Privacy Policy

Your privacy is important to us. Meta-i respect your privacy. Meta-i are committed to protect your privacy. Data protection is of particularly high priority for Meta-i. However, if you (data subject) want to use Meta-i services, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, Meta-i generally obtain consent from the data subject. Processing of personal data, such as the first and last name, complete postal address, e-mail address, phone number, any other personal information of a data subject shall always be in line with the Digital Personal Data Protection (DPDP) Act, 2023, of India, and other relevant privacy policies.

1.0 Definitions

• 1.1 “Business Unit” is a formally defined area of Meta-i representing a specific business function (such as Finance, Solutions Development, Sales, Support, etc.). This could be a department or subset of a department.
• 1.2 “ISSC” means the Security Steering Committee who is also the Chief Privacy Officer.
• 1.3 “CISO” means the Chief Information Security Officer.
• 1.4 “Information” is considered databases, data files, contracts, agreements, system documentation, research information, user manuals, training material, standard operating procedures, business continuity plans, disaster recovery plans, third-party data, audit trails, and archived information.
• 1.5 “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• 1.6 “Privacy Guidelines” are documents that support this Privacy Policy but are not directive in nature. Guidelines are designed to provide members of the Workforce a recommended path to achieve compliance with Meta-i ’ policy.
• 1.7 “Privacy Policy” refers to this formal statement by Meta-i ’ executive management outlining the overall intention and direction of the safeguarding and protection of Sensitive Information for Meta-i , including, but not limited to, affiliates of Meta-i . It is not intended to be detailed, but rather to serve as a capstone principle supported by subordinate documents (including, but not limited to, the Privacy Procedures and Privacy Standards).
• 1.8 “Privacy Procedures” directly support this Privacy Policy and are a detailed set of instructions for various groups of individuals, such as the general Workforce, management, Human Resources, and Business Units. These procedures outline the detailed steps, establish timelines, and document specific behaviors for all Workforce members who are bound within this Privacy Policy’s scope to be in compliance.
• 1.9 “Privacy Standards” support this Privacy Policy by providing specific boundaries. Privacy Standards are focused and serve to establish a set of mandatory decision criteria for systems and processes. Privacy Standards are intended for a limited audience and are mandatory by definition. Privacy Standards do not normally require executive management approval and therefore are more fluid and may adapt to technology changes.
• 1.10 “Processing” is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• 1.11 “Processor” is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• 1.12 “Sensitive Information” is a class of data, that relates to an identified or identifiable individual or entity that is sensitive, confidential, or proprietary to such person or entity and may potentially cause harm to such person or entity if lost or accessed, or used or disclosed by unauthorized persons, either internal or external to Meta-i . “Sensitive Information” includes, but is not limited to, Protected Health Information, Personal Information, Personal Health Information, Personal Data, and Personally Identifiable Information including other sensitive KYC (Know Your Customer) information collected as a part of OVD (Officially valid document (OVD) the passport, the driving license, the Permanent Account Number (PAN) Card, the Voter's Identity Card issued by the Election Commission of India, job card issued by NREGA (as those terms are defined in applicable law).
• 1.13 “Systems” are any computing assets that may create, access, or store sensitive data, including those used internally and those developed and sold as a product.
• 1.14 “Workforce” means full-time or temporary employees, contractors, third-party users, volunteers, interns, trainees, agents, and other persons whose conduct, in the performance of work for Meta-i , is under the direct control of Meta-i , whether they are on-site or off-site, and whether or not they are paid by Meta-i .

2.0 Purpose and Scope

This Privacy Policy explains our policy regarding the collection, use, disclosure and transfer of your information by Meta-i Technologies Pvt Ltd, doing business as, Meta-i , Meta-i is IT enabled service company which works with government, private and public sectors in the field of education, assessment and recruitment services. Our services are based on Business to Business (B2B) and Business to Government (B2G) model and/or its subsidiary(ies) and/or affiliate(s) (collectively referred to as the Company), which operates the website (“Site”), mobile applications (App) and other services including but not limited to delivery SMS, mobile application developed with the aim to provide assessment, Content/question bank management services and recruitment services for colleges/universities and corporate respectively and related content via the site and application, any mobile or internet connected device or otherwise (collectively the “App Service”).

