LTI Employee Privacy Policy

Introduction

This is the LTI Employee Privacy Policy that applies to Larsen & Toubro Infotech Ltd ('LTI', 'our', 'us' or 'we').

This Privacy Policy applies to all employees of LTI and describes:

• what personal information we collect about our EU-based employees, potential employees;
• how we use and otherwise process that information;
• the basis upon which we process it;
• with whom it is shared; and
• how it is stored.

This policy also describes other important topics relating to this information and its privacy.

Please read this Privacy Policy carefully to understand how we handle your personal information.

LTI has designated a Data Protection Officer to oversee compliance with data privacy law. If you have any questions about this Privacy Policy or about how we handle your personal information, please contact Dilip Panjwani at dilip.panjwani@lntinfotech.com.

Information collection

We may collect and use any of the following information about you and we refer to this as “personal information” throughout this policy:

A. Your personal details:

• Full Name
• Residential Address
• Mobile Number
• Email Address
• Home Number
• Language Known
• Education Details, training / certification
• Details of Extra Curricular Activities

B. Your family/next of kin details:

• Emergency Contact Person Name
• Employees’ Relation with person
• Emergency Contact Number, email address, DOB
• Emergency Residence Address
• Passport details (Optional for insurance)

C. Documentation required under immigration laws:

• Residence Card & Passport Copy
• Permanent / Temporary Work Permit
• Dependent Residence Permit
• PESEL Number (For Poland Employees Only)
• Dependant National Identity Card OR Passport Copy (Optional for insurance)

D. Compensation/employment information:

• Current Fixed / Based Comp details
• Current Commission / Variable Plan
• Documents pertaining to Bonus / Retention Pay / ESOPS
• Current & Previous Employment & Employer Details
• Company Name & Address
• 1. Nature of Duty
  2. Job Duty
  3. Reason for job change
  4. Joining and exit dates
  5. Sales Target and YoY Achievement
• Reference of previous 2 reporting managers
• 1. Name
  2. Position & Organization
  3. Designation
  4. Number & Email Address
• For B2B Contracts
• 1. Company Details
  2. Tax Number
  3. Registration Number of Can

E. Payroll data:

• Bank Name, Account Holder Name and Number
• SWIFT Code and and bank account transfer authorization for direct Deposit
• Social Security Document
• Tax Number

Source of personal information

• We may receive some of this personal information from third parties, such as Recruitment Agencies, Open Source Network, Existing Database & Employee reference, and Career Sites. We may also collect this personal information from publicly available sources, such as LinkedIn, Job Boards, and Social Pages.

Special categories of data

• Some of the personal information that we collect about you or which you provide to us about you, your family and benefit beneficiaries may be special categories of data.  Special categories of data include information about your physical and mental health, sexual orientation, racial or ethnic origin, political opinions, philosophical belief, trade union membership, sexual orientation and biometric data.

Use of information

The purposes for which we are processing, or will process, your personal information are, to:

• enable us to maintain accurate and up-to-date employee, worker and contractor records and contact details (including details of whom to contact in the event of an emergency)
• run recruitment processes and assess your suitability for employment, engagement or promotion
• comply with statutory and/or regulatory requirements and obligations
• maintain an accurate record of your employment or engagement terms
• administer the contract we have entered into with you
• make decisions about pay reviews and bonuses
• ensure compliance with your statutory and contractual rights
• ensure you are paid correctly and receive the correct benefits and pension entitlements, including liaising with any external benefits or pension providers or insurers
• ensure compliance with income tax requirements, e.g. deducting income tax and insurance contributions where applicable
• operate and maintain a record of disciplinary, grievance and capability procedures and action taken
• operate and maintain a record of performance management systems
• record and assess your education, training and development activities and needs
• plan for career development and succession
• manage, plan and organise work
• enable effective workforce management
• operate and maintain a record of annual leave procedures
• operate and maintain a record of sickness absence procedures
• operate and maintain a record of maternity leave, paternity leave, adoption leave, shared parental leave, parental leave and any other type of paid or unpaid leave or time off work
• make decisions about continued employment or engagement
• operate and maintain a record of dismissal procedures
• provide references on request for current or former employees, workers or contractors
• prevent fraud
• ensure network and information security and prevent unauthorised access and modifications to systems
• ensure effective HR, personnel management and business administration, including accounting and auditing
• ensure adherence to Company rules, policies and procedures
• enable us to establish, exercise or defend possible legal claims
• administer rewards and recognition

Some of the personal information you provide to us is mandatory and/or is a statutory and/or contractual requirement, some of the personal information you may be asked to provide to us on a voluntary basis. We will inform you whether you are required to provide certain personal information to us or if you have a choice in this.

