Snapshot 222411
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy Updated October 26, 2026 Data Privacy Board Name Designation / Role BU/SBU Vamsi Krishna Vice President - ISSC Head Professional Services Nayan Hazra Director — Global DPO & Grievance Officer IT Security & Modern Tech Ops Samir Dadia Vice President Finance & Accounts Diwyata Burbure Senior Director — Legal Legal Ashwin Jaisinghani Associate Vice President People Success Name Vamsi Krishna Designation / Role Vice President - ISSC Head BU/SBU Professional Services Name Nayan Hazra Designation / Role Director — Global DPO & Grievance Officer BU/SBU IT Security & Modern Tech Ops Name Samir Dadia Designation / Role Vice President BU/SBU Finance & Accounts Name Diwyata Burbure Designation / Role Senior Director — Legal BU/SBU Legal Name Ashwin Jaisinghani Designation / Role Associate Vice President BU/SBU People Success Introduction Searce operates globally, with group entities incorporated in India, the United States, the United Kingdom, Singapore, Indonesia, Malaysia, Canada, Australia, the Philippines, the United Arab Emirates, and Saudi Arabia (each, a “Group Entity,” collectively “Searce,” “We,” “Us,” or “Our”; see Annex A for the full list). We respect the privacy of every individual whose Personal Information We handle in the course of Our business operations and are committed to protecting it in accordance with the data protection laws applicable in each jurisdiction in which We operate. This Privacy Policy (“Policy”) explains how We collect, use, disclose, transfer, and protect Your Personal Information in connection with Our Services, and how You can access, correct, delete, or otherwise manage it. Because data protection requirements differ by country, Annex B sets out jurisdiction-specific rights, regulators, and how to exercise them. Where a Group Entity is subject to additional or stricter local requirements, those requirements govern that entity’s processing in addition to this Policy. We design and operate Our processing activities in line with the principle of Privacy by Design and by Default — meaning We consider privacy risk at the point We design a product, feature, or process, and We configure default settings to be privacy-protective, consistent with Article 25 of the GDPR/UK GDPR and equivalent expectations under other laws referenced in this Policy. Searce’s information security and privacy practices are backed by independent, third-party assurance. Searce maintains ISO/IEC 27001 (Information Security Management) certification, undergoes SOC 1 and SOC 2 attestation examinations, and holds compliance certification under Saudi Arabia’s Personal Data Protection Law (PDPL) for its Riyadh entity. Searce is additionally working toward ISO/IEC 42001 (AI Management System) certification, and its India Group Entities are implementing a dedicated compliance program to meet the Digital Personal Data Protection Act, 2023 (DPDPA) ahead of the statutory compliance. Both certification efforts are currently in progress ahead of their respective target/statutory deadlines. For security vulnerability reports or suspected incidents distinct from privacy rights requests, Searce maintains a dedicated channel — see Section 12 and Section 22. Terms Used in This Policy "Automated Decisions" means decisions about individuals based solely on automated processing of data that may produce legal or similarly significant effects on the individuals involved. "Consent" means a freely given, specific, informed, and unambiguous indication of an individual’s wishes, given by a statement or clear affirmative action, by which the individual agrees to the processing of their Personal Information. "Controller" (also referred to as “Data Fiduciary” under India’s DPDPA or “Organisation” under certain APAC laws) means the entity that determines the purposes and means of processing Personal Information. "Cookies" means small text files stored on Your device when browsing Our Services. "Data Subject / Data Principal / You/Your(s)/Users" refers to the individual to whom the Personal Information relates. "Personal Information" (referred to as “Personal Data” in several jurisdictions) means any information relating to an identified or identifiable natural person, including by reference to an identifier such as a name, identification number, location data, or online identifier. "Processor" (also “Data Processor”) means an entity that processes Personal Information on behalf of a Controller. "Sensitive Personal Information / Special Category Data" includes data such as health information, biometric or genetic data, financial account details, government identifiers, racial or ethnic origin, religious beliefs, or data concerning children, which is subject to heightened protection under most of the laws referenced in this Policy. Biometric identifiers (e.g., fingerprints, facial geometry) are treated as Sensitive Personal Information and, where Searce processes them for a Group Entity subject to a dedicated biometric privacy statute (for example, in certain US states), We apply the additional consent, retention, and disclosure requirements of that statute. "Services" means Your use of all websites, applications, services, products, e-mails, and other communications by or on behalf of Searce. "Third Party/Parties" refers to any individual or legal entity who is not a party to this Policy. "Usage Data" means information collected automatically about access to and use of Our Services, including IP address, browser type and version, pages visited, time and date of visit, time spent on pages, unique device identifiers, and other diagnostic data. "Data Protection Impact Assessment (DPIA)" means a structured assessment, carried out before or during a processing activity, that identifies and mitigates privacy risks to individuals arising from that activity, including processing that uses automated or AI-based systems. "Records of Processing Activities (ROPA)" means the internal register Searce maintains of its processing activities, including the purposes of processing, categories of data and data subjects, recipients, cross-border transfers, and retention periods, consistent with Article 30 GDPR/UK GDPR and equivalent good-practice expectations under other laws referenced in this Policy. Our Group Entities and Scope of This Policy This Policy applies to all Searce Group Entities listed in Annex A, regardless of the jurisdiction in which they are incorporated. Depending on the context, “We,” “Our,” or “Searce” refers to the specific Group Entity that collects or processes Your Personal Information, or to Searce as a whole where the context requires. See Annex A for the complete list of entities and locations. Role of Searce Depending on the engagement, Searce may act as a Controller (Data Fiduciary/Organisation) — determining the purposes and means of processing Personal Information — or as a Processor (Data Processor) — processing Personal Information on behalf of Our clients, who act as Controllers under applicable data protection laws. Where Searce acts as a Processor, We process Personal Information strictly under the client’s documented instructions and applicable data processing agreements. What Data Do We Collect and How? Searce follows the following principles with respect to the collection and use of Personal Information: Personal Information is processed fairly, lawfully, and transparently; Personal Information is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; Personal Information collected is adequate, relevant, and limited to what is necessary (data minimization); Accurate Personal Information is collected, and inaccurate data is rectified or erased upon Us becoming aware of it; Personal Information is retained in identifiable form no longer than necessary