Policy Statement

Personal Data Protection Policy

iTech Management is committed to comply with the data protection and good practices, including,

• Processing personal information only when it’s strictly necessary for legal and regulatory purposes or legitimate organizational purposes.
• Processing only minimum personal information required for these purposes.
• Providing clear communication to the data subjects about how their personal information can be used and by whom.
• Only processing relevant and adequate personal information.
• Processing personal information fairly and lawfully.
• Maintaining documented inventory of the personal information processed by the organization.
• Keeping personal information accurate and where necessary up to date.
• Retaining personal information only for as long as necessary for legal or regulatory requirements or for legitimate organizational purposes and ensuring timely and appropriate disposal.
• Respecting data subject’s rights in relation to their personal information.
• Keeping all personal information secure.
• Adequately protecting the PII while transferring the information outside the country of origin based on the contractual and security requirement.
• The application of the various exemptions allowable by data protection legislation.
• Identification suitable employees with specific responsibility and accountability.
• Providing necessary PDP awareness training to create awareness among the employees.

Privacy Notification and Statement Policy

• iTech shall provide clear, open and honest privacy notification and statement in accordance with applicable Data Protection Legislation regarding how iTech use Personal Data.
• Where possible, Privacy notifications shall be made available to the Individual at the time when iTech collect Personal Data.
• Any significant changes to the way iTech use Personal Data shall be communicated to iTech employees, Customers and other stakeholders through iTech Privacy notifications and other appropriate ways.
• iTech shall maintain Privacy notifications and review them at least on an annual basis to ensure that they accurately describe how iTech use Personal Data.
• The ISSC shall maintain a centralized repository of all Privacy notifications.

Data Protection Impact Assessments (“DPIA”) Policy

• iTech shall perform a DPIA any time it starts a new Project that is likely to include, in any way, the use of Personal Data, using the appropriate DPIA Template in accordance with the DPIA Procedure.
• DPIAs shall identify, describe, and assess the necessity, proportionality, and risk to Individuals resulting from how iTech use Personal Data in accordance with the Risk Assessment procedure.
• DPIAs shall inform the design and implementation of appropriate controls to reduce the risks to Individuals.
• DPIAs shall be completed by the individual or team responsible for the new Project who understands how Personal Data will be used.
• The DPO, ISSC may assist individuals or project teams to complete the DPIA.
• All DPIAs shall be submitted to the ISSC for review and approval before Personal Data may be used.
• Where required, the ISSC shall consult with Individuals (or their representatives), applicable DPOs and/or Data Protection Authorities in respect of new Projects and ensure that any concerns, advice, or recommendations are communicated to the individual or team responsible for the new Project.
• The individual or team responsible for the new Project is responsible for ensuring that controls required to reduce the risk to Individuals, as recommended by the ISSC, are implemented.
• No new Projects shall be undertaken if there is a high risk to Individuals that cannot be mitigated, unless this has been approved by the Management.
• The ISSC shall, from time-to-time, review projects to ensure that appropriate controls have been implemented to reduce the risk to Individuals.
• The ISSC shall reassess DPIAs for projects at its discretion, following any significant changes in the environment of business, Data Protection Legislation, Authority guidelines, industry best practices, media, public sentiment and recent judgements.
• The ISSC shall maintain a centralized repository of all DPIAs and supporting documentation.
• As and when required, iTech may assist its customers to complete their DPIAs by providing the relevant information to support their assessment of the risk to Individuals. The DPO, ISSC may support Customer teams to respond to these requests.

Data Subject Rights and Requests Policy

• All Data Subject Requests shall be managed in accordance with iTech Data Subject Rights Policy and associated procedure.
• All Data Subject Requests shall be responded to within a timely manner, in line with the timeframes stipulated by applicable Data Protection Legislation.
• iTech shall design, implement and maintain appropriate measures to execute any Data Subject Requests.
• The ISSC shall maintain a centralized record of all Data Subject Requests.

