Privacy policy
1. Introduction
Objectives
This policy outlines principles and statements on how pulse by solutions collects, processes, and uses personal data in compliance with applicable requirements around data privacy. Supplemental policies, practices and Governance documents shall be developed, as needed, to meet the regulatory data protection requirements which may provide for more strict or specific privacy and protection standards than those that are set forth in this policy.
Scope & Applicability
This policy is applicable to all entities in pulse by solutions group, having accountability and/or responsibility for processing personal data within pulse by solutions including all users of personal data regardless of their geographic location.
2. Document abbreviations & Definitions
– Consent: Freely given, specific, informed, and explicit consent by statement or action signifying agreement to the processing of their personal data.
– Data Controller: The entity that determines the purposes, conditions, and means of the processing of personal data.
– Data Subject: A natural living person whose personal data is processed by a controller or processor.
– Data Subject Rights: Rights through which data subjects can make a specific request to Controller regarding processing of their Personal Data.
– Data Processor: The entity that processes data on behalf of the Data Controller.
– Data Privacy Officer (DPO): An independent data privacy expert who is responsible for monitoring and enforcement of organization’s data privacy program.
– Chief Data Officer: A senior executive responsible for overseeing an organization’s data governance, privacy compliance, and data management strategy, ensuring that data is handled securely, ethically, and in accordance with applicable laws and regulations.
– Departments: A sub-unit within a Business Unit in pulse by solutions (e.g., Digital Solutions is a department under DX- Digital Transformation).
– Joint Controller: Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers.
– Processing: Any operation performed on personal data, whether or not by automated means, including access, collection, use, recording, disposition, etc.
– Personal Data (PII): Any information regardless of its source or form that would lead to identifying the individual directly or indirectly, including names, ID numbers, addresses, contact numbers, licenses, registration numbers, bank account numbers, credit card numbers, photos, videos, and any other data of personal nature.
– Sensitive Personal Data: Information that if lost, compromised, or disclosed could potentially harm, cause inconvenience, embarrassment, or unfairness to an individual, with high potential risk to their rights and freedoms (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs). Categorized as:
1- Hereditary Genetic Data: Genetic or biometric data processed solely to identify a human being.
2- Medical Data: Health-related data.
3- Medical Services: Data revealing medicines being used along with other health services provided to the subject.
– Third Party: Any external organization or person authorized to process data on behalf of or jointly with the data controller.
– Business/Functional Units: Any Business/Functional Units within pulse by solutions that own a personal data processing activity.
– GRC SPoC: The representative of the system/application who drives day-to-day data related activities from a Data Management perspective.
– Cybersecurity (CS): Preservation of confidentiality, integrity, and availability of information.
– Governance, Risk & Compliance Partners (GRCP): Periodic executive meetings to discuss GRC-related practices, chaired by the CEO or delegate, with the CGO as a permanent member, monitored by the GM of GRC & CS.
– Employee: The personnel who are employed on a full-time basis and is in the payroll of pulse by solutions.
– Executive Management: Refers to the CEO and Chief Officers of pulse by solutions.
– GRC Head: A senior leader that serves as a bridge between legal, IT, and business units to embed privacy practices across the organization.
– Data Collection: The Data Controller obtains personal data in accordance with system provisions, whether from the owner directly, their representative, legal guardian, or another party.
– Data Disposal: Any action which leads to the removal of personal data and makes it impossible to view or restore it again.
– Data Disclosure: Enabling any person — except the data controller — to obtain, use, or access personal data by any means and for any purpose.
– Data Transfer: Transferring personal data from one place to another for processing.
3. Data Privacy Principles
3.1 Lawfulness, Fairness, and Transparency
Personal Data shall be processed lawfully, fairly, and in a transparent manner.
3.2 Data Minimization
3.3 Purpose Limitation
3.4 Accuracy
Personal Data shall be accurate, complete, and current as appropriate for the purposes for which they are collected and/or processed.
3.5 Storage Limitation
3.6 Integrity and Confidentiality
3.7 Compliance with Regulatory Requirements
4. Data Privacy Policy Statements
4.1 Data Privacy Governance, Risk and Compliance
Data Privacy Officer (DPO) shall be appointed and shall be responsible for governance, risk, and compliance of privacy related activities and shall be independent of conflicting duties.
DPO shall be equipped with the resources, support and training required to perform his/ her role.
DPO shall make his information (name and contact details) accessible and communicated to all relevant stakeholders.
DPO shall develop and maintain the data privacy strategy that defines the vision, mission, goals, objectives tailored to the organization’s context and helps meet the needs and expectations of internal and external stakeholders.
DPO shall develop an actionable roadmap to operationalize the strategy, ensure compliance, enable business objectives, meet stakeholder needs and enhance program maturity.