under the applicable law; Privacy risk is considered by design and by default in how We build and configure Our Services. We may collect the Personal Information including but not limited to the following categories, as required to provide Our Services: Contact details, such as address/location, e-mail address, phone or fax number, and social media account name; First name and last name; Age, gender, and date of birth; Organization and employment details (current and previous); Tax and financial information; Information collected through Cookies and similar tracking technologies, where accepted/allowed by You; Usage Data. Your Personal Information may be collected directly through Your use of Our Services, from publicly available sources or social media (e.g., LinkedIn, Facebook, Instagram, X, etc.), lawfully obtained public or commercial databases, lead-generation databases, and Third Party websites, partners, or vendors. Each purpose of processing is supported by an appropriate legal basis under the law applicable to the relevant Group Entity and data subject, which may include: (i) consent, (ii) contractual necessity, (iii) compliance with a legal obligation, (iv) protection of vital interests, (v) performance of a task in the public interest (where applicable), or (vi) Searce’s legitimate interests, balanced against Your rights and freedoms. Where a jurisdiction (e.g., India’s DPDPA) recognizes a narrower set of lawful grounds, We rely only on the grounds recognized under that applicable law. Where processing of Personal Information does not rely on explicit consent, Searce may process such information on one or more of the following legal bases, as applicable under the law of the relevant jurisdiction: (i) performance of a contract to which the Data Principal is a party or in order to take steps at their request prior to entering into a contract; (ii) compliance with a legal obligation applicable to Searce; (iii) processing in the context of employment or services rendered by the Data Principal to Searce, including HR, payroll, and workforce management; (iv) processing for purposes for which the Data Principal has voluntarily provided their information, such as recruitment or B2B sales engagement; or (v) Searce’s legitimate interests, where not overridden by the rights and freedoms of the Data Principal. Under India’s DPDPA 2023, these bases are recognised as deemed consent under Section 7 of the Act. Under the EU/UK GDPR, these correspond to the lawful bases under Article 6(1). Under other applicable laws referenced in this Policy, equivalent provisions apply as recognised under the relevant local law. Where Searce acts as a Data Processor on behalf of a client, processing is governed strictly by the client’s documented instructions and applicable Data Processing Agreements, and the applicable lawful basis obligations vest with the client as Data Fiduciary. In addition to this Policy, Searce issues specific Privacy Notices to Data Principals at or before the point of data collection (wherever applicable under the law) for each processing activity consistent with Section 5 of the DPDPA 2023. These notices provide the specific data categories, purposes, and rights relevant to each individual interaction. Where applicable under the DPDP Rules, 2025, Searce will interact with registered Consent Managers to facilitate the giving, managing, reviewing, and withdrawal of consent by Data Principals. Searce is assessing its obligations under Rule 4 of the DPDP Rules, 2025, in respect of the Consent Manager framework, ahead of the applicable statutory deadline. How Do We Use the Data We Collect? Searce uses Personal Information for legitimate business purposes only, including but not limited to: Providing and maintaining Our Services requested by entities and individuals; Maintaining and developing Our business offerings; Notifying You about changes to Our Services and related terms and policies; Enabling participation in interactive or other features of Our Services; Responding to enquiries and providing support services; Improving Our Services and developing new ones; Monitoring access to and usage of Our Services; Complying with legal obligations, defending and enforcing Our legal rights, and managing regulatory matters, investigations, and data breaches; Processing payments via PCI DSS-compliant third-party payment processors, where card payment data is involved; Searce does not itself directly store, process, or transmit cardholder data; Monitoring, detecting, preventing, and resolving technical, security, or safety issues; Conducting research, data analysis, and reporting; Enabling due diligence for any actual or proposed merger, sale, acquisition, restructuring, financing, or joint venture; Providing relevant search results, news, marketing, and promotional materials, subject to Your consent or opt-out rights where required by law; Identifying and onboarding new clients; Customizing Our business offerings and communications; Facilitating communication between Our employees, partners/vendors, and You; Tracking activity through Cookies, where accepted/allowed by You; Including Your reviews, comments, or feedback in advertisements or promotions, with Your consent. You are the owner of Your Personal Information. We will seek Your consent before using it for any purpose materially different from those described in this Policy, except where processing without consent is expressly permitted under applicable law. Personal Information is processed manually and electronically, and access is restricted to authorized Searce personnel and Third Parties who are trained and contractually bound to process it lawfully and only per Our instructions. Cookies & Tracking Technologies We use cookies and similar tools to improve Your experience, analyze usage, and deliver personalized content. Where required by applicable law (including the EU/UK ePrivacy framework, and consent regimes under India’s DPDPA, Indonesia’s PDP Law, and other jurisdictions listed in Annex B), We obtain Your consent before placing non-essential cookies and provide a mechanism to withdraw that consent at any time. Where applicable, We also recognize opt-out preference signals such as the Global Privacy Control (GPC) for individuals in jurisdictions that require Us to honor such signals (e.g., California). You can also manage or disable cookies through Your browser settings. For details on the cookies We use and how to control them, refer to Our Cookie Policy at https://www.searce.com/cookie. Disclosure of Your Personal Information We may disclose Your Personal Information to Our partners, vendors, service providers, representatives, and other Third Parties under a written contract that obligates them to implement privacy protections consistent with applicable law. In such cases, We disclose only the Personal Information that is relevant and necessary to fulfill Our contractual obligations. We may also disclose Personal Information: If required by law, or in the bona-fide belief that disclosure is necessary to comply with legal processes, including civil or criminal subpoenas, court orders, or regulatory requests; To protect and defend Searce, Our Services, or Our Users; To act under exigent circumstances to protect the personal safety of any person; To existing or potential partners, vendors, or service providers, for marketing, data analysis, data storage, business consultation, collaboration, client support, service provision, hosting, or finance and accounting purposes; If requested by or on Your behalf; Between Searce Group Entities, as necessary for the purposes described in this Policy, subject to the transfer safeguards described in Section 9. 