Data Privacy and Protection Enquiries and Complaints Policy

• iTech shall establish procedure to receive, recognize and respond to PDP enquiries and complaints from Individuals.
• All PDP enquiries and complaints shall be dealt with in a timely manner, in accordance with applicable Data Protection Legislation.
• All PDP complaints shall be reported immediately to the local DPO for co-ordination and response who will inform the Management Team on a regular basis or escalate as appropriate.
• The DPOs (where relevant) and SPOCs (where appropriate) shall assist in responding to PDP enquiries from Individuals.
• The ISSC shall maintain a centralized record of all PDP complaints.
• All PDP complaints shall be reviewed and analysed by the ISSC to identify trends, root causes and deficiencies in iTech PDP policies, frameworks, procedures and guidelines on a quarterly basis.

Data Protection by Design Policy

• Any time iTech use Personal Data, iTech shall ensure that it apply iTech PDP Policy.
• iTech apply the PDP Policy, and associated PDP policies and procedures when iTech change or build new applications, systems, infrastructure, Products, Services or Solutions that Use Personal Data.

Data Landscape Policy

• iTech shall document, maintain, and review at least annually, an accurate and complete record of what Personal Data that iTech uses and how it’s used in the Data Management Plan.
• iTech shall identify and document iTech legal basis (i.e., contract, Legitimate Interests, Vital Interests, compliance with legal obligations, Consent) for using Personal Data.
• iTech shall ensure that where iTech legal basis is “Consent”, that Consent is freely given, specific, informed and clearly given; and Individuals can withdraw Consent at any time.
• The ISSC shall maintain a centralized repository of the Data Management Plan.

Information Lifecycle Management Policy

• iTech shall use Personal Data only for a legitimate business purpose.
• iTech shall not use Personal Data for any additional purposes unless this is compatible with the original purpose for which it was collected.
• iTech shall collect Personal Data directly from the Individual unless they are aware of and/or have Consented to the collection of Personal Data about them from other persons or third parties.
• iTech shall collect Special Category Personal Data only if it has a legitimate business purpose and it is permitted under law (including Data Protection Legislation).
• iTech shall collect Personal Data relating to Vulnerable Persons only if it has a legitimate business purpose.
• iTech shall collect the Personal Data of Children only if it has a legitimate business purpose and have obtained the informed Consent of their parent, guardian, or other competent person.
• iTech shall implement mechanisms to ensure that Personal Data is accurate, complete and up to date.
• iTech shall keep Personal Data for as long as iTech need it to fulfil the business purpose and in accordance with retention schedules.
• iTech shall securely destroy, dispose of, de-identify or anonymize Personal Data when no longer need it.

Cross-border Transfers of Personal Data Policy

• iTech shall transfer Personal Data outside of the country from where it was originally collected only in accordance with applicable laws and regulations (including Data Protection Legislation and data localization and data sovereignty requirements).
• When iTech transfer Personal Data outside of the country from where it was originally collected within iTech, ensure that iTech has appropriate Transfer Mechanisms (i.e. Standard Contractual Clauses, Adequacy Decisions) in place.

Employee Personal Data Policy

• iTech shall respect the right to privacy of iTech Employees and uphold their rights in all that we do.
• iTech shall not use the Personal Data of its employees if they do not know about it, or in a way that would be considered intrusive or invasive.
• iTech shall use the Personal Data of its employees only if it has a legitimate business reason to do so and iTech shall not collect more Personal Data than what is needed.
• iTech shall treat the Personal Data of its employees as confidential at all times and do not share it with others unless they have a legitimate need to know.