DPO shall develop and establish the data privacy governance and operating model to further detail the data privacy roles and responsibilities; formally allocated and accepted across pulse by solutions.
DPO shall establish a data privacy risk management framework that is integrated into the enterprise risk management program, to proactively identify and manage data privacy risks within pulse by solutions.
DPO shall establish a data privacy compliance program to periodically review and monitor pulse by solutions compliance with this policy and applicable legal and regulatory requirements for collecting, processing, or maintaining personal data.
GRC SPOC shall support the DPO in carrying out periodic risk and compliance assessments aligned with the established framework and shall be responsible for monitoring the remediation activities.
DPO shall establish data privacy training and awareness program to ensure all Users shall receive proportionate awareness to their expected role in the data privacy program.
DPO shall periodically develop, review, and maintain procedures and guidelines aligned to this policy to govern, manage, and operate the data privacy program.
4.2 Personal Data Collection
BU/FU Heads of pulse by solutions shall ensure that any personal data collected is adequate, relevant, and limited to what is necessary in relation to the purposes for which they are collected.
If personal data is collected directly from the Data Subject, pulse by solutions shall:
1- Provide a concise, transparent, intelligible, easily accessible, and adequate notice to the Data Subject (employee/ customer/ vendor/ candidates) in physical or electronic format. The notice shall be written in clear and plain language.
2- Notify the Data Subject if there is a change in the purpose of data collection.
3- These disclosures shall be made as soon as possible, and preferably at the first point of contact with the Data Subject.
4- Provide the Data Subject with the right to access personal data which include viewing and copying without any charge.
5- Provide the Data Subject with the right to modify and update the personal data.
4.3 Choice and Consent
Respective departments responsible for collection and processing of personal data shall obtain and record consent from Data Subjects according to the established consent management practices.
Respective departments shall communicate any choices available when personal data is collected or used by a third party or disclosed by pulse by solutions to such parties.
As part of Consent Management, pulse by solutions shall ensure the following:
1- Consent shall adhere to the principle of freely given, specific, informed, and unambiguous indication of data subject, which means the data subject has a genuine ongoing choice and control over how pulse by solutions shall use their data.
2- Request the consent of the data subject using the type of consent (opt-out or opt-in) that is required or appropriate.
3- Ensure that the choices provided to data subject are complete and clear (e.g., how to “opt-out”).
4- Inform data subjects of the consequences for failing to consent or to provide their data.
5- Obtain new consent if personal data will be used for a purpose other than originally disclosed to the data subject.
6- Data Subjects can withdraw consent at any time, as per section 5.9 Data Subject Rights.
4.4 Use, Retention and Disposal
Company data retention guidelines are mentioned in the Data Protection, Classification and Retention Standard.
BU/FU Heads shall ensure processing of personal data is conducted with due regard to the privacy, dignity, and equality of Data Subjects.
Respective departments shall not process personal data in the absence of one of the following valid business and legal basis:
1- Data Subject has provided valid consent for the processing of their personal data.
2- Processing is necessary to fulfil pulse by solutions contractual obligations towards the Data Subject or an organization
3- Processing is necessary to fulfil pulse by solutions legal obligations towards a government or regulatory authority.
4- Processing is necessary to protect vital interests of the data subjects or of another person, in the public interest, or in the exercise of official authority vested in the controller.
5- Processing is necessary to protect the legitimate interests of pulse by solutions. In such cases, care shall be taken to not pose high risk to data subjects, and to protect the interests and rights of data subjects.
Respective departments shall not process sensitive personal data in the absence of the following valid business and legal basis:
1- Such processing is specifically authorized or required by law.
2- The Data Subject has provided explicit consent to such processing.
3- Where the Data Subject is physically or legally incapable of giving consent, but the processing is necessary by law, for example but not limited to: protecting the vital interest of the Data Subject, Support lawsuits/ litigations, and Employment. This exemption may apply, for example, where emergency medical care is needed.
4- Processing is necessary for reasons of public interest in public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care.
5- Processing is necessary for the establishment, exercise, or defense of legal claims.
6- Processing relates to personal data which are manifestly made public by the Data Subject.
As a Data Controller, respective departments shall only use the personal data for the purposes the data subject has been made aware of in the privacy notice provided to them.
DP SPOCs shall conduct periodic reviews to verify and ensure that divisions and departments that collect/ process personal data appropriately are in compliance with privacy notices, contracts, and this policy.
Employees or Users of Personal Data at all levels shall apply the following while processing personal data:
1- Collection and use of personal data shall be avoided or limited when reasonably possible.
2- The purpose(s) of the collecting or processing of personal data shall be expressly identified by the division or department preparing any new or expanded data collection and processing activity or function.