8.1 Vendor & Sub-Processor Due Diligence Before engaging a vendor, partner, or sub-processor who will process Personal Information on Searce’s behalf, Searce performs a risk-based security and privacy assessment covering, as applicable: the vendor’s information security certifications or attestations (e.g., ISO/IEC 27001, SOC 2), its data handling and sub-processing arrangements, its breach-notification commitments, and the physical and technical location(s) where it will store or process the data. Vendor contracts require, at minimum: (a) processing strictly on Searce’s or its client’s documented instructions; (b) confidentiality obligations binding the vendor’s personnel; (c) implementation of technical and organizational security measures no weaker than those described in Section 12.1; (d) prompt notification to Searce of any actual or suspected personal data breach; and (e) cooperation with, or a contractual right for Searce or its clients to conduct, security audits or reviews. Searce maintains a register of active vendors and sub-processors that handle Personal Information and reviews this register periodically as part of its compliance program. Clients may request a summary of the sub-processors engaged in connection with their engagement by writing to privacy@searce.com. 8.2 Sectoral Compliance Frameworks Where Searce processes Personal Information on behalf of a client in a manner that falls within the scope of a sectoral regulatory framework — for example, protected health information subject to the US Health Insurance Portability and Accountability Act (HIPAA), or nonpublic personal financial information subject to the US Gramm-Leach-Bliley Act (GLBA) — Searce enters into the additional agreements required by that framework (such as a HIPAA Business Associate Agreement, or GLBA-equivalent data-safeguarding terms) as part of the applicable client contract and data processing agreement, in addition to and not in place of this Policy. This Policy describes Searce’s general privacy practices; it does not itself constitute a Business Associate Agreement or sectoral compliance certification, and clients operating in a regulated sector should confirm the specific contractual terms applicable to their engagement with their Searce relationship owner. Transfer of Data Searce is a global organization; Your Personal Information may be transferred to, stored, and processed in countries other than the one in which it was collected, including countries with data protection standards that differ from Your own. Where We transfer Personal Information across borders, We use appropriate safeguards depending on the jurisdictions involved, which may include: Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO, for transfers out of the EEA/UK; The EU-US Data Privacy Framework (DPF) and the UK Extension to the DPF, where the receiving Searce Group Entity or vendor is self-certified under that framework, as an alternative or complement to SCCs for transfers to the United States; Adequacy decisions, where the destination country is recognized as providing an adequate level of protection; Saudi Arabia’s Regulations on Personal Data Transfer outside the Kingdom (including SDAIA-approved SCCs, binding common rules, or certification), for transfers involving the Riyadh entity; UAE Data Office-recognized mechanisms (consent, adequacy, or appropriate safeguards) for transfers involving the Dubai entity; Compliance with any Government of India restrictions on cross-border transfer of personal data that may be notified under the DPDPA, for transfers involving Indian entities; Intra-group data transfer agreements incorporating equivalent contractual protections for transfers between Searce Group Entities. Searce takes reasonable steps to ensure Your data is treated securely and in accordance with this Policy, and no transfer of Personal Information will take place to a Third Party or country unless adequate safeguards are in place. Retention of Personal Information Searce retains Personal Information only for as long as necessary: for the purposes set out in this Policy; for the duration of Our engagement with You; as needed to provide Our Services; and to the extent necessary to comply with legal obligations, resolve disputes, and enforce Our agreements and policies. Usage Data is generally retained for a shorter period unless it is needed to strengthen security, improve functionality, or We are legally required to retain it for longer. Tax, financial, and accounting records are retained for the minimum period mandated by applicable tax, corporate, and financial-services record-keeping law in the relevant Group Entity’s jurisdiction. Certain jurisdictions impose specific retention or erasure-notice requirements. For example, under India’s DPDP Rules, 2025, We provide notice at least 48 hours before erasing Personal Information where the specified purpose is no longer being served (unless retention is required by law or You engage further within the retention period), and We retain traffic data and processing logs for at least one year for investigation and continuity purposes. Where a jurisdiction imposes a different minimum or maximum retention period, that requirement governs the processing carried out by the relevant Group Entity. A detailed, category-by-category retention schedule is maintained internally as part of Searce’s Records of Processing Activities and is available to regulators and, where contractually agreed, to clients on request. Individual Data Principals may request information about the retention period applicable to their personal data by writing to privacy@searce.com. Accuracy Where Searce collects Your Personal Information directly from You, it is Your responsibility to provide accurate information. Searce takes reasonable steps to keep Personal Information accurate, complete, current, and relevant. If Your Personal Information is inaccurate or irrelevant, You may request rectification, update, or erasure by writing to privacy@searce.com. Your request may be subject to identity verification. We may decline requests that are unreasonably repetitive, require disproportionate technical effort, risk the privacy of others, are extremely impractical, or are unreasonably expensive, consistent with applicable law. We generally assist free of cost, except where unreasonable extra effort is required. Security of Data Searce employs technical, infrastructural, and organizational measures designed to protect the security of Personal Information, consistent with the standards expected under applicable law (including “reasonable security safeguards” under India’s DPDPA, appropriate technical and organizational measures under GDPR/UK GDPR, and equivalent standards under the other laws referenced in this Policy). No method of transmission over the internet or electronic storage is 100% secure, and We cannot guarantee absolute security. If You become aware of a security issue or wish to report a suspected data breach, contact Us at privacy@searce.com. To report a suspected security vulnerability in Our Services, contact Us at soc@searce.com. 12.1 Technical & Organizational Security Measures This section summarizes, at a level appropriate for a public-facing policy, the categories of technical and organizational measures Searce applies to protect Personal Information. Detailed control descriptions, architecture diagrams, and audit evidence are available to clients and regulators under NDA, and are also reflected in the certifications and attestations listed in Section 12.2. Data classification: Personal Information and other business data are classified according to sensitivity, and the controls applied (encryption, access restriction, monitoring) scale with that classification. Encryption & key management: Personal Information is encrypted in transit using industry-standard protocols (e.g., TLS 1.2+) and at rest using