, government authorities, law enforcement agencies (including tax, social security and labour authorities), courts and tribunals, where required by law;
• Any person in connection with a sale, merger, acquisition, demerger, reorganisation or similar change of the business or assets of Group Rhine, including potential purchasers and their advisers; and
• Education and training organisations, recruitment agencies, and past or prospective employers (for reference checks), with the Individual's knowledge.

7.2 Before Personal Data is disclosed to any Data Processor, the Data Protection Officer shall be consulted and a contract containing appropriate data protection and security obligations shall be in place.

8. Transfer of Personal Data outside India

Personal Data may be transferred to and processed in countries outside India, including to international group companies or service providers, except to any country or territory restricted by the Central Government under Section 16 of the PDPP Act. Group Rhine shall ensure that recipients protect such Personal Data to a standard no lower than that set out in this Policy and shall comply with any requirements notified under the PDPP Rules.

9. Retention and Erasure

9.1 Personal Data shall be retained in accordance with Group Rhine's Document Retention Policy and erased once the purpose is no longer served, Consent is withdrawn, or the retention period required by law expires, whichever is later. Indicative periods are below:

Category	Indicative retention period
Employee personnel and payroll records	Duration of employment + 8 years
Unsuccessful job applicant data	12 months from closure of recruitment
Statutory, tax and accounting records	As required by applicable law (generally 8 years)
Customer and supplier contact data	Duration of relationship + 3 years
System, access and security logs	Minimum 1 year
CCTV footage	30-90 days, unless required for an investigation

9.2 Where Group Rhine is required to erase Personal Data on account of a Data Principal's inactivity under the PDPP Rules, it shall notify the Data Principal at least forty-eight (48) hours before erasure.

10. Rights and Duties of Data Principals

10.1 Every Data Principal has the right to:

• (a) Access information: Obtain a summary of their Personal Data processed by Group Rhine, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared;
• (b) Correction and erasure: Have inaccurate or incomplete Personal Data corrected, completed or updated, and have Personal Data erased once it is no longer necessary, unless retention is required by law;
• (c) Withdraw Consent: At any time, without affecting the lawfulness of processing before withdrawal;
• (d) Grievance redressal: Have grievances addressed by the Data Protection Officer and, thereafter, approach the Data Protection Board of India; and
• (e) Nominate: Nominate another individual to exercise these rights in the event of their death or incapacity.

10.2 Individuals shall provide accurate Personal Data, promptly update any changes, not impersonate another person, not suppress material information, and not register false or frivolous grievances.

10.3 Requests may be made to the Data Protection Officer. Group Rhine may verify the identity of the requester and shall respond within [30] days.

11. Children's Personal Data

Group Rhine does not knowingly process Personal Data of any person under eighteen (18) years of age, except where required (for example, dependants of employees for insurance and benefits), in which case verifiable consent of the parent or lawful guardian shall be obtained. Group Rhine shall not undertake tracking, behavioural monitoring or targeted advertising directed at children.

12. Data Protection Officer and Grievance Redressal

12.1 Group Rhine has designated the following person as its Data Protection Officer and Grievance Officer:

Name	Jyoti Swaroop
Designation	Head operations
Email	service@grouprhine.com
Phone	+91 80590 49080
Address	Plot 44, Sector 5, IMT Manesar, Gurgaon-122052

12.2 The Data Protection Officer shall ensure implementation of this Policy, make it available to Individuals, maintain records of processing, and redress grievances expeditiously and in any case within [30] days of receipt. In the absence of the Data Protection Officer, Individuals may contact the Head - Legal or the Company Secretary.

13. Compliance

Compliance with this Policy is mandatory. Any Individual found to have intentionally or negligently violated this Policy may be subject to disciplinary action, up to and including termination of employment or engagement, in accordance with applicable law. Any suspected violation shall be reported to the Data Protection Officer immediately.

14. Review and Transition

14.1 The Data Protection Officer, in consultation with management, shall review this Policy at least annually and whenever there is a material change in law or business operations.

14.2 The PDPP Rules come into force in phases. Until the substantive provisions take effect (on 13 May 2027, per the PDPP Rules as notified), Group Rhine shall also continue to comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable.