The Company respects the privacy of the users of the Meta-i platform Services and is committed to reasonably protect it in all respects. The information about the user as collected by the Company is: (a) information supplied by users and (b) information automatically tracked while using a mobile device having Meta-i platform Services enabled (collectively referred to as Information).

It is the policy of Meta-i to comply with all applicable laws and regulatory requirements for the use, access and disclosure of Sensitive Information, to ensure the confidentiality and protection of Sensitive Information, and to prevent and mitigate any privacy incidents.

All members of the Workforce shall be required to comply with this Policy and it is applicable to all Meta-i global operations. Individuals who violate these requirements are subject to disciplinary action, up to and including termination or dismissal.

1.1 Information Supplied by / collected from Users

To avail certain services of Meta-i , users are required to provide some personally identifiable information (PII) for the registration process which may include:- a) name, date of birth, gender, b) email address, c) phone number, d) d) bank account details e) Aadhaar details, f) PAN g) residential address, h) alternate contact details such as Mobile Number and Email Address, i) Photographs and biometric data (mainly for recruitment assessments), j) Financial information such as Income documents (parental), birth and educational certificates (for college admissions), and bank account details (for onboarding of exam-related personnel), k) IP addresses, and CCTV data where applicable for assessment security, etc. and any other such information as required. Meta-i collects parent/guardian information for projects involving minors.

In case you choose to decline to submit personally identifiable information on the App/Site, Meta-i may not be able to provide certain services on the App/Site to you. Meta-i will make reasonable efforts to notify you of the same at the appropriate time. In any case, Meta-i will not be liable and or responsible for the denial of certain services to you for lack of you providing the necessary personal information.

When you register with the Meta-i services, Meta-i may contact you from time to time about updation of your personal information to provide such features that Meta-i believe may benefit/interest you.

1.2 Use of Information

The Information as supplied by the users will be used to improve the services and provide you the most user-friendly experience. All required information is service dependent and the Company may use the above said user Information to maintain, protect, and improve the services and for developing new services.

Meta-i may, however, use your email address and phone number without further consent for non-marketing or administrative purposes (such as notifying you of major changes, for customer service purposes, providing information about updates to services, billing, etc.).

Any personally identifiable information provided by you will not be considered as sensitive if it is freely available and/or accessible in the public domain. Further, any reviews, comments, messages, blogs posted/uploaded/conveyed/communicated by users on the public sections of the Site becomes published content and is not considered personally identifiable information subject to this Privacy Policy.

1.3 Information automatically tracked while using the App or Site

Demographic and Related Information: Meta-i may reference other sources of demographic and other information in order to provide you with more targeted communications and promotions. Meta-i use Google Analytics, among others, to track user behaviour on our website.

Google Analytics specifically has been enabled to support display advertising to help us gain an understanding of our users’ Demographics and Interests. The reports are anonymous and cannot be associated with any individual personally identifiable information that you may have shared with us.

Log File Information: Our Servers automatically collect limited information about your device’s connection to the Internet, including your IP address, when you visit our Site or use the App. Meta-i automatically receive and log information from the App and/or your browser including but not limited to IP address, and your operating system. Meta-i may also collect log information from your device, including but not limited to your location, IP address, , device’s serial number or unique identification number (e.g. UDiD on your iOS device, Android ID or ADID on your Android Device), your device operating system, browser type and version, , and connection speed etc.

Cookies: To improve the responsiveness of the Site for our users, Meta-i may use “cookies”, or similar electronic tools to collect information to assign each visitor a unique, random number as a User Identification (User ID) to understand the user’s individual interests using the identified computer. Our partners may also assign their own cookies to your browser, a process that Meta-i do not control.