industry-standard encryption for data stored in Searce-managed or Searce-hosted environments. Encryption keys are managed and rotated in line with Searce’s key-management procedures. Cryptographic agility & post-quantum readiness: Searce tracks the finalized NIST post-quantum cryptography standards (FIPS 203, 204, and 205) and maintains a crypto-agility roadmap so that key systems can migrate to post-quantum or hybrid algorithms as client, regulatory, or standards-body timelines require. This roadmap is reviewed as part of the annual security review referenced in Section 19. Access control: Access to systems and data is granted on a least-privilege, role-based basis, is logged, and is subject to access review no less than quarterly. Multi-factor authentication (MFA) is required for access to production systems, administrative consoles, and remote access to Searce’s network. Network & infrastructure security: Searce maintains network segmentation, firewalls, intrusion detection/prevention controls, endpoint protection, and centralized security logging and monitoring across its managed environments, and performs vulnerability scanning on an ongoing basis and penetration testing of in-scope systems no less than annually. Secure development: Searce follows a secure software development lifecycle (SDLC) incorporating code review, dependency and vulnerability scanning, and change-management approvals for production releases. Personnel security: Access to Personal Information is limited to personnel who require it for their role, all of whom complete privacy and security awareness training at least annually and are bound by confidentiality obligations; access is revoked promptly upon role change or termination. Vendor & sub-processor security: See Section 8.1. Incident response: Searce maintains a documented incident response plan with defined severity levels and escalation paths. Upon confirming a personal data breach, Searce’s internal target is to complete initial triage and impact assessment within 24 hours of confirmation, with legal/regulatory assessment following immediately thereafter, to enable the jurisdiction-specific regulator and individual notification timelines summarized in Section 12.3 to be met. Business continuity & backups: Searce maintains backup and disaster-recovery procedures for in-scope systems, with defined recovery objectives, tested no less than annually, to support the availability of Services and the integrity of Personal Information. 12.2 Certifications & Independent Assurance Searce’s security, AI governance, and privacy controls are subject to independent verification through the following certifications and attestations. Scope statements, certificate numbers, and audit periods are available on request or in the associated certificates/reports maintained by Searce’s Compliance function. Certification / Attestation Coverage Status ISO/IEC 27001 (Information Security Management System) Information security controls across in-scope Searce Group Entities and services Certified ISO/IEC 42001 (AI Management System) Governance of AI development and deployment activities In progress SOC 1 Controls relevant to financial reporting for in-scope services Attestation completed SOC 2 Security, availability, and confidentiality controls (Trust Services Criteria) for in-scope services Attestation completed PCI DSS Payment card handling — not directly applicable to Searce Not held. Searce does not directly process, store, or transmit cardholder data. Where a client engagement involves card payments, transactions are routed through PCI DSS-compliant third-party payment processors/gateways; Searce does not maintain its own PCI DSS Attestation of Compliance. Saudi Arabia PDPL Compliance Certification Searce Technologies Company (Riyadh) Certified India DPDPA Compliance Program Indian Group Entities (Pune, Ahmedabad, Bangalore, Hyderabad, Mumbai, Rajkot) In progress Certification / Attestation ISO/IEC 27001 (Information Security Management System) Coverage Information security controls across in-scope Searce Group Entities and services Status Certified Certification / Attestation ISO/IEC 42001 (AI Management System) Coverage Governance of AI development and deployment activities Status In progress Certification / Attestation SOC 1 Coverage Controls relevant to financial reporting for in-scope services Status Attestation completed Certification / Attestation SOC 2 Coverage Security, availability, and confidentiality controls (Trust Services Criteria) for in-scope services Status Attestation completed Certification / Attestation PCI DSS Coverage Payment card handling — not directly applicable to Searce Status Not held. Searce does not directly process, store, or transmit cardholder data. Where a client engagement involves card payments, transactions are routed through PCI DSS-compliant third-party payment processors/gateways; Searce does not maintain its own PCI DSS Attestation of Compliance. Certification / Attestation Saudi Arabia PDPL Compliance Certification Coverage Searce Technologies Company (Riyadh) Status Certified Certification / Attestation India DPDPA Compliance Program Coverage Indian Group Entities (Pune, Ahmedabad, Bangalore, Hyderabad, Mumbai, Rajkot) Status In progress 12.3 Breach Notification Where a personal data breach occurs, Searce will assess and notify the relevant regulator(s) and affected individuals in accordance with the timelines and thresholds applicable in the relevant jurisdiction, including as summarized below. Internally, Searce targets completion of initial breach triage within 24 hours of confirmation (see Section 12.1) so that these external timelines can be met. Jurisdiction Notification Approach India (DPDPA) Notify the Data Protection Board of India as soon as possible upon becoming aware of a personal data breach, in the manner and with the content prescribed under Rule 7 of the DPDP Rules, 2025, including: the nature of the breach; categories and approximate number of Data Principals and personal data records affected; name and contact details of Searce’s designated point of contact; likely consequences of the breach; and measures taken or proposed to address it. Affected Data Principals are notified in accordance with the Board’s directions. UK / EEA (GDPR) Notify the relevant Supervisory Authority within 72 hours of becoming aware, where feasible; notify affected individuals where there is high risk United States Notify affected individuals, and state Attorneys General and/or consumer reporting agencies where applicable, in accordance with the breach notification statute of each US state in which affected individuals reside; sectoral federal notification obligations apply where relevant data types are involved Australia Notify OAIC and affected individuals under the Notifiable Data Breaches scheme where there is likely serious harm Philippines Notify the NPC within 72 hours of knowledge of a personal data breach that may give rise to real risk of harm to affected data subjects; notify affected individuals without undue delay where required Saudi Arabia (PDPL) Notify SDAIA promptly and, where risk to the data subject exists, notify the affected individual UAE (PDPL) Notify the UAE Data Office and affected individuals where the breach poses a risk to their data or privacy Canada (PIPEDA) Notify the Office of the Privacy Commissioner of Canada and affected individuals where the breach creates a real risk of significant harm (RROSH), and maintain records of all breaches regardless of notification threshold Singapore / Malaysia / Indonesia Notify the applicable regulator and affected individuals in accordance with the notification thresholds and timelines under the relevant local law Jurisdiction India (DPDPA) Notification Approach Notify the Data Protection Board of