eClerx is committed to protecting the privacy and security of your personal information.

This Privacy Notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with applicable laws (including the EU General Data Protection Regulation 2016/679 (“GDPR”) and national laws implementing GDPR).  It applies to all information that we gather from our Business Leads.

eClerx is a “controller” of your personal data. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this Privacy Notice. Our contact details are set out in the Contact section at the end of this Privacy Notice, should you have any questions about the information provided in this Privacy Notice.

This Privacy Notice does not form any part of any contract of employment or other contract to provide services. We may update this Privacy Notice at any time.

It is important that you read this Privacy Notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Right to Object: You have a legal right to object at any time to processing of your personal information which is based on our legitimate interests, unless there are compelling legitimate ground for our continued processing.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

There are “special categories” of more sensitive personal data which require a higher level of protection. We will collect, store, and use the following main categories of personal information about you:

Personal contact details such as name, title (Official Title), company details, addresses, Official email ID, region, telephone numbers, and personal email addresses;

Other sensitive personal information that attracts particular protection under GDPR includes information about religious beliefs, sexual orientation and political opinions. However, we would not expect to hold such information unless you provided it to us for a particular purpose.

We collect personal information about business leads either through our website(s), participation in events / conferences or secondary research. The data collection process is supported by our Marketing Automation and CRM platform which also help in establishing connect with you.

The Legal Basis for Processing your Personal Information

We will only use your personal information when the law allows us to. Where we are required to comply with European data protection legislation, we will use your personal information on the basis of the following lawful grounds under GDPR:

(a) where it is necessary for entering into or performing a contract – in order to perform obligations which, arise under the contract we have entered into with you and/or your company/business, it will be necessary for us to process your personal data;

(b) where we need to comply with a legal obligation – we are subject to certain legal requirements which may require us to process your personal data. We may also be obliged by law to disclose your personal data to a regulatory body or law enforcement agency;

(c) where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests – either we, or a third party, will need to process your personal data for the purposes of our (or a third party’s) legitimate interests, provided we have established that those interests are not overridden by your rights and freedoms, including your right to have your personal data protected.

(d) Consent – in limited circumstances, we may ask for your consent to process your personal data in a particular way.

Situations in which we will use your personal information

We may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The primary situations in which we will process your personal information will be to manage the existing services provided to you and / or to provide new information about our products and services.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information. You will appreciate that the above list cannot be exhaustive, but is intended to cover the main scenarios in which we process your information.

If you fail to provide personal information

If you fail to provide certain information when requested, we would not be able to establish contact with you and apprise you of potential and/or existing business services.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. [If we need to use your personal information for an unrelated purpose which is not compatible, we will notify you and we will explain the legal basis which allows us to do so.]

Please note that we may process your personal information without your knowledge, in compliance with the above rules, where this is required or permitted by law.

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. It is specifically regulated under GDPR where such decisions are taken which have legal or other significant effects on individuals. It is permitted in the following circumstances:

1. Where it is necessary to enter into or perform our contract with you and appropriate measures are in place to safeguard your rights.
2. In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated processing, unless we have a lawful basis for doing so, we have notified you and given you a right to challenge the decision or to require that the decision be taken by a person.

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

In certain circumstances we may need to share your personal information with third parties, including third-party service providers and other entities within the eClerx group of companies.  Details of those third parties are set out below along with the reasons for sharing it.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU.  If we do, you can expect a similar degree of protection in respect of your personal information.

Why we might share your personal information with third parties
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

eClerx Group Companies within the EEA

We will share your personal information with other eClerx Group Company offices in the European Economic Area (“EEA”).

We will share your personal information as above for any or all of the following purposes:

as part of our regular reporting activities on company performance;
in the context of a business reorganisation or group restructuring exercise;
for system maintenance support and hosting of data;]
[for the conduct of centralised functions which support the operations of eClerx Group companies in the EEA]
eClerx Group Companies outside the EEA

We will pass your personal information to, or allow access to such information by, other eClerx Group Companies worldwide where we have lawful grounds to do so.  For example, as a result of the safeguards we apply, it will be within our legitimate interests to carry out intra-group transfers of data. The purposes for which we will do so include the performance of our global IT support function.

