Customer-Vendor Privacy Notice

This Notice describes how we process and store your personal data and the rights available to you, during and after your working relationship with us, in accordance with applicable privacy laws.  

Applicability 

This Notice is applicable to all current and former customers and suppliers, vendors, business partners, service providers, and associated third parties. This Notice does not form part of any contract to provide services.  

Relationship 

LTTS is a “Data Controller” in relation to the Personal Data that we collect from you. This means that we are responsible for deciding how we hold and use Personal Data about you.  

Data protection principles 

While processing your Personal Data we will comply with applicable data privacy laws which requires us to adhere to the following principles which mandates that your Personal Data is: 

• used lawfully, fairly and in a transparent way. 
• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes. 
• relevant to the purposes informed to you and limited only to those purposes. 
• accurate and kept up to date. 
• kept only as long as necessary for the purposes we have told you about. 
• processed and kept securely. 

Your duties as a Data Subject 

• Comply with the provisions of all applicable laws for the time being in force while exercising rights under the provision of India’s Digital Personal Data Protection Act(2023). 
• Ensure not to impersonate another person while providing Personal Data for a specified purpose. 
• Ensure not to suppress any material information while providing Personal Data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities. 
• Ensure not to register a false or frivolous grievance or complaint with LTTS or the Board. 
• Furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of India’s Digital Personal Data Protection Act (2023) or the rules made thereunder. 

Your duty to inform us of changes 

Based on the information provided by you, the personal data that we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us. 

Rights available to you 

Your rights in connection with personal data: Under certain circumstances, by law, you have the: 

• Right of access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you. 
• Right to rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected. 
• Right to be informed about the collection and use of personal data. 
• Right to be forgotten which enables you to ask us to delete your personal data which we hold about you. 
• Right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you to object to processing on this ground. 
• Right to request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you during the time we are checking or confirming accuracy of such data.  
• Right of data portability/ transfer to another party. 
• Right to withdraw consent for processing of personal data where explicit consent has been sought. In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. 
• Right related to automated decision-making including profiling. You will have a right not to be subjected to a decision based solely on automated processing including profiling. 
• Right to nominate. You will have the right to nominate any other individual, who shall, in the event of death or incapacity, exercise your rights in accordance with the provisions of India’s Digital Personal Data Protection Act (2023) and the rules made thereunder2.

If you are a California resident, you have the following rights under certain circumstances:  

• Right to Know: You have the right to request from us information on the personal data about you that we have processed in the preceding 12 months. This also enables you to receive a copy of the personal data we hold about you. 
• Right to Delete: You have the right to request from us the deletion of your personal data. 
• Right to Non-Discriminate: You have the right to exercise any of the rights listed above (and any other rights under CCPA) without discrimination by us. 

Additionally, under the CCPA, you can request LTTS to not sell your personal information to third parties. Similarly, under CCPA, LTTS is also required to inform you if LTTS sells or has sold your personal data during the last 12 months.  

Please note that none of these rights are absolute and are subject to provisions stated under applicable law.  

Your Personal Data that we will process 

We collect the following categories of personal data about you for various processing activities: 

• “Personal details”, including but not limited to Name, Email ID, Address, Company Name, Designation, etc. 
• Financial information including bank account holder’s name, bank account number, bank name, and address, bank sort code, claims settlement amount, etc.; 
• Background information of the individuals associated with your business; 
• Other details including interests and preferences, etc. 
• Your electronic identification data where required for the purpose of delivering products or services to (e.g., login, passwords, badge number and photograph, IP address, online identifiers/cookies, logs, access and connection times, and CCTV footage or other video surveillance (only if legally permitted and where clearly indicated).  

How is your Personal Data collected? 

If you are our customer, we may collect your Personal Data under the circumstances including but not limited to the following: 

• when you submit online applications, website forms, or give us your business cards. 
• indirectly from third parties. 
• when you correspond with us over phone or on email. 
• from publicly available sources of information. 
• during conventions, trade events, and trade shows. 
• when your business contact data is processed for sending newsletter that you requested.  

If you are our supplier, vendor, business partner, service provider, or associated third-party, we may collect your Personal Data under the circumstances including but not limited to the following: 

• we collect Personal Data directly through the applications/forms that are required to be filled at the time of third-party/vendor on-boarding. 
• we may collect your Personal Data indirectly from third-party service including background check provider/agency, credit reference agencies, etc. 
• when you correspond with us over phone or on email. 
• from publicly available sources of information. 