India as soon as possible upon becoming aware of a personal data breach, in the manner and with the content prescribed under Rule 7 of the DPDP Rules, 2025, including: the nature of the breach; categories and approximate number of Data Principals and personal data records affected; name and contact details of Searce’s designated point of contact; likely consequences of the breach; and measures taken or proposed to address it. Affected Data Principals are notified in accordance with the Board’s directions. Jurisdiction UK / EEA (GDPR) Notification Approach Notify the relevant Supervisory Authority within 72 hours of becoming aware, where feasible; notify affected individuals where there is high risk Jurisdiction United States Notification Approach Notify affected individuals, and state Attorneys General and/or consumer reporting agencies where applicable, in accordance with the breach notification statute of each US state in which affected individuals reside; sectoral federal notification obligations apply where relevant data types are involved Jurisdiction Australia Notification Approach Notify OAIC and affected individuals under the Notifiable Data Breaches scheme where there is likely serious harm Jurisdiction Philippines Notification Approach Notify the NPC within 72 hours of knowledge of a personal data breach that may give rise to real risk of harm to affected data subjects; notify affected individuals without undue delay where required Jurisdiction Saudi Arabia (PDPL) Notification Approach Notify SDAIA promptly and, where risk to the data subject exists, notify the affected individual Jurisdiction UAE (PDPL) Notification Approach Notify the UAE Data Office and affected individuals where the breach poses a risk to their data or privacy Jurisdiction Canada (PIPEDA) Notification Approach Notify the Office of the Privacy Commissioner of Canada and affected individuals where the breach creates a real risk of significant harm (RROSH), and maintain records of all breaches regardless of notification threshold Jurisdiction Singapore / Malaysia / Indonesia Notification Approach Notify the applicable regulator and affected individuals in accordance with the notification thresholds and timelines under the relevant local law For Searce’s India Group Entities, the CERT-In Directions, 2022 (issued under Section 70B of the Information Technology Act, 2000) additionally require notification of specified cybersecurity incidents to the Indian Computer Emergency Response Team (CERT-In) within six hours of becoming aware, irrespective of whether personal data is involved. Searce’s India entities maintain the processes, designated point of contact, and log-retention infrastructure (minimum 180 days) required to comply with these directions. 12.4 Regulatory Horizon & Emerging Frameworks In addition to the laws referenced throughout this Policy, Searce monitors regulatory developments that may affect its clients and Group Entities over the life of this Policy, including in particular: EU Network and Information Security Directive 2 (NIS2) and the EU Digital Operational Resilience Act (DORA) — relevant where Searce provides services to EU financial-sector clients or clients otherwise designated as essential or important entities. Applicability is assessed on an engagement-by-engagement basis, and where NIS2, DORA, or equivalent operational-resilience obligations apply to a specific engagement, they are addressed through the applicable client contract and data processing agreement, in addition to this Policy; Emerging US state-level cybersecurity, breach-notification, and AI/automated-decision-making requirements beyond those already summarized in Section 12.3, Section 14, and Section 15, which Searce tracks as part of its compliance program as additional states enact comprehensive privacy or AI legislation. Third Party Sites Our Services may contain links to Third Party sites not operated by Us. If You access a Third-Party site, You will be governed by that party’s privacy policy. This Policy does not cover the practices of Third-Party websites or other Third Parties, even where associated with Our Services. We recommend reviewing the privacy notices of every site You visit; We are not responsible for the outcomes of Your interactions with Third Party websites. Automated Decision Making Searce does not make solely automated decisions that produce legal or similarly significant effects on individuals as a routine practice. Where such automated decision-making is used, affected individuals will, where required by law — including GDPR/UK GDPR Article 22, the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) for AI systems that fall within its prohibited, high-risk, or limited-risk categories, the Colorado AI Act, and California’s automated decision-making technology (ADMT) regulations under the CCPA/CPRA, and equivalent provisions under other laws referenced in this Policy — be given an opportunity to express their views, request human intervention, and object to the decision. Where Searce develops, deploys, or integrates an AI system that may qualify as high-risk under the EU AI Act, or that triggers an impact-assessment obligation under the Colorado AI Act or an equivalent US state law, Searce applies additional risk-management, documentation, and human-oversight measures proportionate to that classification, consistent with Section 15. Searce’s role for any given AI system — as provider, deployer, or downstream processor — is assessed on an engagement-by-engagement basis, since the applicable obligations differ by role. AI Adverse Impact Reporting: As part of Searce’s AI Management System, which is being aligned to ISO/IEC 42001:2023, any individual, including Data Principals, clients, employees, or members of the public, who believes they have experienced or observed an adverse impact from an AI system developed, deployed, or integrated by Searce may report it to privacy@searce.com. Adverse impacts include unintended outcomes, discriminatory results, inaccurate automated outputs, or any other AI-related concern. Reports are reviewed by Searce’s IT Security team and escalated to the Data Privacy Board where appropriate, and may be shared with the relevant client where Searce acts as a processor. Searce will acknowledge receipt within 3 business days. Data Protection Impact Assessments & AI Risk Assessments Before undertaking a new processing activity that is likely to result in a high risk to individuals — including large-scale processing of Sensitive Personal Information, systematic monitoring, or the use of AI or other automated systems to make or materially inform decisions about individuals — Searce conducts a Data Protection Impact Assessment (DPIA) or an equivalent AI risk/impact assessment. This assessment identifies the purpose and nature of the processing, evaluates the necessity and proportionality of the processing against that purpose, assesses risks to individuals’ rights and freedoms, and documents the measures taken to mitigate those risks. For processing involving AI systems, this assessment additionally considers: the training data sources and any Personal Information they contain; the intended use case and any foreseeable misuse; measures to address bias, explainability, and accuracy; and human-oversight mechanisms consistent with Section 14. These practices are being formalized as part of Searce’s ongoing work toward ISO/IEC 42001 (AI Management System) certification referenced in Section 12.2, and are also intended to support compliance with DPIA-equivalent obligations expected for Significant Data Fiduciaries under India’s DPDPA once those provisions take effect, and with Article 35 of the GDPR/UK GDPR where applicable. Where a processing activity involves an AI system that may be classified as