1.4 Links to Third Party Sites/Ad-Servers

The Site may include links to other websites. Such sites are governed by their respective privacy policies, which are beyond our control. Once you leave our servers (you can tell where you are by checking the URL in the location bar on your browser), use of any information you provide is governed by the privacy policy of the operator of the site you are visiting. That policy may differ from ours. If you can’t find the privacy policy of any of these sites via a link from the site’s homepage, you should contact the site directly for more information.

1.5 Information Sharing

The Company (i.e Meta-i) may share sensitive personal information with any third party without obtaining the prior consent of the User in the following limited circumstances:

• When it is requested or required by law or by any court or governmental agency or authority to disclose, for the purpose of verification of identity, or for the prevention, detection, investigation including cyber incidents, or for prosecution and punishment of offences. These disclosures are made in good faith and belief that such disclosure is reasonably necessary for enforcing these Terms or for complying with the applicable laws and regulations.
• Meta-i may share necessary information to Agencies or Government Agencies, with whom Meta-i have valid MoUs, and Third Parties as agreed in the MoUs.
• No personally identifiable data of an individual user such as name, phone number, email address, spends data, card details etc. would be shared with any other User and/or third party – unless explicitly approved by the concerned individual user in order to avail of certain services. However, if this conflicts with conditions mentioned in the immediate point above, this condition would become null and void.

1.6 Accessing and Updating Personal Information

When you use the Meta-i platform Services Site (or any of its sub sites), Meta-i make efforts in good faith to provide you, as and when requested by you, with access to your personal information and shall further ensure that any personal information or sensitive personal data or information found to be inaccurate or deficient shall be corrected or amended as feasible, subject to any requirement for such personal information or sensitive personal data or information to be retained by law or for legitimate business purposes. Any grievance in this regard will be duly addressed by the Data Protection Officer whose contact information is provide below.

Any data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection.

Meta-i ask individual users to identify themselves and the information requested to be accessed, corrected or removed before processing such requests, and Meta-i may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, jeopardize the privacy of others, or would be extremely impractical (for instance, requests concerning information residing on backup tapes), or for which access is not otherwise required.

Processing activities include sensitive handling such as printing question papers, managing OMR sheets, biometric data collection, and CCTV surveillance for examination integrity. META-i obtains onboarding documents such as Proof of Address (POA) and Proof of Identity (POI) from Subject Matter Experts (SMEs) involved in question paper creation.

In any case, where Meta-i provide information access and correction, Meta-i perform this service free of charge, except if doing so would require a disproportionate effort. Because of the way Meta-i maintain certain services, after you delete your information, residual copies may take a period of time before they are deleted from our active servers and may remain in our backup systems.

1.7 Information Storage and backup

If enabled from the app, Meta-i store your data and take a backup of your data on Meta-i platform on our Cloud database/server according to country specific compliance requirements. This is done for the purpose of enabling users to get their data back in case their phone’s data becomes unusable, if the phone is lost, or the user moves to a new phone device. However, in exceptional cases, client server is used to store the data.

1.8 Information Security

Meta-i take appropriate security measures to protect against unauthorised access to or unauthorized alteration, disclosure or destruction of data. These include internal reviews of our data collection, storage and processing practices and security measures, including appropriate encryption and physical security measures to guard against unauthorised access to systems where Meta-i store personal data. All information gathered on the Meta-i platform is securely stored within the controlled database. Access to the servers is password-protected and is strictly limited.

META-i primarily services government clients through tender processes, where clients operate our platforms and use their own privacy policies and terms, under which candidates or students participate. Most of the cases the privacy and terms and conditions will not align with the privacy requirements. In some cases, there will not be any privacy policies or term and conditions. META-i acts as a data processor in such cases, facilitating technical services rather than directly interacting with data subjects.

3.0 Exceptions to this Privacy Policy

Exceptions to this Privacy Policy may be granted by the Information and Security Steering Committee (ISSC).

