Global Privacy Policy

EDISCAS

GLOBAL PRIVACY POLICY

Effective Date: October 1, 2024 | Last Updated: October 1, 2024

This Privacy Policy explains how EDISCAS CONSULTING SERVICES PRIVATE LIMITED (CIN: U62099TS2023PTC173282) ("Ediscas", "we", "us" or "our) collects, receives, uses, discloses, stores and otherwise processes Personal Data in connection with our website, business operations, products and services.

Ediscas is an India-based business-to-business data and technology company. We may work with customers, data providers, businesses, institutions, researchers and technology companies located in India and other countries.

Our activities may include the lawful procurement, processing, organization, transformation, de-identification, aggregation, analysis, licensing and commercialization of datasets and data-related services.

This Privacy Policy is intended to apply globally, subject to any additional privacy rights or requirements that apply to you under the laws of your jurisdiction.

Legal Entity: EDISCAS CONSULTING SERVICES PRIVATE LIMITED (CIN: U62099TS2023PTC173282) | Registered Address: 5-16, near grampanchayath, lalgadi malakpet, bomraspet, rangareddy, k.v.rangareddy, telangana, India, 500078 | Country of Incorporation: India | Website: https://ediscas.com | Contact: legal@ediscas.com

Depending on the relevant processing activity, Ediscas may act as:

a controller or data fiduciary;

a processor or data processor;

a service provider;

an independent data controller/data fiduciary; or

another legally recognized role.

The applicable role depends on the nature of the relationship, the purpose of processing, the applicable law and the relevant contractual arrangements.

Where Ediscas processes Personal Data on behalf of a customer, the applicable contract and, where relevant, Data Processing Addendum ("DPA") will govern that processing relationship.

For this Privacy Policy, "Personal Data" means information relating to an identified or identifiable individual, or information treated as personal data, personal information or an equivalent category under Applicable Data Protection Law.

Depending on the circumstances, Personal Data may include:

name;

email address;

telephone number;

business contact details;

employer or organization;

job title or professional information;

account information;

communications and correspondence;

IP address;

device and browser information;

online identifiers;

usage information;

location information where collected;

information contained in documents or datasets;

professional or employment information;

technical information;

transaction information; and

other information that may identify or relate to an individual.

The specific categories processed depend on the relevant service, transaction and data source.

We may collect Personal Data directly from you when you:

visit our Website;

contact us;

submit a business inquiry;

request information;

request a demonstration;

request a dataset sample;

communicate with our team;

enter into a commercial relationship with us;

provide information during procurement or due diligence;

create or use an account or portal, where available;

attend an event, meeting or webinar; or

otherwise communicate with Ediscas.

Information collected directly may include your:

name;

business email;

telephone number;

organization;

job title;

business address;

communications;

preferences;

transaction information; and

other information you choose to provide.

Because Ediscas operates as a data procurement and licensing business, we may receive Personal Data and other information from sources other than the individual to whom the information relates.

Depending on the circumstances, sources may include:

data providers;

businesses;

customers;

research organizations;

healthcare organizations;

technology providers;

commercial partners;

publicly available sources;

licensed databases;

institutions;

contractors and service providers;

professional networks;

research datasets; and

other lawful sources.

Where we acquire datasets containing Personal Data, we seek to establish the relevant source, rights, restrictions and permitted uses applicable to the data.

Where required by Applicable Data Protection Law, we provide appropriate information to affected individuals or rely on an applicable exemption.

Ediscas may procure, receive, organize, process, structure, transform, de-identify, aggregate, analyze, license or otherwise commercialize datasets where permitted by Applicable Law and the rights applicable to the relevant data.

Datasets may contain:

non-personal data;

Personal Data;

professional information;

technical information;

business information;

research information;

de-identified information;

aggregated information;

derived information; or

other categories of information permitted under Applicable Law.

The fact that information is included in a dataset does not mean that Ediscas treats all such information in the same way.

We assess applicable rights, restrictions, contractual permissions and processing requirements based on the relevant dataset and transaction.

Depending on our business activities, Ediscas may work with datasets relating to areas including:

Software and Technology

Examples may include:

software engineering information;

source-code-related datasets;

developer workflows;

technical documentation;

software development activities;

testing and debugging information; and

related technical datasets.

Robotics

Examples may include:

sensor information;

robotics datasets;

demonstrations;

trajectories;

video or image data;

human-robot interaction data; and

simulation or environmental information.