high-risk under the EU AI Act, or that triggers an impact-assessment obligation under the Colorado AI Act or an equivalent US state law, Searce’s AI risk assessment additionally addresses the risk-management, technical documentation, and conformity-assessment expectations of that framework, to the extent applicable to Searce’s role (as provider, deployer, or processor) in the relevant engagement. Where such an assessment identifies a residual high risk that cannot be mitigated through the AI system’s design or use restrictions, Searce escalates the matter to the Data Privacy Board referenced at the front of this Policy before the system is deployed or continued in production. Where a DPIA or AI risk assessment identifies a residual high risk that Searce cannot mitigate through reasonable measures, Searce will consult the relevant supervisory authority listed in Annex B before proceeding with the processing, where such prior consultation is required by applicable law. Providing Information to Searce If You choose not to provide certain Personal Information, this may impede the exchange of information necessary to perform a contract with You or provide Our Services, and We may be unable to provide certain Services to You. Your Rights Subject to the specific law applicable to You (see Annex B), You generally have the right to: Know the purposes for which Your Personal Information is processed, and the persons or Third Parties who have access to it; Access a copy of Your Personal Information; Request rectification or correction of inaccurate or incomplete Personal Information; Request erasure or deletion of Your Personal Information, subject to legal exceptions; Restrict or object to certain processing, including for direct marketing; Request data portability, where technically feasible and required by law; Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; Nominate a representative to exercise Your rights on Your behalf (available, for example, under India’s DPDPA); Lodge a complaint with the applicable supervisory authority listed in Annex B; Right to Nominate (Section 14 DPDPA): Data Principals subject to India’s DPDPA may nominate any individual to exercise their data rights on their behalf in the event of death or incapacity, by writing to privacy@searce.com. To exercise any of these rights, write to Us at privacy@searce.com. Your request may be subject to identity verification and may be limited by applicable legal exceptions. Searce will acknowledge and respond to Your request within the timeframe prescribed by the law applicable to Your jurisdiction (for example, one month under GDPR/UK GDPR, generally 45 days under CCPA/CPRA, or the timeframe prescribed under India’s DPDP Rules); where a jurisdiction does not prescribe a specific timeframe, Searce endeavors to respond without undue delay. Searce will investigate and attempt to resolve any complaints or disputes regarding the use and disclosure of Your Personal Information. To submit a formal Data Principal Rights Request, contact privacy@searce.com to receive the applicable rights request form. Children’s Privacy Our Services are not intended for individuals below the age of digital consent or majority applicable in their location, and We do not knowingly collect Personal Information from such individuals without appropriate parental or guardian consent where required. That age threshold varies by law — for example, 18 under India’s DPDPA, 13 under the US COPPA framework, and 16 by default under the GDPR/UK GDPR (subject to a lower age, no less than 13, where a member state has legislated one) — and Searce applies the threshold applicable to the relevant Group Entity and data subject. Where Searce has reason to believe a user may be a minor, We take reasonable, risk-based steps to seek appropriate consent before processing that individual’s Personal Information. Several jurisdictions impose specific obligations regarding children’s data — for example, India’s DPDPA requires verifiable parental consent before processing a child’s Personal Information, and other jurisdictions listed in Annex B impose similar or additional protections. If You are a parent or guardian and believe We hold Your child’s or ward’s Personal Information without appropriate consent, please contact Us at privacy@searce.com, and We will delete such information and, where applicable, stop providing Our Services to the minor. Compliance Searce verifies compliance with this Policy through a combination of internal self-assessment and independent external assurance, including its ISO/IEC 27001, SOC 1, SOC 2, and Saudi PDPL certifications/attestations described in Section 12.2, and the technical and organizational measures described in Section 12.1. Searce maintains internal Records of Processing Activities (ROPA) covering its principal processing activities, categories of data, recipients, cross-border transfers, and retention periods, and reviews this register periodically as part of its compliance program. Searce is also working toward ISO/IEC 42001 (AI Management System) certification, and its India Group Entities are separately executing a dedicated DPDPA compliance program — covering consent architecture, itemized notices, Data Principal rights fulfillment, and breach-response readiness ahead of the statutory deadline referenced in Annex B. Both are in progress and being completed ahead of their respective target/statutory deadlines. This Policy will be updated as those programs, and the associated regulatory guidance, develop. Searce has formally assessed its regulatory classification under Section 10(1) of the DPDPA, 2023 through a documented Significant Data Fiduciary (SDF) Applicability Assessment. Based on this assessment, Searce is classified as a Standard Data Fiduciary in its secondary role, and as a Data Processor in its primary role when delivering services to client organizations. Across all Section 10(1) evaluation factors — including volume and sensitivity of personal data, risk to Data Principals, national security considerations, and public order impact — Searce’s risk profile is assessed as Low to NIL. Searce does not meet the presumptive category thresholds applicable to e-commerce entities, social media intermediaries, online gaming platforms, or systemically important institutions. Accordingly, Searce is currently exempt from the additional obligations applicable to Significant Data Fiduciaries under Section 10(2) of the Act and Rule 13 of the DPDP Rules, 2025, including statutory DPO appointment, mandatory external data audits, annual DPIA submissions to the Data Protection Board, algorithmic safety audits, and strict in-country data localization. This assessment will be reviewed annually, or prior to Searce launching any public-facing B2C digital services, whichever is earlier. This Policy, and Searce’s underlying compliance programs, will be formally reviewed by the Data Privacy Board at least annually, and additionally on a trigger basis when a material regulatory development occurs — for example, when EU AI Act high-risk obligations take effect for in-scope systems, when a new US state enacts comprehensive privacy or AI legislation applicable to Searce’s operations, or when there is a material change to Searce’s certification scope under Section 12.2. If You believe Your Personal Information has been processed or disclosed in violation of this Policy, please raise Your concern with Searce’s Data Protection Officer at privacy@searce.com. You also have the right to lodge a complaint with the applicable supervisory authority listed in Annex B. Opt-Out Policy You may opt out of having Your Personal Information used for advertisements, newsletters, promotional, and marketing purposes, and other purposes not directly related to Our Services, by contacting Us at