Outcome of the Board meeting held on May 23, 2019

eClerx means and includes eClerx Services Limited and its subsidiaries (hereinafter referred to as “we”, or “our” and used
interchangeably) having its registered office at Sonawala Building, 29 Bank Street, Fort, Mumbai 400 023 and operates eClerx.com, as well as its associated websites including but not limited to eclerxmarkets.com, eclerxdigital.com, eclerxcustomeroperations.com, careers.eclerx.com (the “Websites”). This Privacy Notice (“Notice”) sets out the way in which we process your information in accordance with the General Data Protection Regulation (GDPR). The Notice applies only to the information we collect through or in connection with any of our digital or offline channels.

eClerx is a controller of your personal data available with us. This means that we are responsible for deciding how we hold and use personal information about you. This Privacy Notice does not form any part of any contract of employment or other contract to provide services. It is important that you read this Privacy Notice, together with any other privacy notice or consent forms we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

WE WILL COLLECT, STORE, AND USE THE FOLLOWING MAIN CATEGORIES OF PERSONAL INFORMATION ABOUT YOU WHEN YOU USE OUR WEBSITES (NOT AN EXHAUSTIVE LIST):

• Information that you provide via our Websites, including information you provide when you register on our Websites e.g. name, email address, designation, company, country and telephone number.
• Information captured indirectly from third parties about your computer and about your visits to and use of this Websites, such as your Internet Protocol (IP) address, demographics, your computers’ operating system, and browser type and information collected via cookies (Please read about our Cookie policy at eclerx.com/cookies-policy).

Some of the data that eClerx stores will be hosted within our websites including but not limited to following locations: Chicago, USA; London, UK; Amsterdam, Netherlands; Milan, Italy; Singapore, Mumbai, India.

We will only use your personal information when the law allows us to. If the European data protection legislation applies, we will use your personal information on the basis of the following lawful grounds under GDPR:

1. where it is necessary for a contract – in order to perform obligations which, arise under the contract we have entered into with you, such as when you use our Websites or register on our Websites for usage of its services, it will be necessary for us to process your personal data. We process your Personal Information for the performance of a contract in the following circumstances:
   • to provide better usability, troubleshooting and site maintenance; and
   • to create your user ID.
2. where it is necessary for our legitimate interests (or those of a third party) – either we, or a third party, will need to process your personal data for the purposes of our (or a third party’s) legitimate interests, provided those interests are not overridden by your rights and freedoms, including your right to have your personal data protected. Our legitimate interests include maintaining the smooth operation of eClerx, to identify you once you register on our Websites, to contact you and respond to your questions or requests, to understand which parts of the Websites you visited and how frequently, to understand your preferences in order to provide you with desirable content, to send you communication on sales and marketing programs, and for registration and subscriptions purposes.
3. Consent – in limited circumstances, we may ask for your consent to process your personal data in a particular way, e.g. your consent to the usage of cookies as per our cookie policy.

The primary situations in which we will process your personal information will be to manage the existing services provided to you, to provide new information about our products and services, to understand your usage preferences in order to provide access to desirable content, to process a job application and former employee related requests, to communicate with you in case of customer support, to process transactions, for sending newsletters, updates and promotional materials, to carry out advertising and market research based on behavioral metrics, geo-location data, demographic data and marketing preferences we capture.

If you fail to provide certain information when requested, we would not be able to establish contact with you to assist with
the provision of corresponding services, or apprise you of potential and/or existing business services.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

Please note that we may process your personal information without your knowledge, in compliance with the above rules, where this is required or permitted by law.

You will not be subject to decisions that will have a significant impact on you based solely on automated processing, unless we have a lawful basis for doing so, we have notified you and given you a right to challenge the decision or to require that the decision be taken by a person.

In certain circumstances we may need to share your personal information with third parties, including third-party service providers and other entities within the eClerx group of companies.

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

We will share your personal information with other eClerx Group Company offices in the European Economic Area (“EEA”) for any or all of the following purposes:

• as part of our regular reporting activities on company performance;
• in the context of a business re-organization or group restructuring exercise;
• for system maintenance support and hosting of data;
• for the conduct of centralized functions which support the operations of eClerx Group companies in the EEA.

We will pass your personal information to, or allow access to such information by, other eClerx Group Companies worldwide where we have lawful grounds to do so. For example, as a result of the safeguards we apply, it will be within our legitimate interests to carry out intra-group transfers of data. The purposes for which we will do so include the performance of our global IT support function and for performance of contracts with our clients.

If you would like details of the particular Group Companies which can access your personal information, please contact us using the details in the Contact section below.

If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.

If we or our business merges with or is acquired by another business or company, we will share your personal information with the new owners of the business or company and their advisors.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirement.

We have put in place adequate safeguard measures to protect the security of your information. (Details of these measures are available upon request). Third parties will only process your personal information with our instructions and where they have agreed to treat the information confidentially and to keep it secure.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

You have following rights in relation to personal information we hold about you.

You have the right at any time to ask us for a copy of the personal information that we hold about you and to check that we are
lawfully processing it. Where we have good reason, and if the GDPR permits, we can refuse your request for a copy of your personal information, or certain elements of the request.

If personal information we hold about you is not accurate or is out of date and requires amendment or correction you have a right to have the data rectified or completed.

In certain circumstances, you have the right to request that the personal information we hold about you is erased e.g. if the information is no longer necessary for the purposes for which it was collected or processed or our processing of the information is based on your consent and there are no other legal grounds on which we may process the information.

In certain circumstances, you have the right to object to our processing of your personal information. You may also have the right to restrict our use of your personal information, such as in circumstances where you have challenged the accuracy of the information and during the period where we are verifying its accuracy.

In certain instances, you have a right to receive any personal information that we hold about you in a structured, commonly used and machine-readable format. In such circumstances, you can ask us to transmit that information to you or directly to a third party organization. The above right exists only in respect of personal information that:

• you have provided to us previously
• is processed on the basis of certain lawful grounds; and
• is processed by us using automated means.

While processing such requests, we are not able to guarantee technical compatibility with a third party organization’s systems. We are also unable to comply with requests that relate to personal information of others without their consent.

You can request the exercise of any of the above rights by contacting us. Most of the above rights are subject to limitations and exceptions. We will provide reasons if we are unable to comply with any such request for the exercise of your rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for legally doing so.

If you are unhappy about our use of your personal information, you can contact us using the details in the Contact section below. You are also entitled to lodge a complaint with the applicable EU data protection agency.

We reserve the right to change or update this Privacy Notice at any time. Such updated Notice will be available at
https://eclerx.com/privacy-policy/ and we will advise you of material changes to our Privacy Notice by appropriate means. We may also notify you in other ways from time to time about the processing of your personal information.