Customer Personal Data Policy

• Any time iTech process Personal Data on behalf of its customers (or potential Customers) (“Customer Personal Data”), iTech shall ensure that it only do so in accordance with a written agreement between iTech and iTech customer that describes iTech role, the required terms and conditions, the type of Personal Data, the purpose for using the customer Personal Data, and what iTech may or may not do with the Customer Personal Data.
• Any agreements that set out PDP obligations with iTech customers shall be negotiated and agreed in accordance with the applicable legal contracting playbooks that include iTech standard clauses and escalation processes.
• iTech shall maintain an accurate and complete record of how iTech use Customer Personal Data in the Data Management Plan.
• The ISSC shall maintain a centralized repository of the PDP Customer record of Processing.

Marketing Policy on PDP

• iTech shall respect the right of an Individual to not be marketed to. Hence iTech shall provide Individuals with the option to opt-in to iTech’s marketing communications (including electronic, online, telephonic and post), unless permitted under applicable laws and regulations.
• At any point in time, iTech shall provide Individuals with the option to opt-out of our marketing communications and provide them with an information on how to do so.
• iTech shall not market to Individuals who have opted-out of our marketing communications.
• When purchasing marketing lists or databases, iTech shall ensure that the list or database provider has obtained the required opt-in consent from Individuals to receive marketing communications from us. Where iTech buy a list, iTech shall conduct a review to ensure that any Individual who has withdrawn consent from iTech for marketing communications is removed.
• iTech shall not sell its marketing lists or databases to 3rd parties.
• iTech only receive or share its marketing lists or databases from/with iTech Partners, if there is:
  • a specific agreement in place (including a Data Protection Agreement (“DPA”)),
  • there is a legitimate business reason for sharing the Personal Data,
  • only the minimum amount of Personal Data necessary is shared,
  • the Personal Data will not be used for a different purpose,
  • the Use would not be considered excessive, and
  • Individuals are aware that iTech share their Personal Data with its Partners.
• iTech shall obtain consent for the use of cookies and other technologies that target, profile and/or track Individuals for marketing purposes.
• Where possible, iTech shall ensure that Individuals are aware of its marketing practices at the time their Personal Data is collected.
• iTech maintain a record of Individual preferences regarding marketing communications, cookies, and other technologies.
• iTech maintain a record of all marketing lists and databases that are purchased or received from and shared with other parties or its Partners.

Regulatory Policy

• The ISSC and senior maangement shall ensure that iTech Management is aware of and understand the requirements imposed by Data Protection Legislation(s).
• DPOs (and equivalent roles) may inform and advise the ISSC of requirements under Data Protection Legislation, when required.
• The ISSC and DPOs (and equivalent roles) shall keep abreast of changing legislative, regulatory and industry best practices and ensure that any changes are adopted and communicated.
• The ISSC shall define, document, assess, manage and monitor Risk Management Plans for high-risk Data Protection Legislation.
• All required statutory registrations and required authorizations (including DPOs or equivalent roles, databases, Special Category Personal Data, cross-border transfers, etc.) shall be performed/obtained and maintained in accordance with applicable Data Protection Legislation by the relevant business units. The ISSC shall assist in statutory registrations or authorizations, as required.
• All requests from Authorities (including complaints, questions, audits, investigations, etc.) shall be immediately reported to the DPO.
• The DPO, where required, shall assess, co-ordinate and respond to requests from Authorities in accordance with Data Protection Legislation, and any other applicable legislation.
• The DPO, where required, shall be consulted prior to disclosing Personal Data to any Authorities.
• The ISSC shall maintain a centralized register of all statutory registrations, authorizations, interactions with Authorities and data disclosures with necessary access control.