privacy@searce.com or using the opt-out mechanism in the relevant communication. Where required by applicable law, We also honor recognized opt-out preference signals such as the Global Privacy Control (GPC) (see Section 7). We will inform Third Parties with whom We have shared Your Personal Information of Your request to the extent required by law, though We are not responsible for their independent non-compliance. Changes to This Privacy Policy We may update this Policy from time to time and will publish any changes on this page. The updated version will govern Our use of Your Personal Information from its effective date. Where required by applicable law (for example, material changes affecting EEA/UK individuals, or changes requiring fresh consent under India’s DPDPA), We will provide additional notice or seek renewed consent as appropriate. You are advised to review this Policy periodically. Contact Us If You have any questions about this Privacy Policy, wish to exercise a right described in Section 17, or need to reach a regional representative or supervisory authority, please contact Us at privacy@searce.com, or refer to Annex A for the Group Entity relevant to Your interaction with Searce and Annex B for the relevant national supervisory authority. To report a suspected security vulnerability, contact Us at soc@searce.com. For data subjects and the Saudi Data and Artificial Intelligence Authority (SDAIA) in the Kingdom of Saudi Arabia, Searce Technologies Company’s designated Data Protection Officer under the KSA Personal Data Protection Law is Rasheed Alghamdi, Solutions Consultant, Searce Technologies Company, Building 3853, Zayadah Al Qurtabi, Al Malaz, Riyadh, Saudi Arabia 12836. Email: privacy@searce.com. For UK data subjects, Searce Limited’s designated representative under Article 27 of the UK GDPR is Soma Naidoo, Director - Solutions Consulting, Searce Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Email: privacy@searce.com. UK data subjects may contact this representative directly in addition to writing to privacy@searce.com. Annex A: Searce Group Entities The following Group Entities are covered by this Policy. Each entity is responsible for its own processing activities and complies with the data protection law applicable in its jurisdiction, in addition to this Policy. Location Legal Entity Country Pune, India SLALLP (Searce Logistics Analytics LLP) India Pune, India SCSPL (Searce Cosourcing Services Pvt. Ltd.) India Ahmedabad, India SLALLP India Bangalore, India SCSPL India Hyderabad, India SCSPL India Mumbai, India SCSPL India Mumbai, India SIPL (Searce India Pvt. Ltd.) India Rajkot, India SCSPL India Rajkot, India SIPL India Houston, USA Searce Inc. United States Houston, USA Searce Technologies Inc. United States Singapore Searce Pte. Ltd. Singapore Singapore Searce Technologies Pte Ltd Singapore London, UK Searce Limited United Kingdom Indonesia P.T Searce Technologies Indonesia Indonesia Kuala Lumpur, Malaysia Searce Malaysia Sdn. Bhd. Malaysia Toronto, Canada Searce Canada Inc. Canada Sydney, Australia Searce Australia Pty Ltd Australia Manila, Philippines Searce Philippines Inc. Philippines Dubai, UAE Searce Technologies LLC United Arab Emirates Riyadh, Saudi Arabia Searce Technologies Company Saudi Arabia Location Pune, India Legal Entity SLALLP (Searce Logistics Analytics LLP) Country India Location Pune, India Legal Entity SCSPL (Searce Cosourcing Services Pvt. Ltd.) Country India Location Ahmedabad, India Legal Entity SLALLP Country India Location Bangalore, India Legal Entity SCSPL Country India Location Hyderabad, India Legal Entity SCSPL Country India Location Mumbai, India Legal Entity SCSPL Country India Location Mumbai, India Legal Entity SIPL (Searce India Pvt. Ltd.) Country India Location Rajkot, India Legal Entity SCSPL Country India Location Rajkot, India Legal Entity SIPL Country India Location Houston, USA Legal Entity Searce Inc. Country United States Location Houston, USA Legal Entity Searce Technologies Inc. Country United States Location Singapore Legal Entity Searce Pte. Ltd. Country Singapore Location Singapore Legal Entity Searce Technologies Pte Ltd Country Singapore Location London, UK Legal Entity Searce Limited Country United Kingdom Location Indonesia Legal Entity P.T Searce Technologies Indonesia Country Indonesia Location Kuala Lumpur, Malaysia Legal Entity Searce Malaysia Sdn. Bhd. Country Malaysia Location Toronto, Canada Legal Entity Searce Canada Inc. Country Canada Location Sydney, Australia Legal Entity Searce Australia Pty Ltd Country Australia Location Manila, Philippines Legal Entity Searce Philippines Inc. Country Philippines Location Dubai, UAE Legal Entity Searce Technologies LLC Country United Arab Emirates Location Riyadh, Saudi Arabia Legal Entity Searce Technologies Company Country Saudi Arabia Legal Entity Registered Office Address SEARCE COSOURCING SERVICES PVT LTD (SCSPL) Address - 31 Arham, Subhash Road, Moti Tanki, Rajkot - 360 001, Gujarat SEARCE Logistics Analytics LLP (SLALLP) SNO.2/2/2/6 THE WOOD'S WAKAD BLD.1 FLAT-602 / PUNE MH 411027, INDIA Searce India PVT LTD (SIPL) 11 Arham, Subhash Road, Moti Tanki, Rajkot - 360001, Gujarat PT Searce Technologies Indonesia Tower 36th floor Kuningan City, Jalan Profesor Doktor Satrio Kaveling 18, Kelurahan Karet Kuningan, Kecamatan Setiabudi, Jakarta Selatan 12940. Searce Inc 3663 North Sam Houston Pkwy E, Suite # 600, Houston Texas 77032 U.S.A Searce Technologies Inc. 8 The Green #24973; Dover, DE 1990 Searce Malaysia Sdn. Bhd. LEVEL 5, GUOCO TOWER 6 JALAN DAMANLELA, DAMANSARA CITY, BUKIT DAMANSARA, KUALA LUMPUR W.P. KUALA LUMPUR Searce Philippines Inc. 26 and 27/F Menarco Tower, 32nd St. Bonifacio Global City Taguig Manila, PHL-00 1634 Searce Technologies LLC Madina Mall, The One Tower - Office 06, 15th Floor, Sheikh Zayed Road, Dubai, UAE Searce Limited 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom Searce Australia Pty Limited C/O TMF Corporate Services (Aust) Pty Limited, Suite 1 Level 11, 66 Goulburn Street, Sydney New South Wales 2000, Australia Searce Pte. Ltd. 36 Robinson Road, #20-01, City House, Singapore - 068877 Searce Canada Inc C/O Tmf Canada Inc. 1 University Avenue, 3rd Floor Toronto On M5j 2p1 Searce Technologies Company Building # 3853, Zayadah Al Qurtabi, Al Malaz, Riyadh, Saudi Arabia - 12836 Legal Entity SEARCE COSOURCING SERVICES PVT LTD (SCSPL) Registered Office Address Address - 31 Arham, Subhash Road, Moti Tanki, Rajkot - 360 001, Gujarat Legal Entity SEARCE Logistics Analytics LLP (SLALLP) Registered Office Address SNO.2/2/2/6 THE WOOD'S WAKAD BLD.1 FLAT-602 / PUNE MH 411027, INDIA Legal Entity Searce India PVT LTD (SIPL) Registered Office Address 11 Arham, Subhash Road, Moti Tanki, Rajkot - 360001, Gujarat Legal Entity PT Searce Technologies Indonesia Registered Office Address Tower 36th floor Kuningan City, Jalan Profesor Doktor Satrio Kaveling 18, Kelurahan Karet Kuningan, Kecamatan Setiabudi, Jakarta Selatan 12940. Legal Entity Searce Inc Registered Office Address 3663 North Sam Houston Pkwy E, Suite # 600, Houston Texas 77032 U.S.A Legal Entity Searce Technologies Inc. Registered Office Address 8 The Green #24973; Dover, DE 1990 Legal Entity Searce Malaysia Sdn. Bhd. Registered Office Address LEVEL 5, GUOCO TOWER 6 JALAN DAMANLELA, DAMANSARA CITY, BUKIT DAMANSARA, KUALA LUMPUR W.P. KUALA LUMPUR Legal Entity Searce Philippines Inc. Registered Office Address 26 and 27/F Menarco Tower, 32nd St. Bonifacio Global City Taguig Manila, PHL-00 1634 Legal Entity Searce Technologies LLC Registered Office Address Madina Mall, The One Tower - Office 06, 15th Floor, Sheikh Zayed Road, Dubai, UAE Legal Entity Searce Limited Registered Office Address 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom Legal Entity Searce Australia Pty Limited Registered