Healthcare and Life Sciences

Examples may include:

clinical information;

medical information;

healthcare workflows;

medical imaging;

pathology information;

research datasets;

claims-related information;

provider information; and

other health-related datasets.

Healthcare and other specially protected information may be subject to additional legal, contractual and security requirements.

Depending on the circumstances, Ediscas may process Personal Data for purposes including:

providing and operating our Website and services;

responding to inquiries and communications;

managing customer and supplier relationships;

evaluating and entering into commercial transactions;

procuring and managing datasets;

performing data processing and transformation activities;

de-identifying or aggregating information where permitted;

preparing datasets and data products;

providing licensed datasets and related services;

supporting artificial intelligence and machine-learning development where authorized;

supporting research, analytics, evaluation and benchmarking;

maintaining provenance and data-rights records;

complying with contractual obligations;

preventing fraud, misuse and security incidents;

maintaining security and business continuity;

improving our products, services and operations;

managing billing and payments;

complying with legal and regulatory obligations;

establishing, exercising or defending legal claims; and

carrying out other purposes disclosed at the time of collection or otherwise permitted by Applicable Law.

Some datasets and services provided by Ediscas may be intended for artificial intelligence, machine-learning, software, robotics, research or related applications.

Where contractually and legally permitted, datasets may be used for:

AI model training;

machine-learning training;

fine-tuning;

model evaluation;

benchmarking;

research;

algorithm development;

software development;

robotics development;

product development; and

related commercial applications.

The applicable Data License, Order Form or other commercial agreement determines the specific rights granted to a customer.

Ediscas does not assume that every dataset may be used for every AI or commercial purpose.

Where the GDPR or another law requires a lawful basis for processing, Ediscas will rely on an appropriate legal basis depending on the circumstances.

These may include:

Consent

Where we obtain valid consent for a specified processing activity.

Contract

Where processing is necessary to enter into or perform a contract.

Legitimate Interests

Where processing is necessary for our legitimate interests or those of another party and those interests are not overridden by applicable rights and freedoms.

Examples may include:

managing business relationships;

fraud prevention;

information security;

network and service security;

business administration;

improving services; and

protecting legal rights.

Legal Obligation

Where processing is necessary to comply with a legal obligation.

Vital Interests

Where applicable law permits processing necessary to protect vital interests.

Other lawful grounds

Where another lawful basis is available under Applicable Data Protection Law.

The applicable legal basis may vary depending on the specific data, source, jurisdiction and processing activity.

Certain information may receive additional protection under Applicable Data Protection Law.

This may include, depending on the applicable law:

health information;

genetic information;

biometric information;

racial or ethnic information;

religious information;

political information;

sexual-orientation information;

information concerning criminal allegations or convictions; and

other specially protected categories.

Ediscas may process such information only where permitted under Applicable Law and where the applicable legal, contractual and operational requirements have been satisfied.

Where additional safeguards are required, they may be established through contractual agreements, processing restrictions, de-identification requirements, security measures or other appropriate controls.

Ediscas may create or receive:

de-identified data;

anonymised data;

aggregated data;

statistical information;

transformed data;

derived data; and

other data products.

Where data has been sufficiently anonymised under Applicable Law so that an individual is no longer identifiable, the information may no longer constitute Personal Data under that law.

However, Ediscas does not assume that a dataset is anonymous merely because direct identifiers have been removed.

The applicable legal status of a dataset depends on the nature of the transformation, the possibility of re-identification and the requirements of Applicable Law.

Where required, Ediscas will apply appropriate technical and organizational measures to reduce re-identification risks.

We may disclose Personal Data to:

customers;

data providers;

service providers;

technology providers;

hosting providers;

analytics providers;

professional advisers;

auditors;

legal advisers;

insurers;

payment providers;

business partners;

regulators and governmental authorities where legally required; and

other parties where permitted by Applicable Law.

Where Personal Data forms part of a dataset licensed to a customer, disclosure will be subject to the rights, restrictions, permissions and legal requirements applicable to that dataset.

We do not disclose Personal Data simply because it is available to us. The relevant disclosure must have an applicable legal, contractual or other lawful basis.

Where Ediscas obtains information from a data provider, the provider may be contractually required to represent and warrant that it has the necessary rights, permissions and authority to provide the relevant information to Ediscas.

