iTech Management is committed to complying with data protection and good practices, including,
Processing personal information only when it’s strictly necessary for legal and regulatory purposes or legitimate organizational purposes.
Processing only minimum personal information is required for these purposes.
Providing clear communication to the data subjects about how their personal information can be used and by whom.
Only processing relevant and adequate personal information.
Processing personal information fairly and lawfully.
Maintaining a documented inventory of the personal information processed by the organization.
Keeping personal information accurate and, where necessary, up to date.
Retaining personal information only for as long as necessary for legal or regulatory requirements or legitimate organizational purposes and ensuring timely and appropriate disposal.
Respecting data subject’s rights in relation to their personal information.
Keeping all personal information secure.
Adequately protecting the PII while transferring the information outside the country of origin based on the contractual and security requirements.
The application of the various exemptions allowable by data protection legislation.
Identification of suitable employees with specific responsibility and accountability.
Providing necessary PDP awareness training to create awareness among the employees.
Privacy Notification and Statement Policy
iTech shall provide clear, open, and honest privacy notifications and statements in accordance with applicable Data Protection Legislation regarding how iTech uses Personal Data.
Where possible, Privacy notifications shall be made available to the Individual at the time when iTech collects Personal Data.
Any significant changes to the way iTech uses Personal Data shall be communicated to iTech employees, Customers, and other stakeholders through iTech Privacy notifications and other appropriate ways.
iTech shall maintain Privacy notifications and review them at least on an annual basis to ensure that they accurately describe how iTech uses Personal Data.
The ISSC shall maintain a centralized repository of all Privacy notifications.
Data Protection Impact Assessments (“DPIA”) Policy
iTech shall perform a DPIA any time it starts a new Project that is likely to include, in any way, the use of Personal Data, using the appropriate DPIA Template in accordance with the DPIA Procedure.
DPIAs shall identify, describe, and assess the necessity, proportionality, and risk to Individuals resulting from how iTech uses Personal Data in accordance with the Risk Assessment procedure.
DPIAs shall inform the design and implementation of appropriate controls to reduce individual risks.
DPIAs shall be completed by the individual or team responsible for the new Project who understands how Personal Data will be used.
The DPO and ISSC may assist individuals or project teams to complete the DPIA.
All DPIAs shall be submitted to the ISSC for review and approval before Personal Data may be used.
Where required, the ISSC shall consult with Individuals (or their representatives), applicable DPOs, and/or Data Protection Authorities in respect of new Projects and ensure that any concerns, advice, or recommendations are communicated to the individual or team responsible for the new Project.
The individual or team responsible for the new Project is responsible for ensuring that controls required to reduce the risk to Individuals, as recommended by the ISSC, are implemented.
No new Projects shall be undertaken if there is a high risk to Individuals that cannot be mitigated, unless this has been approved by the Management.
The ISSC shall, from time to time, review projects to ensure that appropriate controls have been implemented to reduce the risk to Individuals.
The ISSC shall reassess DPIAs for projects at its discretion, following any significant changes in the environment of business, Data Protection Legislation, Authority guidelines, industry best practices, media, public sentiment, and recent judgments.
The ISSC shall maintain a centralized repository of all DPIAs and supporting documentation.
As and when required, iTech may assist its customers to complete their DPIAs by providing the relevant information to support their assessment of the risk to Individuals. The DPO, ISSC may support Customer teams to respond to these requests.
Data Subject Rights and Requests Policy
All Data Subject Requests shall be managed in accordance with the iTech Data Subject Rights Policy and associated procedures.
All Data Subject Requests shall be responded to within a timely manner, in line with the timeframes stipulated by applicable Data Protection Legislation.
iTech shall design, implement, and maintain appropriate measures to execute any Data Subject Requests.
The ISSC shall maintain a centralized record of all Data Subject Requests.
Data Privacy and Protection Enquiries and Complaints Policy
iTech shall establish a procedure to receive, recognize, and respond to PDP enquiries and complaints from Individuals.
All PDP enquiries and complaints shall be dealt with in a timely manner, in accordance with applicable Data Protection Legislation.
All PDP complaints shall be reported immediately to the local DPO for coordination and response, who will inform the Management Team on a regular basis or escalate as appropriate.
The DPOs (where relevant) and SPOCs (where appropriate) shall assist in responding to PDP enquiries from Individuals.
The ISSC shall maintain a centralized record of all PDP complaints.
All PDP complaints shall be reviewed and analysed by the ISSC to identify trends, root causes and deficiencies in iTech PDP policies, frameworks, procedures and guidelines on a quarterly basis.
Data Protection by Design Policy
Any time iTech uses Personal Data, iTech shall ensure that it applies iTech PDP Policy.
iTech applies the PDP Policy and associated PDP policies and procedures when iTech changes or builds new applications, systems, infrastructure, Products, Services, or Solutions that Use Personal Data.