4.0 Privacy Principles

Meta-i has implemented the following fair information privacy principles that support individual rights and set guidelines for the protection of Sensitive Information:

3.1 Notice

Meta-i shall provide notice regarding its privacy policies and procedures and include the purposes for which Sensitive Information is accessed, collected, used, retained, and disclosed. Notice may occur in a variety of formats including publication on Meta-i ’ internal and external websites and specified in internal and external contracts and agreements.

3.2 Choice and Consent

Where practical or required by law or contract, Meta-i shall provide individuals with opportunity to consent to or authorize Meta-i’s access, collection, use, retention, and disclosure of Sensitive Information. Consent or authorization may be explicit or implicit depending upon the specific circumstances, and the PSSC shall advise the Business Units as to appropriate means of obtaining consent or authorization. Processing of personal data is done only with the free consent of the individual. The personal data and the purpose of processing the same will be informed to the individual/company concerned, with a notice. However, META-i does not directly obtain consent from candidates or students who typically access the platform via client portals, without explicit knowledge of META-i’s involvement. In case of minors, special precautions are taken and lawful guardians' consent is obtained.

3.3 Limited Collection

Sensitive Information shall only be collected for the purposes identified in the notice.

3.4 Limited Use and Disclosure

Sensitive Information shall only be used and/or disclosed to third parties for the purposes identified in the notice.

3.5 Limited Retention

Sensitive Information may be retained only as long as necessary, including, but not limited to, as may be required by law or contract, to fulfill a valid business purpose.

3.6 Accuracy

Meta-i shall maintain the accuracy and integrity of the Sensitive Information under its care.

3.7 Right to Inspect/Confirm and Correction

Individuals may request access to their Sensitive Information and request amendment to that Sensitive Information if such information is believed to be inaccurate. Meta-i shall review and respond to requests for access and amendment in a timely manner. The ISSC shall provide guidance to Business Units regarding individual rights to access and/or amend Sensitive Information upon request by the Business Unit.

3.8 Right to Erasure

Each data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• The data subject withdraws consent on which the processing is based and no other lawful or business ground exists for retaining the data.
• The data subject raises a valid objection to processing and there are no overriding business or legal reasons to continue such processing.
• The personal data has been processed in a manner inconsistent with internal policies or applicable law.
• The personal data must be erased complying with an applicable legal obligation.
• Where personal data of minors has been collected without appropriate safeguards or permissions.

Important Notice: While Meta-i make reasonable efforts to honor deletion requests, Meta-i are not legally bound by DPDP or equivalent data protection frameworks. Therefore, deletion cannot be guaranteed in all circumstances, and certain information may be retained as necessary for operational, contractual, security, or legal purposes.

If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by Meta-i, he or she may, at any time, contact Data Protection Officer. The Data Protection Officer of Meta-i shall promptly ensure that the erasure request is complied with immediately.

Where the controller has made personal data public and is obliged to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. The Data Protection Officer of Meta-i will arrange the necessary measures in individual cases.

3.9 Right of restriction of processing

Each data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of personal data and requests instead the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• If data subject object to how Meta-i are using his/her personal data, Meta-i may pause processing while Meta-i review whether our business reasons for using it outweigh your concerns.

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by Meta-i, he or she may at any time contact Data Protection Officer of the controller. The Data Protection Officer of Meta-i will arrange the restriction of the processing.

3.10 Right to object

Each data subject shall have the right to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her. This also applies to profiling based on these provisions.

Meta-i will no longer process the personal data in the event of the objection, unless Meta-i can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If Meta-i processes personal data for marketing purposes – either directly or through platforms like Google Ads (AdWords), Bing Ads, Facebook, AdRoll, etc. the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such marketing. If the data subject objects to Meta-i processing for marketing purposes, Meta-i will no longer process the personal data for these purposes.

In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by Meta-i for scientific or historical research purposes, or for statistical purposes, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

In order to exercise the right to object, the data subject may contact the Data Protection Officer of Meta-i. Additionally, the data subject is free, in the context of using information society services, to exercise this right by automated means through technical specifications.

