This policy was created to demonstrate our commitment to your privacy

“Synechron is a leading digital transformation consulting firm focused on the financial services industry and is working to Accelerate Digital initiatives for banks, asset managers, and insurance companies around the world. Synechron uniquely delivers these firms end-to-end Digital, Consulting, and Technology capabilities with expertise in wholesale banking, wealth management, and insurance as well as emerging technologies like Blockchain, Artificial Intelligence, and Data Science. This has helped the company grow in revenue and 14,500+ employees, and we’re continuing to invest in research and development in the form of Accelerators (prototype applications) developed in our global Financial Innovation Labs (FinLabs).”

This policy applies to processing of personal data in electronic form or otherwise and shall apply to Synechron, its operations and business units and supersedes any other policy relating to Personal Data protection. This means that this Policy shall apply to all employees, contractors, working partners and businesses carried on by Synechron and any other Affiliates of Synechron except to the extent, if any, stated under exemptions below, must comply with it.

Synechron may collect, store, use and disclose information about individuals which may constitute Personal Data (including Sensitive Personal Data) under various applicable data protection laws (including but not limited to Information Technology Act 2000 (IT Act), Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (IT Rules), General Data Protection Regulation (GDPR), UK DPA 2018, Data Protection Act 1998 (USA), California Consumer Protection Act (CCPA), The Personal Information Protection and Electronic Documents Act (PIPEDA) Canada, Personal Data Protection Act 2012 (PDPA) Singapore, Personal Data (Privacy) Ordinance (PDPO) Hong Kong, Act on Protection of Personal Information (APPI) Japan for lawful, explicit and legitimate purposes and for further processing of Personal Data consistent with those purposes.

The Personal Data may be processed for purposes including without limitation:

• Administering relationships services
• Operational purposes
• Conducting market research
• Providing individuals with information concerning products and services which Synechron believes to be of interest
• Compliance with any requirement of law, regulation, associations, codes that Synechron decides to adopt
• For the detection, investigation, monitoring and prevention of fraud and other crimes or malpractice
• For the purpose of, or in connection with, any legal proceedings for obtaining legal advice or for establishing, exercising or defending legal rights or any other purpose connected to or incidental to the purposes stated above
• Personal Data collected at website - cookies may be used in website to track user behavior, etc., and/or username, address, email, phone number may be collected for marketing or research purposes

Synechron shall specifically mention the purpose and obtain free consent, if required from the data subject prior to collecting, storing and processing of Personal Data.

Synechron shall not utilize an individual’s Personal Data in its control, beyond the scope for which it was collected without prior written consent from the individual. Individual’s Personal Data shall not be provided or otherwise disclosed to third parties other than Synechron, investigators, or law enforcement personnel where consent has been obtained from the concerned individual or when disclosure is legally mandated. Synechron may record and monitor electronic and voice communications, to the extent permitted by applicable laws, to ensure compliance with the legal and regulatory obligations, internal policies and for the purposes outlined above in this policy.

Synechron entities may transfer personal data internally or to third party recipients. In order for Synechron to carry out its operations across its various entities, there may be occasions when it is necessary to transfer personal data from one entity to another, or to allow access to the personal data from an overseas location.

Any transfer of Personal Data to a third party shall take place only if, adequate levels of protection of Personal Data in accordance with applicable data protection laws is guaranteed by such third party. Data shall be encrypted and anonymized wherever necessary.

Synechron recognizes that data subjects have a right to request a copy of the Personal Data held by Synechron. If any Personal Data is found to be incorrect, the individual concerned has the right to file a request to amend, update or delete it, as appropriate. Individuals also have a right to object or restrict to the processing of their Personal Data as per the prevailing laws.

The right to data portability gives data subjects the right to receive personal data they have provided to Synechron in a structured, commonly used and machine-readable format.

If Synechron undertakes transactions or other services that involves the processing or disclosure of Personal Data on behalf of any of our client or counterparty, it shall be the responsibility of such client or counterparty to ensure that it has all necessary authority to permit Synechron to process and disclose the Personal Data accordingly.

Privacy consent can be withdrawn by the data subject by informing the appropriate authority within Synechron as mentioned in access revocation process document.

Please note that we may ask you to verify your identity before responding to such requests. The personal data shall be deleted from the system on request or when it has served its purpose, only after a complete evaluation of compliance with any applicable legal obligations or business processes.

All employees shall have their data protection responsibilities outlined to them as part of the induction training. A culture of data protection and privacy shall be inculcated among the employees by providing regular training in order to sustain awareness.

Synechron shall conduct periodical Data Protection Impact Assessment that shall include:

• A systematic description of the system or purpose.
• Assessment of the risks to the rights and freedoms of data subjects.
• The measures to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data and to demonstrate.

All Synechron personnel handling Personal Data shall take reasonable measures for protection of Personal Data. The Data Privacy Officer (DPO) is responsible for administration of this policy and monitoring its compliance.

• Synechron shall mean and include its Affiliates and group entities.
• Affiliates mean Synechron Limited, Synechron Inc., Synechron Technologies Pvt. Ltd. and (a) any persons or entities that, now or in the future, directly or indirectly, control, are controlled by them, or are under common control, or (b) any persons or entities that are acquired, managed, or operated by them, whether by membership, stock ownership, joint operating agreement, or other substantial relationship. “Control” means, with respect to a corporation, the direct or indirect control of more than fifty percent (50%) of the voting power to elect directors thereof, or any other entity, the power to direct the management or management policies of such entity.
• Data Protection Laws and Regulations means, in the European Union, the Data Protection Directive 95/46/EC and the national statutory legislation passed in each Member State implementing this Directive, the General Data Protection Regulation(GDPR) 2016 / 679, as well as applicable data protection and privacy laws that exist outside the EU in each country. Information Technology Act 2000 (IT Act), Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (IT Rules), Data Protection Act 1998 (USA), California Consumer Protection Act (CCPA), The Personal Information Protection and Electronic Documents Act (PIPEDA) Canada, Personal Data Protection Act 2012 (PDPA) Singapore, Personal Data (Privacy) Ordinance (PDPO) Hong Kong, Act on Protection of Personal Information (APPI) Japan.
• European Union – means the current EU Member State countries of: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.
• Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Personal information’ under Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (Privacy Rules) means any information that relates to a natural person, which either directly or indirectly, in combination with other information that is available or likely to be available to a corporate entity, is capable of identifying such person Internal Document 9.
• Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Specified purpose means being clear from the outset about why we are collecting Personal Data and are transparent about our purposes with the individuals concerned.
• Sensitive personal data or information under Privacy Rules—means such personal information which consists of information relating to;— (i) password; (ii) financial information such as Bank account or credit card or debit card or other payment instrument details ; (iii) physical, physiological and mental health condition; (iv) sexual orientation; (v) medical records and history; (vi) Biometric information; (vii) any detail relating to the above clauses as provided to body corporate for providing service; and (viii) any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise: provided that, any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as sensitive personal data or information for the purposes of these rules.