Privacy Policy for India (Digital Personal Data Protection Act 2023)

1. Purpose

This policy explains how Unolabs Technologies Private Limited ("we", "us") handles digital personal data in India. It tells you what we collect, why, how long we keep it, and how to use your rights.

2. Scope

This policy covers digital personal data we process in India as a Data Fiduciary. That means we decide why and how it is processed. It covers:

• people who apply for jobs or engagements with us;
• our employees, consultants and contractors;
• business contacts at clients, suppliers and partners;
• people who contact us by email or phone.

It does not cover:

• data we process only on behalf of a client. The client is the Data Fiduciary, and its own notice applies. We act as its Data Processor and follow its instructions under a contract;
• personal data kept on paper and never put into digital form;
• processing in the United Kingdom by Unolabs Limited. That is covered by our Data Protection Policy (UK GDPR and Data Protection Act 2018).

3. Legal framework

• The Digital Personal Data Protection Act 2023 (the "Act").
• The Digital Personal Data Protection Rules 2025 (the "Rules").

The Act and the Rules come into force in phases. Until a duty applies to us, we follow it as good practice. We do not claim that a duty is in force before its start date.

The Government has not notified us as a Significant Data Fiduciary.

4. Roles and responsibilities

• Director (India entity): owns this policy, approves changes and is accountable for compliance.
• Grievance Officer (India): Akshay Raj, contact info@unolabs.com. He answers questions about your data, handles rights requests and grievances, and keeps a record of each one.
• Staff with access to personal data: use it only for the purpose it was collected for, and report any suspected breach straight away.

5. Our commitments

5.1 Notice

When we ask for your consent, we give you a notice first. It says what data we collect and why. It also says how to withdraw consent, use your rights and complain to the Data Protection Board of India. The notice is in English. You can ask for it in any language listed in the Eighth Schedule to the Constitution.

5.2 Consent and withdrawing consent

Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, and you give it by a clear action. We ask only for data we need for the stated purpose.

You can withdraw consent at any time, as easily as you gave it, by emailing info@unolabs.com. We then stop processing, and ask our Data Processors to stop, within a reasonable time. Withdrawal does not affect processing done before it. Once Consent Managers are registered with the Data Protection Board, you may also use one.

5.3 Legitimate uses

We may process some data without consent where section 7 of the Act allows it, for example:

• data you give us voluntarily for a stated purpose, where you have not said you object;
• data needed for employment, or to protect us from loss or liability;
• data needed to meet a legal duty, or a court order;
• data needed in a medical emergency or a disaster.

5.4 Purposes

We do not use your data for a new purpose without telling you first, and asking for consent where the Act requires it.

5.5 Children and people with disabilities

Our services are not aimed at children (people under 18). We do not knowingly process a child's data. If we ever need to, we will first get verifiable consent from a parent or lawful guardian. We do not track, monitor behaviour or target advertising at children.

For a person with a disability who has a lawful guardian, we get the guardian's consent.

5.6 Accuracy and security

We take reasonable steps to keep data accurate and complete when we use it to make a decision about you. Before the security duty applies to us, we will document reasonable safeguards to prevent a personal data breach.

5.7 Retention

We keep personal data only as long as we need it for its purpose, or as long as the law requires. Then we erase it, and we ask our Data Processors to erase it too. Where the Rules set a minimum period for keeping records or logs, we follow it.

5.8 Transfers outside India

We may transfer personal data outside India, for example to our group company in the UK, Unolabs Limited, or to service providers. We do not transfer data to any country the Government restricts by notification. Where a sector law sets a stricter rule, we follow it.

5.9 Non-residents' data under foreign contracts

Section 17(1)(d) of the Act gives a partial exemption. It applies when we process, in India, data of people outside India under a contract with a person outside India. Most of the Act's duties and rights then do not apply. We still keep that data secure (section 8(5)) and make sure our processing follows the Act (section 8(1)). The data protection law of the person's own country, and our contract, also apply.

6. Your rights and how to use them

As a Data Principal, you have the right to:

• Access: get a summary of your data, how we process it, and who we have shared it with;
• Correction and completion: have inaccurate or incomplete data corrected or completed, and out-of-date data updated;
• Erasure: have data erased once it is no longer needed, unless the law requires us to keep it;
• Grievance redressal: have your complaint handled by us;
• Nomination: name another person to use your rights if you die or become unable to act.

How to ask: email our Grievance Officer (India), Akshay Raj, at info@unolabs.com. Use the subject line "For the Grievance Officer (India)". Tell us which right you are using. We may ask you to prove your identity first.

Response times: we acknowledge your request within 7 working days and reply in full within 30 working days. The Rules set an outer limit of 90 days. If we cannot reply within 30 working days, we tell you why and when you will hear from us.

Escalation: if you are not satisfied with our reply, you can complain to the Data Protection Board of India. The Act asks you to use our grievance route first. The Board accepts complaints online through its digital office.

7. Personal data breaches

If a personal data breach happens, we will tell each affected Data Principal without delay. We will say what happened, the likely effect, what we are doing about it, and how you can protect yourself.

We will also tell the Data Protection Board without delay. We will send it a detailed report within 72 hours of becoming aware of the breach, or longer if the Board allows. These duties apply from the date set by the Rules. Until then, we follow this process as good practice.

Staff report any suspected breach to the Grievance Officer (India) straight away.

8. Monitoring, review and changes

The Director reviews this policy every 12 months. We also review it when a DPDP Rules commencement date arrives, or when the law changes. We publish each new version on this page with its date.

9. Contact