3.11 Right to withdraw data protection consent

Each data subject shall have the right to withdraw his or her consent to process his or her personal data at any time.

If the data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact Data Protection Officer of Meta-i.

3.12 Disposal

Meta-i shall dispose and destroy Sensitive Information, at the end of the applicable retention period, in a manner that prevents the likelihood of restoration of the Sensitive Information or in a manner required by law or contract.

3.13 Training

Workforce members shall be provided training on this Privacy Policy.

3.14 Breach Notification

Actual or suspected breaches of Sensitive Information shall be immediately reported in accordance with the Privacy and Security Incident Reporting Policy.

3.15 Accountability

Violations of this Privacy Policy may result in discipline up to and including termination, in compliance with Human Resources policies.

5.0 Privacy Policy Requirements

4.1 Policy Availability

This Privacy Policy shall be made available to the Workforce through Meta-i management, the Intranet, formal training programs, and other appropriate mechanisms.

4.2 Review Cycle

4.2.1 The ISSC shall review the privacy requirements for the organization. The ISSC shall be responsible for conducting an annual review of this Privacy Policy and all related corporate policies, standards, and procedures. The ISSC may grant an exception for an annual review of this Privacy Policy. A review shall also occur each time there is a significant and material change in laws or regulations regarding the privacy of Sensitive Information. The ISSC shall submit material changes or modifications for approval to the Senior Management, the CISO, and Legal team for review prior to presentation for final review and approval by the Security Steering Committee.

4.2.2 Requests for changes or modifications to this Privacy Policy may be submitted by a member of the Workforce in writing to the ISSC. The ISSC and the CISO shall determine whether the requested change or modification should be included in the Privacy Policy.

4.3 Policy Retention

This Privacy Policy, as well as any procedures supporting this Privacy Policy, and all previous versions shall be maintained for a minimum of six (6) years after the latest effective date, even if superseded, or longer if required by a legal, regulatory, or contractual requirement.

4.4 Changes to the Policy and Opt-Out

Meta-i will occasionally change/update this Privacy Policy to reflect Company and customer feedback and to meet the changing government policies and regulations. Meta-i may notify you by posting a prominent announcement on our web pages. However, Meta-i encourages you to periodically review this Policy to be informed of how Meta-i are protecting your information.

By disclosing personal information to Meta-i the user is giving consent to send promotional materials through a medium like SMS, Email, etc., as per this Privacy Policy. In case of the user intending to opt out of the promotional activities from Meta-i, the user may unsubscribe using the button in the promotional email.

YOU MAY CHOOSE TO “OPT-OUT”/STOP RECEIVING OUR NEWSLETTER OR MARKETING EMAILS BY FOLLOWING THE UNSUBSCRIBE LINK INCLUDED IN THESE EMAILS OR BY SENDING AN E-MAIL TO marcom@metaitechnologies.com.

6.0 Privacy Requirements

5.1 Executive Commitment

Meta-i’s executive leadership agrees that maintaining the privacy and security of Meta-i, the Workforce, PII, PD, PI, Personal Health Information, and other Sensitive Information is essential to Meta-i’s business and reputation and to operating in a responsible, compliant manner. Accordingly, the Executive Leadership affirmatively approves and supports this Privacy Policy

5.2 Workforce Responsibilities

Each member of the Meta-i workforce is responsible for the security of Sensitive Information in his or her workspace. Workforce members take reasonable and appropriate precautions to safeguard access to Sensitive Information including, without limiting the generality of the following, compliance with security measures required by the Security Policy and other guidance issued by the Security Steering Committee and Chief Information Security Officer.