Office Address C/O TMF Corporate Services (Aust) Pty Limited, Suite 1 Level 11, 66 Goulburn Street, Sydney New South Wales 2000, Australia Legal Entity Searce Pte. Ltd. Registered Office Address 36 Robinson Road, #20-01, City House, Singapore - 068877 Legal Entity Searce Canada Inc Registered Office Address C/O Tmf Canada Inc. 1 University Avenue, 3rd Floor Toronto On M5j 2p1 Legal Entity Searce Technologies Company Registered Office Address Building # 3853, Zayadah Al Qurtabi, Al Malaz, Riyadh, Saudi Arabia - 12836 Annex B: Jurisdiction-Specific Rights and Regulators This annex summarizes, at a high level, the primary data protection law, supervisory authority, and key individual rights applicable in each jurisdiction in which Searce operates. It is not an exhaustive statement of law; where more specific or additional rights exist under local law, those rights apply. Jurisdiction Primary Law Supervisory Authority Key Individual Rights India Digital Personal Data Protection Act, 2023 (DPDPA) and DPDP Rules, 2025; IT Act, 2000 (interim, for matters not yet in force). Searce’s DPDPA compliance program is in progress; full statutory compliance obligations take effect Data Protection Board of India (DPBI) Access, correction, erasure, grievance redressal, right to nominate a representative, right to withdraw consent United Kingdom UK GDPR and Data Protection Act 2018 Information Commissioner’s Office (ICO) Access, rectification, erasure, restriction, portability, objection, rights re: automated decision-making European Economic Area (where Searce processes EEA residents’ data) EU General Data Protection Regulation (GDPR) Relevant national Supervisory Authority / lead authority Access, rectification, erasure, restriction, portability, objection, rights re: automated decision-making United States Applicable state comprehensive privacy laws (e.g., CCPA/CPRA and other state laws, where applicable) and sectoral federal laws; state breach notification statutes apply to affected residents California Privacy Protection Agency (CPPA); other state Attorneys General as applicable Right to know/access, deletion, correction, opt-out of sale/sharing and targeted advertising, non-discrimination Canada Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws Office of the Privacy Commissioner of Canada (OPC) Access, correction, withdrawal of consent, complaint to the OPC Australia Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) Office of the Australian Information Commissioner (OAIC) Access, correction, complaint to the OAIC, anonymity/pseudonymity where practicable Singapore Personal Data Protection Act 2012 (PDPA) Personal Data Protection Commission (PDPC) Access, correction, withdrawal of consent, data portability (where applicable), complaint to the PDPC Malaysia Personal Data Protection Act 2010 (PDPA) Department of Personal Data Protection (JPDP) Access, correction, withdrawal of consent, to limit processing for direct marketing Indonesia Law No. 27 of 2022 on Personal Data Protection (PDP Law) Personal Data Protection Supervisory Institution (under the Ministry of Communication and Digital Affairs) Access, correction, erasure/termination of processing, withdrawal of consent, data portability, objection to automated decisions Philippines Data Privacy Act of 2012 (Republic Act No. 10173) National Privacy Commission (NPC) Access, correction, erasure/blocking, damages, data portability, objection, complaint to the NPC United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) UAE Data Office Access, correction, erasure, restriction, objection, withdrawal of consent, data portability Saudi Arabia Personal Data Protection Law (Royal Decree No. M/19, as amended) and its Implementing Regulations. Searce Technologies Company (Riyadh) holds PDPL compliance certification — see Section 12.2. Saudi Data and Artificial Intelligence Authority (SDAIA) Access, correction, erasure/destruction, withdrawal of consent, complaint to SDAIA Jurisdiction India Primary Law Digital Personal Data Protection Act, 2023 (DPDPA) and DPDP Rules, 2025; IT Act, 2000 (interim, for matters not yet in force). Searce’s DPDPA compliance program is in progress; full statutory compliance obligations take effect Supervisory Authority Data Protection Board of India (DPBI) Key Individual Rights Access, correction, erasure, grievance redressal, right to nominate a representative, right to withdraw consent Jurisdiction United Kingdom Primary Law UK GDPR and Data Protection Act 2018 Supervisory Authority Information Commissioner’s Office (ICO) Key Individual Rights Access, rectification, erasure, restriction, portability, objection, rights re: automated decision-making Jurisdiction European Economic Area (where Searce processes EEA residents’ data) Primary Law EU General Data Protection Regulation (GDPR) Supervisory Authority Relevant national Supervisory Authority / lead authority Key Individual Rights Access, rectification, erasure, restriction, portability, objection, rights re: automated decision-making Jurisdiction United States Primary Law Applicable state comprehensive privacy laws (e.g., CCPA/CPRA and other state laws, where applicable) and sectoral federal laws; state breach notification statutes apply to affected residents Supervisory Authority California Privacy Protection Agency (CPPA); other state Attorneys General as applicable Key Individual Rights Right to know/access, deletion, correction, opt-out of sale/sharing and targeted advertising, non-discrimination Jurisdiction Canada Primary Law Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws Supervisory Authority Office of the Privacy Commissioner of Canada (OPC) Key Individual Rights Access, correction, withdrawal of consent, complaint to the OPC Jurisdiction Australia Primary Law Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) Supervisory Authority Office of the Australian Information Commissioner (OAIC) Key Individual Rights Access, correction, complaint to the OAIC, anonymity/pseudonymity where practicable Jurisdiction Singapore Primary Law Personal Data Protection Act 2012 (PDPA) Supervisory Authority Personal Data Protection Commission (PDPC) Key Individual Rights Access, correction, withdrawal of consent, data portability (where applicable), complaint to the PDPC Jurisdiction Malaysia Primary Law Personal Data Protection Act 2010 (PDPA) Supervisory Authority Department of Personal Data Protection (JPDP) Key Individual Rights Access, correction, withdrawal of consent, to limit processing for direct marketing Jurisdiction Indonesia Primary Law Law No. 27 of 2022 on Personal Data Protection (PDP Law) Supervisory Authority Personal Data Protection Supervisory Institution (under the Ministry of Communication and Digital Affairs) Key Individual Rights Access, correction, erasure/termination of processing, withdrawal of consent, data portability, objection to automated decisions Jurisdiction Philippines Primary Law Data Privacy Act of 2012 (Republic Act No. 10173) Supervisory Authority National Privacy Commission (NPC) Key Individual Rights Access, correction, erasure/blocking, damages, data portability, objection, complaint to the NPC Jurisdiction United Arab Emirates Primary Law Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) Supervisory Authority UAE Data Office Key Individual Rights Access, correction, erasure, restriction, objection, withdrawal of consent, data portability Jurisdiction Saudi Arabia Primary Law Personal Data Protection Law (Royal Decree No. M/19, as amended) and its Implementing Regulations. Searce Technologies Company (Riyadh) holds PDPL compliance certification — see Section 12.2. Supervisory Authority Saudi Data and Artificial Intelligence Authority (SDAIA) Key Individual Rights Access, correction, erasure/destruction, withdrawal of consent, complaint to SDAIA