---

Annexure A - Key Terms

• "Consent" means consent of the Data Principal as described in Section 6 of the PDPP Act and paragraph 4.2 of this Policy.
• "Data Fiduciary" means any person who alone or with others determines the purpose and means of processing Personal Data. For this Policy, Group Rhine.
• "Data Principal" means the individual to whom the Personal Data relates; for a child or a person with disability, includes their parent or lawful guardian.
• "Data Processor" means any person who processes Personal Data on behalf of a Data Fiduciary.
• "Data Protection Board" means the Data Protection Board of India established under the PDPP Act.
• "Data Protection Law" means the PDPP Act, the PDPP Rules, the Information Technology Act, 2000 and rules made under it, and any other applicable law on protection of Personal Data, as amended from time to time.
• "Data Protection Officer" means the person designated by Group Rhine under paragraph 12 of this Policy.
• "Legitimate Use" means the uses set out in Section 7 of the PDPP Act for which Personal Data may be processed without Consent.
• "Notice" means the notice given to a Data Principal before or at the time of seeking Consent, in the form set out in Annexure E.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Personal Data Breach" means any unauthorised processing of Personal Data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data that compromises its confidentiality, integrity or availability.
• "Processing" means a wholly or partly automated operation or set of operations performed on digital Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
• "Reasonable Security Safeguards" means the technical and organisational measures required under the PDPP Rules and described in paragraph 5 and Annexure C of this Policy.
• "Sensitive Personal Data" means personal Data of a sensitive nature, including passwords; financial information such as bank account, credit or debit card details; physical, physiological and mental health condition; sexual orientation; medical records and history; biometric information; and government-issued identifiers. Such data shall be subject to heightened safeguards.

Annexure B - Standards for Collection and Processing

• (a) Collect only such Personal Data as is necessary for the purpose for which it is collected.
• (b) Before collecting Personal Data, inform the Data Principal (through a Notice where Consent is sought) of: the Personal Data to be collected and the purpose; how to withdraw Consent and exercise their rights; and how to complain to the Data Protection Board.
• (c) Ensure Personal Data in company records is updated as provided by the Individual, and correct inaccuracies promptly.
• (d) Do not retain Personal Data longer than necessary, taking into account its purpose, legal and regulatory obligations, and the Document Retention Policy.
• (e) Process Sensitive Personal Data only with explicit Consent or where a Legitimate Use clearly applies, and with heightened security.
• (f) Do not use Personal Data for any new purpose without assessing its lawfulness and, where required, obtaining fresh Consent.
• (g) Contact the Data Protection Officer to obtain standard Notice and Consent formats. Any decision not to provide a Notice must be referred to the Data Protection Officer.

Annexure C - Security Measures for Individuals

• (a) Comply with Group Rhine's IT, Information Security, HR and other policies, and any guidelines issued from time to time.
• (b) Access only the Personal Data you need for your role; use strong passwords and multi-factor authentication; lock devices when unattended.
• (c) Do not store Personal Data on personal devices, personal email or unapproved cloud services; encrypt removable media where its use is authorised.
• (d) Do not disclose Personal Data to, or alter it at the request of, any third party (including law enforcement or regulators) unless you are sure the third party is authorised by Group Rhine to receive it. If in doubt, contact the Data Protection Officer first.
• (e) Report immediately to the Data Protection Officer and the IT Helpdesk ([itsecurity@grouprhine.com]) any actual or suspected Personal Data Breach, such as lost or stolen devices, misdirected emails, or unauthorised access.
• (f) Dispose of printed Personal Data by shredding and digital data by approved secure deletion methods.
• (g) Before engaging a service provider, third party or group company to process Personal Data, consult the Data Protection Officer to ensure appropriate contractual and security safeguards are in place.

Annexure D - Purposes of Use of Personal Data

Group Rhine may, itself or through a Data Processor or member of Group Rhine, process Personal Data, including Sensitive Personal Data where lawful, for the following purposes:

• (a) Performing obligations in connection with employment or engagement, including recruitment, background and reference checks, onboarding, performance management, training and development, payroll, statutory deductions, provident fund, gratuity, insurance and benefits administration;
• (b) Managing and operating Group Rhine's businesses, technology infrastructure, facilities and property, including monitoring of systems and premises for security purposes;
• (c) Administering relationships with customers, suppliers and business partners;
• (d) Advertising, marketing and developing the business of Group Rhine, and public relations, subject to Consent where required;
• (e) Preventing and detecting fraud and breaches of law or policy, and supporting investigations, including through the use of CCTV;
• (f) Complying with law, regulation, and lawful requests of regulators, government and law enforcement authorities, tax authorities and stock exchanges, and with any court order or in connection with litigation;
• (g) In connection with any sale, merger, acquisition, demerger, reorganisation or similar transaction, including due diligence; and
• (h) Any other purpose reasonably incidental to the above purposes and notified to the Data Principal.

Where necessary and lawful, Group Rhine may continue to process an Individual's Personal Data after cessation of employment or engagement, for example to meet statutory record-keeping obligations, settle dues, or respond to reference requests.