Data Landscape Policy
iTech shall document, maintain, and review, at least annually, an accurate and complete record of what Personal Data that iTech uses and how it’s used in the Data Management Plan.
iTech shall identify and document iTech legal basis (i.e., contract, Legitimate Interests, Vital Interests, compliance with legal obligations, Consent) for using Personal Data.
iTech shall ensure that where iTech’s legal basis is “Consent,” consent is freely given, specific, informed, and clearly given, and individuals can withdraw consent at any time.
The ISSC shall maintain a centralized repository of the Data Management Plan.
Information Lifecycle Management Policy
iTech shall use personal data only for legitimate business purposes.
iTech shall not use Personal Data for any additional purposes unless this is compatible with the original purpose for which it was collected.
iTech shall collect Personal Data directly from the Individual unless they are aware of and/or have consented to the collection of Personal Data about them from other persons or third parties.
iTech shall collect Special Category Personal Data only if it has a legitimate business purpose and it is permitted under law (including Data Protection Legislation).
iTech shall collect Personal Data relating to Vulnerable Persons only if it has a legitimate business purpose.
iTech shall collect the Personal Data of Children only if it has a legitimate business purpose and has obtained the informed consent of their parent, guardian, or other competent person.
iTech shall implement mechanisms to ensure that Personal Data is accurate, complete, and up to date.
iTech shall keep Personal Data for as long as iTech needs it to fulfill the business purpose and in accordance with retention schedules.
iTech shall securely destroy, dispose of, de-identify, or anonymize Personal Data when no longer needed.
Cross-border Transfers of Personal Data Policy
iTech shall transfer Personal Data outside of the country from where it was originally collected only in accordance with applicable laws and regulations (including Data Protection Legislation and data localization and data sovereignty requirements).
When iTech transfer Personal Data outside of the country from where it was originally collected within iTech, ensure that iTech has appropriate Transfer Mechanisms (i.e. Standard Contractual Clauses, Adequacy Decisions) in place.
Employee Personal Data Policy
iTech shall respect the right to privacy of iTech Employees and uphold their rights in all that we do.
iTech shall not use the personal data of its employees if they do not know about it or if it is used in a way that would be considered intrusive or invasive.
iTech shall use the personal data of its employees only if there is a legitimate business reason for doing so, and iTech shall not collect more personal data than what is needed.
iTech shall treat the Personal Data of its employees as confidential at all times and not share it with others unless they have a legitimate need to know.
Customer Personal Data Policy
Any time iTech process Personal Data on behalf of its customers (or potential Customers) (“Customer Personal Data”), iTech shall ensure that it only do so in accordance with a written agreement between iTech and iTech customer that describes iTech role, the required terms and conditions, the type of Personal Data, the purpose for using the customer Personal Data, and what iTech may or may not do with the Customer Personal Data.
Any agreements that set out PDP obligations with iTech customers shall be negotiated and agreed in accordance with the applicable legal contracting playbooks that include iTech standard clauses and escalation processes.
iTech shall maintain an accurate and complete record of how iTech uses Customer Personal Data in the Data Management Plan.
The ISSC shall maintain a centralized repository of the PDP Customer record of Processing.
Marketing Policy on PDP
iTech shall respect the right of an Individual not to be marketed to. Hence, iTech shall provide individuals with the option to opt into iTech’s marketing communications (including electronic, online, telephonic, and post) unless permitted by applicable laws and regulations.
At any point in time, iTech shall provide Individuals with the option to opt out of our marketing communications and provide them with information on how to do so.
iTech shall not market to Individuals who have opted out of our marketing communications.
When purchasing marketing lists or databases, iTech shall ensure that the list or database provider has obtained the required opt-in consent from Individuals to receive marketing communications from us. Where iTech buys a list, iTech shall conduct a review to ensure that any individual who has withdrawn consent from iTech for marketing communications is removed.
iTech shall not sell its marketing lists or databases to 3rd parties.
iTech only receives or shares its marketing lists or databases from/with iTech Partners if there are:
a specific agreement in place (including a Data Protection Agreement (“DPA”)),
there is a legitimate business reason for sharing the Personal Data,
only the minimum amount of Personal Data necessary is shared,
the Personal Data will not be used for a different purpose,
The use would not be considered excessive, and
Individuals are aware that iTech shares their Personal Data with its Partners.
iTech shall obtain consent for the use of cookies and other technologies that target, profile, and/or track Individuals for marketing purposes.
Where possible, iTech shall ensure that individuals are aware of its marketing practices when their personal data is collected.
iTech maintains a record of Individual preferences regarding marketing communications, cookies, and other technologies.
iTech maintain a record of all marketing lists and databases that are purchased or received from and shared with other parties or its Partners.
Regulatory Policy
The ISSC and senior management shall ensure that iTech Management is aware of and understands the requirements imposed by Data Protection Legislation(s).
DPOs (and equivalent roles) may inform and advise the ISSC of requirements under Data Protection Legislation when required.
The ISSC and DPOs (and equivalent roles) shall keep abreast of changing legislative, regulatory, and industry best practices and ensure that any changes are adopted and communicated.
The ISSC shall define, document, assess, manage, and monitor Risk Management Plans for high-risk Data Protection Legislation.