If you would like details of the particular Group Companies which can access your personal information, please contact us using the details in the Contact section below.

eClerx applies equal rigour to the security of data held and processed across the whole of its global network. Each eClerx Group Company outside the EEA with access to data in the UK, enters into a specific data protection agreement with eClerx thereby undertaking to meet the same standards of data security and to act in accordance with data protection principles applicable under the strict European data protection laws.

Regulatory and Law Enforcement Agencies

If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.

New business owners

If we or our business merges with or is acquired by another business or company, we will share your personal information with the new owners of the business or company and their advisors. If this happens, you will be notified.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve these purposes through other means, and the applicable legal requirements.

We have put in place measures to protect the security of your information. [Details of these measures are available upon request. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from our Data protection officer.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so or where we believe it is necessary to protect you.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

You have certain rights in relation to personal information we hold about you. Details of these rights and how to exercise them are set out below. We will require evidence of your identity before we are able to act on your request.

Right of Access

You have the right at any time to ask us for a copy of the personal information that we hold about you and to check that we are lawfully processing it. Where we have good reason, and if the GDPR permits, we can refuse your request for a copy of your personal information, or certain elements of the request. If we refuse your request or any element of it, we will provide you with our reasons for doing so.

Right of Correction or Completion

If personal information we hold about you is not accurate or is out of date and requires amendment or correction you have a right to have the data rectified or completed.

Right of Erasure

In certain circumstances, you have the right to request that personal information we hold about you is erased e.g. if the information is no longer necessary for the purposes for which it was collected or processed or our processing of the information is based on your consent and there are no other legal grounds on which we may process the information.

Right to object to or restrict processing

In certain circumstances, you have the right to object to our processing of your personal information. For example, if we are processing your information on the basis of our legitimate interests and there are no compelling legitimate grounds for our processing which override your rights and interests.

You may also have the right to restrict our use of your personal information, such as in circumstances where you have challenged the accuracy of the information and during the period where we are verifying its accuracy.

Right of Data Portability

In certain instances, you have a right to receive any personal information that we hold about you in a structured, commonly used and machine-readable format.

In such circumstances, you can ask us to transmit that information to you or directly to a third party organisation.

The above right exists only in respect of personal information that:

you have provided to us previously;
is processed on the basis of certain lawful grounds; and is processed by us using automated means. While we are happy for such requests to be made, we are not able to guarantee technical compatibility with a third party organisation’s systems. We are also unable to comply with requests that relate to personal information of others without their consent.

Exercise of your rights

You can request the exercise of any of the above rights by contacting us.

Most of the above rights are subject to limitations and exceptions. We will provide reasons if we are unable to comply with any request for the exercise of your rights.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If you are unhappy about our use of your personal information, you can contact us using the details in the Contact section below. You are also entitled to lodge a complaint with the UK Information Commissioner’s Office using any of the below contact methods:

Telephone: 0303 123 11113

Website: https://ico.org.uk/concerns/

Post: Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

If you live or work outside of the UK or you have a complaint concerning our activities outside of the UK, you may prefer to lodge a complaint with a different supervisory authority as would be relevant within your jurisdiction.

We reserve the right to change or update this Privacy Notice at any time. If we change our Privacy Notice in the future, we will advise you of material changes or updates to our Privacy Notice by e-mail.

We may also notify you in other ways from time to time about the processing of your personal information.

If you have any enquires or if you would like to contact us about this Privacy Notice or our processing of your personal information, including to request the exercise of your rights as outlined above, please contact us via any of the methods below.

When you contact us, we will ask you to verify your identity.

Contact name: Bhimraj Shirsat (Data Protection Officer)

Email: bhimraj.shirsat@eclerx.com

Telephone:  +91-22-41943435

Our registered office is at: Mumbai, India.