TataWorld Privacy Policy and Legal Disclaimer

This Privacy Notice is issued pursuant to the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”) and UK GDPR. It sets out the categories of personal data collected, purposes of processing, lawful bases, data subject rights, grievance redressal mechanisms, cross-border transfer safeguards, and retention practices.

1. Scope

This portal (www.TataWorld.com) and its sub-domains and sub-links (“TataWorld”), processes personal data necessary for employment-related and internal administrative purposes, as set out in detail hereinbelow.

Under the DPDP Act, Tata Sons Private Limited (“we” or “us”) acts as a Data Fiduciary of such personal data processed through TataWorld, and the purposes set out hereinbelow may constitute a ‘legitimate use’ under Section 7. For employees located in the EU/EEA/UK, processing is based on Article 6 GDPR’s lawful bases, including performance of employment contract, compliance with legal obligations, and legitimate interests. Consent shall be relied upon only where required and obtained through clear affirmative action.

2. What personal data we collect

The following categories of personal data processed may include:

• Identification details (name, employee ID, designation)
• Contact details (email, country code, phone number)
• Organizational details (company, function)
• Login credentials and authentication information
• Usage logs and system activity records
• Content voluntarily posted on TataWorld

3. How we collect personal data

We may collect your personal data in several ways from your use of TataWorld, including:

• when you contact us (through any form, by providing your e-mail address)
• when you enter a contest, competition or promotion
• when you opt to receive any communications (including any newsletter or offers)
• when you upload posts, comments, or media on TataWorld
• information provided by you through the employee engagement program
• Cookies on your browser may capture your IP address and geo-location when you visit TataWorld (as per the cookie settings of your browser).

4. Our use of your personal data

Your data may be used by us for the following purposes:

• Name and company details: other users registered on TataWorld may be able to see your first name, last name, email address and company name.
• Email: (i) transmission of marketing materials related to TataWorld to you; (ii) contact for survey or feedback; and (iii) to process your requests (such as replying to your queries).
• Country code and mobile number: to contact you ahead of any event being organised by Tata Sons or TataWorld, in which you are either participating or being invited.
• Usage logs: for IT security, to improve system performance, audit, compliance, and prevention of unauthorized access. Monitoring is proportionate and limited to legitimate business purposes.

If you are not satisfied with this, you have the right to object in certain circumstances (see the section headed "Your rights" below).

5. Who do we share personal data with

We may share your personal data with our employees, vendors, agents and professional advisors working to provide TataWorld to you, and with service-providers who assist in protecting and securing our systems and to carry out analytics at the aggregate level, which might be used for driving improvements on TataWorld.

We do not share other personal data collected from TataWorld with other third parties unless:

• You request or authorise us to do so;
• We need to comply with applicable law or respond to valid legal process; or
• We need to operate and maintain the security of this website, including preventing or stopping an attack on our computer systems or networks.

6. Keeping data secure

We are committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your data from unauthorized access, use or disclosure. We use technical and organizational measures to safeguard your personal data, and we take full caution from our end to store your data on secure servers. Technical and organizational measures include measures to deal with any suspected data breach. If you suspect any misuse or loss or unauthorized access to your data, please let us know immediately by contacting us via e-mail on tataworld@tata.com.

In case of a data breach, we will notify the data subjects about the type of breach, type of personal data involved, actions that we will take for affected persons and assistance to affected persons to help assist themselves.

7. Retention of personal data

Personal data shall be retained only for as long as necessary to fulfil the specified purpose or comply with legal, regulatory, audit, employment, or record-keeping requirements. For EU/EEA/UK employees, retention criteria include duration of employment, limitation periods, and IT security requirements. Data shall be erased where it is no longer necessary.

8. Your rights

• Right of Access – to obtain a summary of personal data.
• Right to Rectification – to correct inaccurate or incomplete data.
• Right to Erasure – to request deletion where legally permissible.
• Right to Restriction – to limit the way in which we use or process your data.
• Right to Data Portability – to receive personal data in a structured format.
• Right to Object – to object to processing of your personal data.
• Right to Nominate – to nominate another person to exercise rights in case of death or incapacity.
• Right to Lodge Complaint – EU/EEA/UK employees may lodge complaints with their supervisory authority; Indian employees may approach the Data Protection Board.

For information about managing your personal data, email subscriptions, promotional communications and/or exercising any of the above rights, please submit a request to us by sending an email on tataworld@tata.com. We reserve the right to request any additional information/ documentation that is required to verify your identity to ensure genuineness of the request and security of the data.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during the period for which we hold it. For programs where your organization is the Data Controller, please reach out to your respective organizational contact.

9. Links to other websites

TataWorld may, from time to time, provide links to other external websites. We have no control over such websites and are not responsible for the content of these websites. This privacy policy does not extend to your use of such websites.

10. Cookies

TataWorld may place and access certain Cookies on your computer. Tata Sons uses Cookies to improve your experience of using TataWorld. For users located in the EU/EEA/UK, non-essential cookies shall be deployed only after obtaining prior consent through an appropriate cookie management mechanism.

It is recommended that you ensure that your internet browser is up-to-date and that you consult the help and guidance provided by the developer of your internet browser on enabling, disabling, or adjusting your Cookies settings.

11. Where we store and process personal data

Personal data collected by us may be stored and processed in your region, in India, and in any other country where Tata Sons or its affiliates, subsidiaries or service providers operate facilities. The storage location(s) are chosen to operate efficiently. We take steps to ensure that the data we collect under this privacy statement is processed as per the provisions of this statement and the requirements of applicable law wherever the data is located.

Cross-border transfers shall comply with Section 16 of the DPDP Act and, where applicable, Chapter V GDPR. Transfers from the EU/EEA/UK to India or other non-adequate jurisdictions shall rely on standard contractual clauses or other legally recognized safeguards.

12. General

If any court or competent authority finds that any particular provision of this privacy policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted. The validity and enforceability of the other provisions of this privacy policy shall remain unaffected.

13. Changes to this privacy policy

We reserve the right to change this privacy policy as deemed necessary from time to time, or as required by law. Any changes will be immediately posted on TataWorld, and you are deemed to have accepted them on your first use of TataWorld following the alterations.

For any grievances or support, you may contact Tata Sons through tataworld@tata.com.