1. Introduction

Quantiphi Inc. (“we”, “our”, “us”) is committed to protect the privacy and security of your personal data that we process. It is important that you read this Privacy Notice (“Notice”), so that you are aware of how and why we are using your personal data, and the rights available to you.

2. Applicability

This Notice applies to all third-party service providers including vendors, contractors, etc. This Notice does not form part of any contract to provide services.

3. Scope

Though the General Data Protection Regulation (GDPR) has been considered as the baseline for this notice, data protection and privacy legislations of other jurisdictions, those largely applicable to Quantiphi, have also been taken into consideration.

4. Relationship

We are the “Data Controller” of your personal data. This means that we decide why and how we process your personal data.

5. What personal data do we collect?

We may process the following categories of personal data about you, as applicable to you:

• Personal Data, such as:
  • Including but not limited to Full Name, Phone Number, Corporate Email ID, PAN Number, etc.
• Employment Data, such as:
  • Including but not limited to Designation, Name of the Organization, Address, etc.
• Sensitive Personal Data, such as:
  • Signature, as part of the tax documents.
• Bank Details

6. How do we collect your personal data?

We collect and maintain personal data about you that are required to be filled at the time of third-party approval and during on-boarding.

All data, including any additional data collected, will be used, and stored for performance of the service agreement, as well as for complying with our legal obligations or legitimate interests.

7. Purposes of processing your personal data

We will use your personal data for the following purposes:

5. To validate the vendor details
6. To create a purchase order for verified and approved vendors
7. To maintain records, such as for audit purposes
8. To initiate payment processing and invoice

We rely on the following lawful basis:

9. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. (For example, we need to process for administrative and record keeping purposes, etc.)
10. Where we need to protect your vital interests (or someone else's interests).
11. Where we need to comply with a legal obligation.
12. Where we need to comply with Performance of Contract.

We will only use your personal data for the purposes stated in this Notice. If we need to use your personal data for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so without undue delay. Please note, that in case we process your personal data without your knowledge or consent, it will be in compliance with the applicable data protection legislations.

8. Data sharing

We may share your personal data with the following:

13. Internal / external auditors
14. Internal Procurement and Finance department for the performance of their roles

We may transfer your personal data to other processing locations in cases where our data centers are located in other geographical locations. In such instances, we enter into adequate data processing agreements in accordance with applicable data protection laws (including the Standard Contractual Clauses, as applicable).

9. Data security

We have put in place measures to safeguard your personal data, such as restricting access to only authorized individuals.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

10. Data retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for. To determine the appropriate retention period for personal data, we consider the business (for example, for reporting / accounting purposes), contractual, or applicable legal and regulatory requirements. Once the purpose has been fulfilled, we securely delete your personal data, unless we need to retain it in circumstances such as the following:

15. Ongoing investigations from official authorities, seeking records of personal data to prove compliance with any legal requirements.
16. When exercising legal rights in cases of lawsuits or similar court proceedings recognized under local law.

11. What rights do you have?

Under certain circumstances, you may have the following rights:

• Right to Access: You have the right to request from us information on the personal data about you that we process at any time. This also enables you to receive a copy of the personal data we hold about you.
• Right to Rectification of Incorrect Data: If data about you is inaccurate, you have the right to obtain from us the rectification of such data without undue delay.
• Right to Erasure / Deletion: You have the right to request from us the erasure of your personal data.
• Right to Restriction of Processing: You have the right to obtain from us restriction of processing.
• Right to Object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you.
• Right to Non-Discrimination: You have the right to exercise any of the rights listed above (and any other rights under CCPA) without discrimination by us.
• Right to Data Portability: You have the right to ask us to transfer your personal information directly to you. This applies to certain personal information if processed by automated means and with your consent, or based on the contract you have with us.
• Right to Withdrawal of Consent (or Opt-Out): Where explicit consent has been sought for processing of personal data, you have the right to withdraw your consent at any time. Once we have received notification of withdrawal, we will no longer process your data for the specified purpose unless we have another lawful basis to do so in law. You may withdraw your consent in the following scenarios:
  1. Opt-out from marketing communications sent to you. In such cases, Quantiphi will provide an email address to opt out and include an unsubscribe link in marketing communications. You may also opt out of the sale or sharing of your personal data (and exercise any other rights under CCPA).
• Right Related to Automated Decision-Making: We do not use your personal data to make decisions with legal or similar effects based solely on automated processing. If such processing is introduced in the future, you will be informed along with your rights to opt out.
• Right to Nominate: You have the right to nominate another individual who, in the event of your death or incapacity, shall have the authority to exercise your rights (and any other rights under DPDPA).

12. Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

13. Data protection officer

We have appointed a data protection officer (DPO) Mr. Vishal Kalro to oversee compliance with this Notice. If you have any questions about this Notice or how we handle your personal data, please contact the DPO at privacy@quantiphi.com.

14. Changes to this Notice

This notice is effective as of the approved date. We reserve the right to update or change this at any time, and we will provide you with the updated notice when we make any substantial updates at the earliest either through email or by providing a prominent notice of change on the website. You should check the notice periodically. Your continued use of the website after we post any modifications to the notice on this page will constitute your acknowledgment of the modifications and your consent to abide by and be bound by the modified notice.