Legal bases for use of your personal information

We need to have legal bases for using your personal information for the purposes set out in this Privacy Policy. We consider that our legal bases are as follows:

• our use of your personal information is necessary for the performance of our obligations under our contract with you (for example, to pay you or to confer a benefit under the terms of an employment contract); or
• our use of your personal information is necessary for complying with our legal obligations, particularly as your employer (or prospective employer) (for example, providing your personal information to HMRC); or
• where neither (a) nor (b) apply, it is necessary for the purposes of our legitimate interests or the legitimate interests of a third party (for example, to ensure a safe working environment, to ensure the reliability of our employees or to maintain adequate personnel records).

Where we are relying on our legitimate interests or the legitimate interests of a third party, we have explained, in the relevant parts of this Privacy Policy, what those legitimate interests are.

In the limited circumstances where you have provided your consent to the processing of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. This will not, however, affect the lawfulness of processing based on your consent before its withdrawal. If you wish to withdraw your consent, please contact our DPO at the contact details stated above. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose you originally agreed to, unless we have another legal basis for processing.

Change of purpose

• We will only use your personal information for the purposes for which we collected it. If we need to use your personal information for a purpose other than that for which it was collected, we will provide you, prior to that further processing, with information about the new        purpose, we will explain the legal basis which allows us to process your personal information for the new purpose and we will provide you with any relevant further information. We may also issue a new privacy notice to you.

Disclosure of personal information

A. Disclosure to LTI teams

• Within LTI your personal information will be made available only to those teams that require your personal information, such as visa information to our Visa Processing Team, tax details to our Taxation Team or bank details to our Payroll and Benefits Team.

B. Disclosure to LTI group companies

• Your personal information will be made available to the following LTI group companies:
• Larsen & Toubro Infotech India Limited
• Other subsidiaries and branch offices based on legitimate interest
• Your personal information will be made available to the above mentioned LTI group companies for the following purposes:
• For all HR, payroll, tax, insurance & immigration related activities.

C. Disclosure to third parties

We will share your personal information with the following categories of third parties:

• other parties such as legal and regulatory authorities, accountants, auditors, lawyers and other outside professional advisors; and
• companies that provide products and services to us, such as:
• 1. payroll and benefits providers;
  2. pension providers;
  3. insurance companies, including those providing medical insurance and group income protection;
  4. human resources services, such as pre-employment checks and for employee monitoring;
  5. recruitment agencies;
  6. parties requesting an employment reference;
  7. travel agencies and transport providers;
  8. information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up and disaster recovery and cyber security services; psychometric testing providers and other outsourcing providers, such as off-site storage providers and cloud services providers.

We will also disclose your personal information to third parties:

• where it is in our legitimate interests to do so to run, grow and develop our business:
• 1. if we sell or buy any business or assets, we may disclose your personal information to the prospective seller or buyer of such business or assets;
  2. if LTI or substantially all of its assets are acquired by a third party, in which case personal information held by LTI will be one of the transferred assets;
• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;
• to enforce our contract with you, to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or
• to protect the rights, property or safety of LTI, our employees, customers, suppliers or other persons.

Restrictions on use of personal information by recipients

Any third parties with whom we share your personal information are limited (by law and by contract) in their ability to use your personal information for the specific purposes identified by us. We will always ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this Privacy Policy and applicable laws.

Save as expressly detailed above, we will never share, sell or rent any of your personal information to any third party without notifying you and/or obtaining your consent. Where you have given your consent for us to use your information in a particular way, but later change your mind, you can contact us and we will stop doing so.

Retention of personal information

LTI collects and maintains personal information on current, former and prospective employees for legitimate corporate business purposes, such as processing payroll, collecting CVs/resumes to fill vacant positions, and maintaining accurate benefits records.

We keep your personal information for no longer than necessary for the purposes for which the personal information is used or otherwise processed. The length of time we retain personal information depends on the purposes for which we collect and use it and / or as required to comply with applicable laws.

Once you have left employment or your engagement has been terminated, we will generally hold your personal information after the termination of your employment or engagement, but this is subject to: (a) any minimum statutory or other legal, tax, health and safety, reporting or accounting requirements for particular data or records, and (b) as far as this is necessary in the context of current, planned or impending legal disputes, especially in case of impending legal proceedings.

