DPDP Act notice.

About this notice.

This DPDP Act Notice is issued by Vijaya Bhanu Engineering India Private Limited, trading as VB Group ("VB", "we", "us", "our"), under the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act") and the rules notified thereunder.

It supplements the general VB Group Privacy Policy with the specific disclosures required of a Data Fiduciary for Data Principals in India. To the extent of any inconsistency between this Notice and the Privacy Policy on a matter governed by the DPDP Act, this Notice prevails.

Data Fiduciary identity.

Personal data we process.

The categories of personal data VB processes are set out in detail in Section 03 of the Privacy Policy. They include, in summary: identification and contact data, engagement and platform usage data, operational and industrial data, recruitment data, marketing and event data, and (in limited and lawful circumstances only) sensitive-category data.

Purposes and lawful basis.

VB processes personal data for the purposes listed in Section 04 of the Privacy Policy, on the lawful bases listed in Section 05 of the Privacy Policy. Under the DPDP Act, these lawful bases include:

• Consent, taken in compliance with Section 6 of the DPDP Act;
• Certain legitimate uses recognised under Section 7 of the DPDP Act, including performance of contract, compliance with judgment or order, response to medical emergency, employment-related purposes, and the provision of services or benefits where you have voluntarily provided your personal data.

Consent and withdrawal.

Where VB relies on your consent to process your personal data, your consent is freely given, specific, informed, unconditional and unambiguous, signified by a clear affirmative action and limited to the personal data necessary for the specified purpose.

You may withdraw your consent at any time by emailing connect@groupvb.com with the subject line "DPDP: Consent withdrawal". The consequence of withdrawal is that VB will cease the relevant processing within a reasonable period and, where the processing is no longer otherwise justified, will cause its data processors to cease processing as well. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal, nor does it affect processing that VB is required or permitted to continue under any other lawful basis.

Your DPDP rights.

Under the DPDP Act, you have the following rights in respect of personal data we process about you:

1. Right to access information about personal data (Section 11 of the DPDP Act). You may request a summary of personal data being processed and the processing activities undertaken, the identities of Data Fiduciaries and Data Processors with whom personal data has been shared, and any other information as prescribed.
2. Right to correction and erasure of personal data (Section 12 of the DPDP Act). You may request correction of inaccurate or misleading personal data, completion of incomplete personal data, updating of out-of-date personal data, and erasure of personal data that is no longer necessary for the purpose for which it was processed and is not otherwise required to be retained.
3. Right of grievance redressal (Section 13 of the DPDP Act). You may raise a grievance regarding any act or omission of VB or its Data Processors that affects your rights.
4. Right to nominate (Section 14 of the DPDP Act). You may nominate another individual to exercise your rights in the event of your death or incapacity. Your nominee will be authorised to exercise those rights on your behalf.

The exercise of these rights is subject to the conditions, exceptions and limitations set out in the DPDP Act and the rules notified thereunder, including verification of your identity.

How to exercise your rights.

To exercise any DPDP right, email connect@groupvb.com with a clear subject line ("DPDP: Access", "DPDP: Correction", "DPDP: Erasure", "DPDP: Nomination" or "DPDP: Grievance") and the following information:

• your full name and contact information;
• the nature of your request;
• sufficient detail to identify the personal data and the processing activity to which your request relates;
• any supporting documentation reasonably necessary for VB to verify your identity and the validity of your request.

VB will acknowledge your request within seven (07) working days and respond substantively within the timeframe prescribed by applicable rules under the DPDP Act, currently expected to be a reasonable period not exceeding the statutory limit notified by the Central Government from time to time. Where additional time is required, you will be notified of the reason for the delay.

VB reserves the right to charge a reasonable fee for handling manifestly unfounded, excessive or repetitive requests, or to refuse to act on such requests, to the extent permitted by law.

Grievance redressal.

If you are not satisfied with VB’s response, or if you have any concern about how VB processes your personal data, please escalate to our Grievance Officer:

Cross-border transfers.

VB operates from India and the United States and serves clients across 21+ countries. Personal data may be transferred to and processed outside India, including in the United States and any other jurisdiction in which VB, its affiliates, its operating companies or its sub-processors operate, subject to any restriction notified by the Central Government under Section 16 of the DPDP Act.

VB will maintain appropriate contractual, technical and organisational safeguards for cross-border transfers as required by applicable law.

Retention.

VB retains personal data only for as long as is necessary for the purposes for which it was processed, taking into account VB’s contractual obligations, statutory recordkeeping obligations, audit and tax obligations, the period required to defend or pursue legal claims, and the retention period of any disaster-recovery and archival systems. When the personal data is no longer necessary, VB will delete or de-identify it.

Children and persons with disability.

VB’s services are directed at industrial organisations and business contacts. VB does not knowingly process the personal data of a child (as defined under the DPDP Act, being an individual who has not completed eighteen years of age) or of a person with disability who has a lawful guardian, without verifiable parental or guardian consent obtained in the manner prescribed under the DPDP Act and the rules notified thereunder.

VB does not undertake tracking or behavioural monitoring of children, nor does VB target advertising to children. If you believe VB has processed a child’s personal data without verifiable parental or guardian consent, please contact the Grievance Officer and VB will take appropriate action.

Significant Data Fiduciary status.

The Central Government may notify VB, or a class of Data Fiduciaries to which VB belongs, as a Significant Data Fiduciary under Section 10 of the DPDP Act, based on factors including the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, and the impact on the sovereignty and integrity of India.

If VB is so notified, additional obligations will apply, including the appointment of a Data Protection Officer based in India, the appointment of an independent data auditor, periodic Data Protection Impact Assessment, periodic audits, and any other measures prescribed. VB will update this Notice to reflect such status if and when it applies.

Updates to this notice.

VB may amend this Notice from time to time to reflect changes in law (including amendments to the DPDP Act or notification of rules thereunder), in VB’s services and operations, or in industry practice. The "Last updated" date at the top of the page indicates the date of the most recent revision. Material changes will be brought to your attention by reasonable means, which may include posting on this page.