Depending on the transaction, Ediscas may maintain records concerning:

source;

acquisition method;

acquisition date;

applicable permissions;

contractual restrictions;

geographic restrictions;

data categories;

Personal Data status;

de-identification status;

permitted uses;

licensing rights; and

other provenance information.

These records may be used to support data governance, customer due diligence, contractual compliance and regulatory requirements.

Where a customer provides Personal Data or other information to Ediscas, Ediscas will process that information according to the applicable agreement.

Where Ediscas acts as a processor, Ediscas will process the relevant Personal Data in accordance with the customer's documented instructions and the applicable DPA.

Where Ediscas acts as an independent controller/data fiduciary, Ediscas will process the information according to the applicable legal basis and this Privacy Policy.

Ediscas may use third-party service providers to support its business.

These may include providers of:

cloud infrastructure;

hosting;

data storage;

cybersecurity;

communications;

analytics;

customer relationship management;

payment processing;

legal and professional services;

identity and access management;

business administration; and

other operational services.

Where required by Applicable Law, Ediscas will enter into appropriate contractual arrangements with relevant processors and service providers.

Ediscas is based in India and may operate with customers, providers and service providers located in other countries.

Personal Data may therefore be transferred to or accessed from jurisdictions outside the country in which it was originally collected.

Where GDPR or another Applicable Data Protection Law requires a transfer mechanism, Ediscas will use an appropriate mechanism, which may include:

an adequacy decision;

Standard Contractual Clauses;

applicable contractual safeguards;

binding corporate rules, where applicable;

another legally recognized transfer mechanism; or

an applicable statutory derogation.

The European Commission recognizes adequacy decisions, Standard Contractual Clauses and other mechanisms as part of the GDPR's international-transfer framework.

Where appropriate, the relevant contractual arrangements may contain the applicable transfer provisions and supplementary safeguards.

Ediscas retains Personal Data only for as long as reasonably necessary for the purposes for which it was collected or otherwise processed, including:

providing services;

maintaining business and transaction records;

satisfying contractual obligations;

complying with legal obligations;

resolving disputes;

preventing fraud;

maintaining security; and

establishing or defending legal claims.

Retention periods may vary depending on:

the nature of the data;

the purpose of processing;

the contractual relationship;

legal requirements;

regulatory requirements;

security requirements; and

applicable limitation periods.

Where Personal Data is no longer required, Ediscas will delete, anonymise, de-identify or otherwise securely dispose of it where appropriate and subject to Applicable Law.

Dataset-specific retention obligations may be established under the applicable commercial agreement.

Ediscas maintains reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, use, disclosure, alteration, loss or destruction.

Depending on the nature of the processing, measures may include:

access controls;

authentication;

authorization controls;

encryption;

network security;

logging and monitoring;

backups;

vulnerability management;

personnel controls;

confidentiality obligations;

incident response procedures; and

data retention and deletion controls.

Security measures are reviewed and updated as appropriate to the nature and risks of the processing.

No method of transmission or storage can be guaranteed to be completely secure.

If Ediscas becomes aware of a Personal Data breach or security incident, we will assess and respond to it in accordance with our incident-response procedures and Applicable Law.

Where notification to a regulator, customer or affected individual is legally required, Ediscas will make such notification within the applicable timeframe.

Where Ediscas acts as a processor, notification and cooperation obligations will also be governed by the applicable DPA.

Ediscas may use cookies, pixels, tags, SDKs and similar technologies.

These technologies may be used for:

website functionality;

security;

analytics;

performance;

preferences;

communications; and

marketing, where permitted.

Our use of cookies and similar technologies is described in the Ediscas Cookie Policy.

Where consent is required, Ediscas will provide an appropriate consent mechanism.

Depending on your jurisdiction and the circumstances of processing, you may have rights concerning your Personal Data.

These may include the right to:

request access;

request correction;

request deletion;

request restriction of processing;

object to processing;

request portability;

withdraw consent where consent is the legal basis;

object to certain direct marketing;

object to certain automated decision-making or profiling; and

lodge a complaint with an applicable supervisory or regulatory authority.

Not every right applies in every circumstance.

The exercise of a right may be subject to applicable legal exceptions, including where retention or processing is required by law.

Where Ediscas relies on consent as the legal basis for processing, you may withdraw that consent.

Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

Where Applicable Law requires processing to cease following withdrawal, Ediscas will take appropriate steps within the applicable timeframe.

Where another lawful basis permits continued processing, Ediscas may continue the relevant processing to the extent permitted by law.

For India, the Digital Personal Data Protection Act provides that withdrawal of consent does not affect the legality of processing based on consent before withdrawal and provides for cessation of processing where required after withdrawal, subject to lawful exceptions.

To exercise applicable privacy rights, you may contact:

Privacy Contact: privacy@ediscas.com

Your request should include sufficient information to allow us to understand and verify the request.

Where permitted by law, we may request reasonable information to verify your identity before responding.

We will respond within the timeframe required by Applicable Data Protection Law.

If Ediscas processes your Personal Data solely on behalf of a customer, we may direct your request to the relevant customer where appropriate.

Ediscas' Website and B2B services are not directed toward children unless expressly stated otherwise.

We do not knowingly collect Personal Data from children in circumstances where such collection is prohibited by Applicable Law.

Where Ediscas processes children's data as part of a lawful dataset or customer service, additional requirements may apply.

Ediscas may use automated technologies for purposes such as:

data organization;

classification;

quality assessment;

fraud detection;

security;

analytics;

data matching; and

operational processes.

Where Ediscas carries out automated decision-making or profiling that is subject to specific legal rights or restrictions, Ediscas will provide the information and safeguards required by Applicable Law.

Ediscas does not represent that every use of automated processing constitutes legally regulated "automated decision-making."

Ediscas may disclose or transfer relevant information in connection with:

a merger;

acquisition;

financing;

restructuring;

sale of assets;

corporate reorganization;

investment;

bankruptcy or insolvency; or

similar corporate transaction.

Any such transfer will remain subject to Applicable Data Protection Law.

Ediscas may disclose Personal Data where reasonably necessary to:

comply with law;

respond to lawful governmental requests;

comply with court orders;

protect the rights or property of Ediscas;

investigate fraud or abuse;

protect users or third parties;

establish or defend legal claims; or

address security or safety concerns.

Where Ediscas is required under Applicable Data Protection Law to appoint an EU representative, UK representative, Data Protection Officer or other designated privacy contact, the applicable details will be published or provided through the appropriate privacy notice.

EU Representative, if applicable: Designated representative accessible via legal@ediscas.com

Data Protection / Grievance Officer: grievance@ediscas.com

Ediscas will not represent that a particular appointment is legally required unless the relevant legal and operational circumstances require it.

Where the Digital Personal Data Protection Act, 2023 and applicable rules apply to Ediscas' processing, Ediscas will process Personal Data in accordance with applicable requirements.

These may include requirements concerning:

notice;

consent;

legitimate uses where applicable;

data security;

retention;

erasure;

data principal rights;

grievance handling;

data processor arrangements; and

other applicable obligations.

The DPDP Rules 2025 require notices to be clear, standalone and understandable and to identify the Personal Data and purposes for processing, together with mechanisms for exercising rights and withdrawing consent where applicable.

Ediscas may be subject to privacy and data-protection laws in jurisdictions in which it operates, provides services, receives data or conducts covered processing activities.

Where applicable, Ediscas will implement additional contractual, technical or organizational measures required by those laws.

These may include, depending on the jurisdiction:

GDPR;

UK GDPR;

applicable U.S. state privacy laws;

Canadian privacy laws;

Australian privacy laws;

Indian data-protection laws; and

other applicable privacy legislation.

Where a jurisdiction grants additional mandatory rights, those rights will apply to the extent required by law.

Ediscas may update this Privacy Policy from time to time.

When we make changes, we will update the "Last Updated" date.

Where required by Applicable Law, we will provide additional notice or obtain consent for material changes to processing activities.

We encourage you to review this Privacy Policy periodically.

For privacy and data protection questions, requests or complaints:

EDISCAS CONSULTING SERVICES PRIVATE LIMITED (CIN: U62099TS2023PTC173282) | Registered Address: 5-16, near grampanchayath, lalgadi malakpet, bomraspet, rangareddy, k.v.rangareddy, telangana, India, 500078 | Email: legal@ediscas.com | General Email: contact@ediscas.com | Website: https://ediscas.com

Where Applicable Law provides a right to complain to a supervisory authority or data protection regulator, you may also exercise that right.

End of Privacy Policy