Irrespective of you being our customer or supplier, vendor, business partner or associated third-party, we may sometimes collect additional Personal Data about you throughout the period of your association with us. All data including any additional data collected during our course of the association will be used and stored for rendering service as well as for complying with our legal obligations or legitimate interests.  

Purposes and their lawful basis 

We will use your Personal Data only when the law allows us to do so and for the purposes for which we collected it. Most commonly, we will use your Personal Data in the following circumstances: 

• To generate the purchase order, agreements, etc. 
• To maintain customer relationship. 
• To send you marketing communication. 
• To maintain records, such as for audit purposes. 
• To respond to any queries raised by you through our website or by calling our official phone numbers or by sending emails to our official mail IDs. 
• To manage our technology resources (e.g., cyber-risk management, infrastructure management and business continuity). 
• To preserve our economic interests and ensure compliance to applicable laws.  

We rely on the following lawful basis: 

• Where we need to perform the obligations that we have agreed with you in a contract. 
• Where we need to comply with a legal obligation.  
• Where it is necessary for our legitimate interests (or those of a third party) provided your interests and fundamental rights do not override those interests.  
• Where we need to protect your interests (or someone else's interests). 
• Where we have sought your explicit consent. 

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so without undue delay. Please note that we may process your Personal Data without your knowledge or consent, in compliance with applicable privacy laws. 

If you fail to provide your Personal Data 

If you choose not to provide your personal data that is mandatory to process your request or for carrying out processing required as per our legitimate interests or any other purpose, we may not be able to redress your complaints on processing or with data subject requests such as right to access, delete etc. 

Change of purpose 

We will inform you about the changes in the processing of your Personal Data with regards to: 

• change in the categories of Personal Data provided to a third party 
• change in the method of processing of Personal Data by a third-party  
• change in the method in which LTTS will receive your request. 
• change in the purpose of processing by the person who jointly processes your Personal Data with us.  

Data sharing 

We will share your Personal Data with the following recipients:  

• We may share your Personal Data with third parties with whom we have a contractual relationship, including but not limited to sales and marketing vendors, cold calling vendors, data shredding agency, etc. We require third parties to respect the security and confidentiality of your data and to treat it in accordance with our instructions and as mandated under applicable law. 
• We may share your Personal Data with other LTTS entities for the performance of service contract. We may transfer your Personal Data transnationally for processing in accordance with the Standard Contractual Clauses/Inter-company Agreements/Binding Corporate Rules executed between LTTS and its entities situated across different geographies. 
• We may share your Personal Data within our Internal departments, including without limitation to the IT team, admin team sales and marketing teams, accounts team, finance team, events team, or procurement team, etc. 

Data security 

We have put in place reasonable security measures to protect the confidentiality of your Personal Data. Details of these measures are available in our data privacy policy. Third parties who are required to process your Personal Data, does so only on our instructions and under the obligation of implementing adequate amount of security and confidentiality. We enter into specific data processing agreements with such third parties to ensure that they comply with our privacy requirements as well as the standards prescribed under applicable laws. 

Data retention 

We will only retain your Personal Data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. 

In some circumstances we may anonymize your Personal Data so that it can no longer be associated with you, or identify you, in which case we may use such data without further notice to you. In cases where you no longer remain our customer/supplier/vendor/business partner/ service provider/associated third-party, we may still retain and/or securely destroy your Personal Data in accordance with our data retention policy or applicable laws and regulations.   

If you wish to exercise your rights, please contact the Data Protection Officer over email  dpo@ltts.com. 

For the detailed information, kindly refer to our data privacy policy.  

Data Protection Office 

We have appointed a Data Protection Officer (DPO) to oversee compliance with this Notice. If you have any questions about this Notice, or you want to know more about how we handle your personal data, or if want to exercise any of the aforesaid rights, please write to the DPO at: dpo@ltts.com.  

You have the right to make a complaint at any time to the regional supervisory authority for data protection issues.  

Apart from sending email to the aforesaid email ID, any request may be submitted by filling up the form on available on LTTS website.  

No fee usually required 

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. 

Changes to this Notice 

We reserve the right to update this Notice at any time. Any changes to this Notice will be displayed on the LTTS website. We may also notify you in other ways such as by contracts or agreements from time to time about the processing of your personal data. 

Footnotes:

[1] Additional requirement from India’s Digital Personal Data Protection Act (2023)