Your rights

You have the following rights with respect to your personal information:

Right of access

• You have the right to request from us information on which personal information about you we process at any time. Please send your request to the postal or email address stated above.

Right to rectification of incorrect data

• If data about you is inaccurate, you have the right to obtain from us rectification of such data without undue delay. Please send your request to the postal or email address stated above.

Right to erasure

• Under the requirements set out in Art 17 GDPR you have the right to request from us the erasure of your personal information. In particular you may ask us to erase personal information, if (i) it is no longer necessary in relation to the purposes for which it was collected or otherwise processed; (ii) the personal information has been unlawfully processed, (iii) you object to the processing pursuant to Art 21(1) GDPR and there are no overriding legitimate grounds for the processing, (iv) the personal information has to be erased for compliance with a legal obligation in Union or Member State law to which we are subject or (v) you withdraw your consent on which the processing is based and there is no other legal ground for the processing. Please send your request to the postal or email address stated above.

Right to restriction of processing

• You have the right to obtain from us restriction of processing, where one of the following applies: (i) The accuracy of the personal information is contested by you, processing will be restricted for a period enabling us to verify the accuracy of the personal information, (ii) the processing is unlawful and you oppose the erasure of the personal information and request the restriction of their use instead, (iii) we no longer need the personal information for the purposes of the processing, but are required by you to keep them for the establishment, exercise or defence of legal claims or (iv) you have objected to processing pursuant to Art 21(1) GDPR and the verification whether our legitimate interests override yours is pending. Please send your request to the postal or email address stated above.

Right to data portability

• According to Art 20 GDPR you have the right to receive the personal information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. Please send your request to the postal or email address stated above.

Right to object

• Pursuant to Art 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal information concerning you which is based on point e) or
  f) of Art 6 para. 1 GDPR. We will no longer process your personal information unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the purpose of establishing, exercising or defending legal claims.

We will consider all such requests and provide our response within a reasonable period (and in any event any time period required by law). Please note, however, that certain personal information may be exempt from such requests in certain circumstances.

If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.

If you have any questions or concerns about our use of your personal information, please contact our DPO.

Transfers of information

The personal information may be processed by staff operating outside the EEA working for us, other members of our group or third party data processors for the purposes mentioned in section 2 above. Further details on to whom your personal information may be disclosed are set out in section 4 above.

If we provide any personal information about you to any such non-EEA members of our group or third party data processors, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy. These measures include entering into European Commission approved standard contractual arrangements with them.

Further details on the steps we take to protect your personal information in these cases is available from us on request by contacting your local HR representative at any time.

Security

LTI has put in place measures to protect the security of your personal information. It has internal policies, procedures and controls in place to try and prevent your personal information from being accidentally lost or destroyed, altered, disclosed or used or accessed in an unauthorised way. In addition, we limit access to your personal information to those employees, workers, agents, contractors and other third parties who have a business need to know in order to perform their job duties and responsibilities. You can obtain further information about these measures from our DPO at the contact details stated above.

Where your personal information is shared with third-party service providers, we require all third parties to take appropriate technical and organisational security measures to protect your personal information and to treat it subject to a duty of confidentiality and in accordance with data protection law. We only allow them to process your personal information for specified purposes and in accordance with our written instructions. also has in place procedures to deal with a suspected data security breach and we will notify the applicable supervisory authority or regulator and you of a suspected breach where we are legally required to do so.

Third party websites

You may, from time to time, during your employment, access links to or other websites operated by third parties (e.g. training providers, industry news sources and bulletins). Please note that this Privacy Policy only applies to the personal information that we (or third parties on our behalf or our group companies) collect from or about you and we cannot be responsible for personal information collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third party websites or third party terms and conditions or policies.

Automated decision making

Automated decision making occurs when an electronic system uses your personal information to make a decision without human intervention. We do not envisage that any employment decisions will be taken about you based solely on automated decision making, including profiling. However, we will notify you in writing if this position changes.

Changes to our Privacy Policy

This Privacy Policy does not form part of any employee’s contract of employment and we may amend it from time to time. Any changes we make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our Privacy Policy.

Further questions or making a complaint

• If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact our DPO. We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal information.
• You may also make a complaint to your local data protection authority in the EU country where we are based. If you are unsure which data protection authority to contact, please contact our DPO who will advise you.

The practices described in this Privacy Policy are current personal information protection policies, as of 23 May, 2018