Third Party Management Policy

• All third parties shall be selected, on-boarded, managed and off-boarded in accordance with iTech supplier management policies, procedure and guidelines.
• Any time that iTech engage a Third-Party Processor, iTech shall ensure that a written Data Processing Agreement (DPA) is in place.
• DPAs shall be negotiated and agreed in accordance with the appropriate legal contract.
• All Third-Party Processors shall only use Personal Data in accordance with the written agreements between iTech and them and shall not use Personal Data for any other purposes.
• Where Third Party Processors transfer Personal Data outside of the country from where it was originally collected or stored, iTech shall ensure that an adequate Transfer Mechanism is in place.
• Any time that iTech engage a Third-Party Processor, iTech shall ensure that the Third-Party Processor has undertaken the PDP Third Party Risk Assessment and the Information Security Vendor Risk Assessment.
• Any Third-Party Processor that does not meet iTech PDP and/or information security requirements, shall not be allowed to use Personal Data on iTech behalf.
• All Third-Party Processors shall implement appropriate controls to ensure that Personal Data is protected against unauthorized use, access, disclosure, loss or damage.
• All Third-Party Processors shall immediately notify iTech of any actual or suspected Personal Data Breaches.
• From time-to-time, iTech may audit (or require assurance from) its Third-Party Processors to ensure that they comply with iTech PDP and information security requirements.
• The ISSC shall retain a record of all Third-Party Processors and the associated DPAs.
• All Third-Party Processors shall be made aware of and comply with iTech PDP Policy.
• iTech shall ensure that appropriate (Data Processing Agreements and Data Sharing Agreements) are in place to support the Use of Personal Data, when processed by iTech and/or its subsidiaries.

Privacy Training and Awareness Policy

• iTech is committed to building a culture that promotes Personal Data Protection and the ethical use of Personal Data.
• All of iTech employees shall be aware of, understand and committed to ensure that iTech use Personal Data in a transparent, fair, ethical and lawful way.
• iTech shall ensure that all of its employees receive training on PDP polices, procedures and guidelines, appropriate to their role upon joining and on at least an annual basis thereafter.
• The ISSC shall be responsible for the design, implementation and maintenance of PDP training and awareness.
• Where local variations, additional requirements and/or exceptions to the PDP Policy exist, the relevant DPO shall ensure that appropriate, additional training is provided to iTech employees to ensure that they are aware of their additional responsibilities under the local variation, additional requirements and/or exceptions. Any additional training shall be
  • consistent with the PDP Policy and associated PDP polices, frameworks, procedures and guidelines and reviewed and approved by the ISSC

PDP Risk Management Policy

• PDP Risks shall be managed in accordance with Risk Management Policy and Procedure (iTech-ISMS-POL 06 & iTech-ISMS-PR 02 ).
• When iTech identify possible PDP Risks, this shall be reported to the ISSC.
• The ISSC shall review, identify, and assess PDP Risks on at least a quarterly basis and capture these in the Risk Register.
• The ISSC shall design and implement controls and initiate activities to mitigate PDP Risks to an acceptable level of residual risk.
• The ISSC shall ensure that PDP Risks are managed within iTech’s risk appetite as given in the Risk Management procedure.
• The ISSC shall assess the effectiveness of the controls implemented to mitigate iTech’s PDP Risks, at least on an annual basis.
• The ISSC shall review and define key risk and control indicators to monitor the status of risks and risk management activities.
• CISO shall report on the status of the risk management activities to the Management team at a minimum on a bi-annual basis (i.e. twice a year).
• As and when required , ISSC shall perform a deep dive of PDP Risks and present a report to the CISO about the adequacy and effectiveness of controls implemented to address these risks.

Breach Response and Notification Policy

• iTech shall manage IS incidents and provide Personal Data Breach notifications in accordance with iTech Personal Data Breach Notification Policy.
• iTech shall identify, protect, detect, respond, and recover from Personal Data Breaches in accordance with iTech’s Incident Management procedure.
• All of iTech’s employees shall immediately report any suspected or actual Personal Data Breaches to their line manager, the local Data Protection Officer.
• iTech shall notify relevant Authorities, affected Individuals and Customers of Personal Data Breaches in accordance with Data Protection Legislation and iTech’s contractual commitments.
• The ISSC maintains a record of all Personal Data Breaches and notifications.

Further help and advice

For any further queries or suggestions please contact the Data Protection Officer at  dpo@itechindia.co