Last Updated: July 2023
Welcome to Tata Chemicals Magadi Limited's Data Protection & Privacy Policy. This Policy outlines how TCML handles and processes your personal data in compliance with applicable data protection laws and regulations in Kenya and other relevant jurisdictions where we operate.

1. Purpose

This Policy ensures the protection of your privacy and the responsible handling of your personal data.

2. Scope

This Policy applies to all personal data processed by TCML, regardless of the form of processing or media. It covers all stakeholders and individuals engaging with our company.

3. Definitions

Please familiarize yourself with the key terms used in this Policy:

• Act: Data Protection Act, 2019.
• Regulations: Data Protection (General) Regulations 2021 or any other data protection regulations in the jurisdictions where we operate.
• Data Subject: Individuals whose personal data we process.
• Personal Data: Information that identifies or relates to a specific individual.
• DPO: Data Protection Officer.
• GDPR: European Union's General Data Protection Regulation.

4. Responsibilities

• Our Board of Directors oversees legal and compliance risks related to data protection.
• Our Managing Director ensures policy implementation and stakeholder compliance.
• Our Data Protection Officer (DPO) oversees data processing and compliance.
• All employees are responsible for adhering to this Policy.

5. Principles of Personal Data Protection

• Right to Privacy: We respect your right to privacy and ensure access to your personal data as detailed in our Privacy Notice.
• Lawfulness, Fairness & Transparency: We process personal data lawfully and transparently.
• Purpose Limitation: We collect and use personal data for explicit, specified, and legitimate purposes only.
• Data Minimization: We only process relevant and necessary personal data.
• Accuracy: We ensure personal data is accurate and up-to-date.
• Storage Limitation: We retain personal data for the necessary period or as required by law.
• Transfer Limitation: We do not transfer personal data outside Kenya without proper safeguards.
• Accountability: We demonstrate compliance with data protection principles.

6. Data Collection & Procedures

• We collect personal data fairly, lawfully, and transparently for specific purposes.
• We rely on consent or other legal bases for processing personal data.
• Privacy Notices provide detailed information when collecting personal data.
• We process special categories of personal data with explicit consent or legal basis.
• We respect your choices, including withdrawal of consent.

7. Reporting a Personal Data Breach

• We have procedures to address and report personal data breaches promptly.
• If a breach occurs, we notify the Data Protection Commissioner and affected individuals within 72 hours.

8. Your Rights & Requests

• You have rights concerning your personal data, as detailed in our Privacy Notice.
• If you wish to exercise your rights, contact our Data Protection Officer.

9. External Data Privacy Statement(s)

• We provide external Data Privacy Statement(s) to inform third parties how we process their personal data.

10. Deletion of Personal Information

• We retain personal data as required by law or for specific purposes.
• When no longer needed, we securely delete or anonymize personal data.

11. Protection & Security

• We employ technical and organizational measures to safeguard your personal data.
• Our service providers and agents are bound by confidentiality obligations.

12. Compliance with GDPR

• We recognize the importance of data protection and comply with GDPR principles.

13. Grievance Officer & Redressal Process

• For any complaints or issues related to your personal data, contact our Data Protection Officer.

14. Limitation of Liability

• We are not liable for any breach of security caused by a Force Majeure Event.

15. The Use of Website Cookies

• Our website(s) use "cookies" to store non-personal information on your computer, including your IP address, visit date and time, pages browsed, and successful page deliveries. These cookies help us recognize you on future visits, store your preferences, enable sign-in, provide interest-based advertising, combat fraud, and analyse product performance. The data may be used in aggregate form to create customized services based on your interests and needs. You can choose to be prompted before accepting cookies or block them entirely, but this may limit access to certain website features.

16. Contact Us

• Please contact our Data Protection Officer if you (i) have any questions or concerns about how TCML processes your personal data or (ii) want to exercise any of your rights in relation to your personal data, email: dpo.tcml@tatachemicals.com

17. Amendments to this Policy

• TCML reserves the right to amend or modify this privacy statement from time to time and your continued use of our products and services constitutes your agreement to be bound by the terms of any such amendment or variation. You can access the most current version of the privacy statement from https://www.tatachemicals.com/operations/magadi and Any amendment or modification to this statement will take effect from the date of notification on the TCML website.