Each Workforce member shall be responsible for:

• 5.2.1 Reading and understanding the contents of this Privacy Policy and its related policies and procedures;
• 5.2.2 Ensuring that his or her actions comply with the requirements of this Privacy Policy and its related policies and procedures;
• 5.2.3 Demonstrating his or her understanding of and compliance with this Privacy Policy and its related policies and procedures through the completion of annual training and certification or through any other means used by Meta-i for such certification;
• 5.2.4 Collaborating with all levels of the Meta-i organization to ensure that an effective privacy program is implemented and maintained;
• 5.2.5 Seeking assistance if uncertain how to comply with the requirements of this Privacy Policy and its related policies and procedures;
• 5.2.6 Complying with the Security Policy and related policies and procedures and implementing and maintaining the Security Program;
• 5.2.7 Reporting any violations of this Privacy Policy, related policies or procedures or the law or regulations to the ISSC, CISO, Human Resources representative, Meta-i management,

5.3 Managers’ Responsibilities

In addition to responsibilities as a member of the Workforce, each Meta-i manager shall be also be responsible for:

• 5.3.1 Ensuring that all members of the Workforce reporting directly or indirectly to such manager have read, understand, been trained on, and comply with, this Privacy Policy and its related policies and procedures;
• 5.3.2 Ensuring all members of the Workforce who report directly or indirectly to such manager have completed the required privacy training;
• 5.3.3 Ensuring that this Privacy Policy, and its related policies and procedures, are fully implemented in his or her functional area of responsibility;
• 5.3.4 Requesting guidance from Human Resources or the ISSC on implementing this Privacy Policy as a manager if needed.

5.4 Business Units and Functional Areas

In addition to responsibilities as a member of the Workforce, each Business Unit or functional area leader shall also be responsible for:

• 5.4.1 Identifying any privacy-related contractual requirements mandated or requested by external clients or third-party vendors, and not previously approved by the legal team and the ISSC, and providing those requirements or requests to the legal team and the ISSC prior to contract execution;
• 5.4.2 Identifying where Sensitive Information is located, and providing such information to the ISSC and/or CISO;
• 5.4.3. Maintaining a list of all Workforce members who have access to Sensitive Information and approving access by Workforce members to any Sensitive Information in a manner consistent with such Workforce members’ duties and responsibilities;
• 5.4.4 Documenting and maintaining procedures to implement this Privacy Policy within its own Business Unit.

5.5 Security Steering Committee

The Security Steering Committee shall be responsible for:

• 5.5.1 Developing, implementing and maintaining this Privacy Policy and related policies and procedures;
• 5.5.2 Coordinating with the CISO in the development and maintenance of security policies and programs to ensure that appropriate physical, administrative and technical safeguards are in place to protect the privacy and security of Sensitive Information;
• 5.5.3 Upon request, reviewing, guiding, and approving Standard Operating Procedures (SOPs) for Business Units and functions, relating to Sensitive Information;
• 5.5.4 In collaboration with Human Resources, designing and ensuring the provision of adequate training to all Workforce members, including to every new hire as a part of the on-boarding process, on this Privacy Policy, related policies and procedures, and the privacy and security laws and regulations of applicable jurisdictions;
• 5.5.5 Receiving and reviewing complaints related to this Privacy Policy and related procedures or the requirements for the handling of Sensitive Information under any applicable law, including documenting the complaint and disposition thereof;
• 5.5.6 Coordinating with Human Resources to recommend appropriate discipline for violations of this Privacy Policy;
• 5.5.7 Reviewing and responding to requests from law enforcement and regulatory agencies for access to Sensitive Information, in coordination with others to the extent permitted and as appropriate;
• 5.5.8 Ensuring that Meta-i complies with applicable privacy laws, regulations, and contractual privacy requirements;
• 5.5.9 May designate another individual to function in his/her capacity with regards to the requirements set forth in this Policy.

5.6 Human Resources

Human Resources shall be responsible for:

• 5.6.1 Together with the ISSC, designing, documenting, and enforcing a progressive disciplinary policy for non-compliance with or violation of this Privacy Policy and related policies and procedures;
• 5.6.2 Ensuring that Workforce members reporting violations of this Privacy Policy, related policies or procedures or the law are protected from retaliation;
• 5.6.3 Collaborating with hiring managers to ensure privacy and security obligations are specified in Meta-i job and roles descriptions;
• 5.6.4 Communicating job status changes, including termination of Workforce members, to IT Operations, so that access to systems with Sensitive Information is appropriately modified.