All required statutory registrations and required authorizations (including DPOs or equivalent roles, databases, Special Category Personal Data, cross-border transfers, etc.) shall be performed/obtained and maintained in accordance with applicable Data Protection Legislation by the relevant business units. The ISSC shall assist in statutory registrations or authorizations as required.
All requests from Authorities (including complaints, questions, audits, investigations, etc.) shall be immediately reported to the DPO.
The DPO, where required, shall assess, coordinate, and respond to requests from Authorities in accordance with Data Protection Legislation and any other applicable legislation.
The DPO, where required, shall be consulted prior to disclosing Personal Data to any Authorities.
The ISSC shall maintain a centralized register of all statutory registrations, authorizations, interactions with Authorities, and data disclosures with necessary access control.
Third-Party Management Policy
All third parties shall be selected, on-boarded, managed, and off-boarded in accordance with iTech supplier management policies, procedures, and guidelines.
Any time that iTech engage a Third-Party Processor, iTech shall ensure that a written Data Processing Agreement (DPA) is in place.
DPAs shall be negotiated and agreed upon in accordance with the appropriate legal contract.
All Third-Party Processors shall only use Personal Data in accordance with the written agreements between iTech and them and shall not use Personal Data for any other purposes.
Where third-party processors transfer personal data outside of the country from where it was originally collected or stored, iTech shall ensure that an adequate transfer mechanism is in place.
Any time that iTech engage a Third-Party Processor, iTech shall ensure that the Third-Party Processor has undertaken the PDP Third Party Risk Assessment and the Information Security Vendor Risk Assessment.
Any Third-Party Processor that does not meet iTech PDP and/or information security requirements shall not be allowed to use Personal Data on iTech’s behalf. All Third-Party Processors shall implement appropriate controls to ensure that Personal Data is protected against unauthorized use, access, disclosure, loss, or damage.
All Third-Party Processors shall immediately notify iTech of any actual or suspected Personal Data Breaches.
From time to time, iTech may audit (or require assurance from) its Third-Party Processors to ensure that they comply with iTech PDP and information security requirements.
The ISSC shall retain a record of all Third-Party Processors and the associated DPAs.
All Third-Party Processors shall be made aware of and comply with iTech PDP Policy.
iTech shall ensure that appropriate (Data Processing Agreements and Data Sharing Agreements) are in place to support the Use of Personal Data when processed by iTech and/or its subsidiaries.
Privacy Training and Awareness Policy
iTech is committed to building a culture that promotes Personal Data Protection and the ethical use of Personal Data.
All iTech employees shall be aware of, understand, and committed to ensuring that iTech uses Personal Data in a transparent, fair, ethical, and lawful way.
iTech shall ensure that all of its employees receive training on PDP policies, procedures, and guidelines appropriate to their role upon joining and on at least an annual basis thereafter.
The ISSC shall be responsible for the design, implementation, and maintenance of PDP training and awareness.
Where local variations, additional requirements, and/or exceptions to the PDP Policy exist, the relevant DPO shall ensure that appropriate, additional training is provided to iTech employees to ensure that they are aware of their additional responsibilities under the local variation, additional requirements, and/or exceptions. Any additional training shall be
consistent with the PDP Policy and associated PDP policies, frameworks, procedures, and guidelines and reviewed and approved by the ISSC
PDP Risk Management Policy
PDP Risks shall be managed in accordance with the Risk Management Policy and Procedure (iTech-ISMS-POL 06 & iTech-ISMS-PR 02 ).
When iTech identifies possible PDP risks, they shall be reported to the ISSC.
The ISSC shall review, identify, and assess PDP Risks on at least a quarterly basis and capture these in the Risk Register.
The ISSC shall design and implement controls and initiate activities to mitigate PDP Risks to an acceptable level of residual risk.
The ISSC shall ensure that PDP Risks are managed within iTech’s risk appetite as given in the Risk Management procedure.
The ISSC shall assess the effectiveness of the controls implemented to mitigate iTech’s PDP Risks, at least on an annual basis.
The ISSC shall review and define key risk and control indicators to monitor the status of risks and risk management activities.
CISO shall report on the status of the risk management activities to the Management team on a bi-annual basis (i.e., twice a year).
As and when required, ISSC shall perform a deep dive into PDP Risks and present a report to the CISO about the adequacy and effectiveness of controls implemented to address these risks.
Breach Response and Notification Policy
iTech shall manage IS incidents and provide Personal Data Breach notifications in accordance with iTech’s Personal Data Breach Notification Policy.
iTech shall identify, protect, detect, respond, and recover from Personal Data Breaches in accordance with iTech’s Incident Management procedure.
All of iTech’s employees shall immediately report any suspected or actual Personal Data Breaches to their line manager, the local Data Protection Officer.
iTech shall notify relevant Authorities, affected Individuals, and Customers of Personal Data Breaches in accordance with Data Protection Legislation and iTech’s contractual commitments.
The ISSC maintains a record of all Personal Data Breaches and notifications.
Breach Response and Notification Policy
For any further queries or suggestions, please contact the Data Protection Officer at dpo@itechindia.co.