7.0 Permitted Uses and Disclosures of Sensitive Information

All members of the Workforce shall safeguard the confidentiality of and protect any Sensitive Information in accordance with the requirements of this Privacy Policy, other applicable policies and procedures, relevant contractual requirements, and as required by law.

6.1 Consent and Authorization to Use Sensitive Information

6.1.1 Limited Collection. Workforce members shall only collect, request, or access the minimum amount of Sensitive Information necessary to serve a valid business purpose and in accordance with the requirements of this Privacy Policy, other applicable policies and procedures, relevant contractual requirements, and as required by law.

6.1.2 Limited Use. Meta-i Workforce members shall only access, use, and disclose Sensitive Information in accordance with:

• 6.1.2.1 the requirements of the consent or authorization provided by the subject or owner of the Sensitive Information;
• 6.1.2.2 the requirements of this Privacy Policy, or other applicable policies and procedures;
• 6.1.2.4 relevant contractual requirements; and
• 6.1.2.5 as required by law.

6.1.3 All access, use and disclosure of Sensitive information shall be limited to the minimum amount of Sensitive Information necessary to accomplish a valid business purpose.

6.1.4 All requests to limit or cease using Sensitive Information shall be directed to the ISSC for review.

6.2 De-Identified Sensitive Information

6.2.1 In certain cases, Meta-i may receive consent or authorization to de-identify Sensitive Information. In these cases, once the Sensitive Information has been de-identified, Workforce members may use and disclose the de-identified Sensitive Information in accordance with the consent or authorization.

6.2.2 Requests to de-identify Sensitive Information must be submitted, in writing, to the ISSC or her/his designee who will evaluate the scope and purpose of the request and the means of de-identification to ensure a low likelihood of re-identification of Sensitive Information and that applicable legal, contractual, and industry-standard requirements are met.

6.3 Disclosures Required by Law

Meta-i may use or disclose Sensitive Information as required by law.

8.0 Privacy Risk Assessment

Meta-i shall assess Privacy Risk annually pursuant to Meta-i ’s Risk Management Policy.

9.0 Reporting and Handling of Privacy Complaints and Incidents

For the purposes of this Privacy Policy, all privacy complaints and incidents shall follow Privacy and Security Incident Response Policy.

10.0 Disposal of Sensitive Information

All electronic media and paper copies containing Sensitive Information shall be retained in accordance with Meta-i Records Management Policy and Retention Schedule, and properly disposed of once the intended use has been completed in accordance with the Meta-i Information Classification and Handling Policy. All media or copies containing Sensitive Information from a client is either to be returned to the client, or destroyed, in accordance with the contractual agreement with the client.

11.0 Human Resources Privacy Requirements

10.1 Human Resources is responsible for ensuring that Workforce Members’ Sensitive Information is appropriately identified and protected in accordance with this Privacy Policy, contractual requirements, applicable laws and regulations of Government of India.

10.2 For countries like United States, European Union Meta-i Human Resources will protect any health-related Sensitive Information obtained as a result of providing health-related benefits to employees in accordance with this Privacy Policy, applicable laws, regulations, and contractual requirements.

12.0 Complaints and Grievances

In case you have any complaints and/or grievances in relation to the processing of your Personal Information you can send this via e-mail to our Privacy Officer privacyofficer@metaitechnologies.com

Meta-i will revert to you on your clarification or requests or queries or complaints or grievance within 48 working hours but not more than 72 working hours.

13.0 Appendix A – Applicable Regulatory Standards

Laws and regulations relevant to this Policy include, but are not limited to, the following:

• Information Technology Act of 2000/2008 (India)
• Personal Data Protection Bill 2019 -PDP Bill 2019
• Digital Personal Data Protection (DPDP) Act, 2023
• RBI Master Circular – 'Know Your Customer' (KYC) Guidelines-RBI/2015-16/108
• Organization of Economic Cooperation and Development Guidelines