DP SPOCs and GRC SPOCs shall ensure to implement reasonable processes to monitor the quality of the personal data it stores/processes as per the pulse by solutions’ Enterprise Data Management policy.
BU/FU Heads shall define the retention schedule of all personal data stored and processed by their respective departments. Data retention must be identified as per pulse by solutions’ Data Protection, Classification and Retention standard.
Personal Data shall not be retained longer than required for the purpose it was collected for aligned to legitimate business requirements, and applicable laws and regulatory requirements. However, personal data can be kept for a longer period in case of availability of statutory justification or if personal data is connected directly to an open case judicial body.
Personal Data shall be erased if their storage violates any of the data privacy principles or if knowledge of the data is no longer required by pulse by solutions or for the benefit of the Data Subject.
Personal Data shall be blocked and restricted, rather than erased, insofar as the law/regulation prohibits erasure, erasure would impair legitimate interests of the Data Subject, erasure is not possible without disproportionate effort due to the specific type of storage, or if the Data Subject disputes that the data is incorrect, and it cannot be ascertained whether they are correct or incorrect.
Disposal of personal data shall be handled with utmost care and shall be governed by the Enterprise Data Management policy.
Respective departments shall process Employee data to fulfil hiring laws and regulations and fulfil the terms of their employment contract.
4.5 Privacy by Design (PbD)
DPO under supervision of the Data Management Officer shall establish a process to proactively embed privacy requirements into the system architecture and product/ service/ software development lifecycle.
Considerations shall be made for technical and organizational measures to enhance privacy (e.g. data obfuscation/anonymization, data minimization etc.). In addition, appropriate technical and organizational measures shall be considered to ensure that personal data collected or processed is adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
Privacy Impact Assessments (PIAs) shall be carried out on processing activities that are likely to result in a high risk to data subject’s privacy, rights, and interests.
Procedures shall be developed to elaborate the criteria, triggers, checklists, and methodology for conducting PIAs.
PIAs shall be performed for any new launch or major changes made to major products/ services/ technology, which require the processing of personal data.
4.6 Personal Data Transfers
4.7 Disclosure to Third Parties
Data Privacy Officer shall establish a Vendor Management process to manage data privacy risks associated with use of third-party vendors which include:
1- Conducting appropriate data privacy due-diligence prior to on-boarding new third- party vendors.
2- Including data privacy responsibilities and obligations as part of contracts signed with third-party vendors including clear instructions around how personal data shall be handled.
3- Based on relevant laws and regulations periodic privacy compliance reviews of third- party vendors.
Respective departments shall clearly notify Data Subjects regarding the category of third parties along with purposes for personal data disclosure.
Personal data shall be shared to third party vendors only for reasons consistent with the purposes for which the data was originally collected or other purposes authorized by law, followed by a data processing agreement (DPA).
4.8 Security of Personal Data
GRC is responsible for developing and maintaining CS policies/ standards/ frameworks aligned to applicable regulatory requirements and leading practices.
GRC assesses the data protection and handling measures in accordance to Information Classification and Handling Cybersecurity Standard implemented to safeguard personal data on a regular basis and update the same, where required.
GRC SPOCs should support Risk & Compliance to identify key data security requirements aligned to applicable data privacy laws/ regulations to ensure adequate protection of personal data processed within pulse by solutions.
GRC SPOCs and DPO should work with respective departments to implement adequate technical and organizational safeguards, in line with this policy, CS policies/standards/frameworks and operating models published by GRC.
Employees and contractors adhere to pulse by solutions’ internal CS policies, practices and any additional guidance issued around personal data protection by GRC.
Confidentiality agreements & NDAs covering data protection and privacy responsibilities should be signed by all employees & contractors on or before their joining date.
Employees, contractors, and third-party vendors involved in any stage of processing personal data should explicitly be made subject to a requirement of secrecy which shall continue after the end of the employment/business relationship.
Employees, contractors, and third-party vendors shall have access to the personal data necessary for the fulfilment of their employment/ contractual duties.
GRC assesses the security measures implemented to safeguard the overall organization on a regular basis and updates the same, where required. This assessment is applicable to safeguard measures that directly/indirectly affect personal data.
4.9 Data Subject Rights
Data subjects shall have the right to:
1- Request access to copies of their personal data.
2- Request information on the processing activities carried out with their personal data. 3- Request that their personal data is rectified if it is inaccurate or incomplete.
4- Request erasure of their personal data in certain circumstances, except if the data is maintained for regulatory reasons.
5- Request that the processing of their personal data is restricted in certain circumstances.
6- Object to processing their personal data in certain circumstances.
7- Object to, and not to be subject to a decision based solely on, automated processing (including profiling), which produces legal effects or significant effects on the data subject.
8- The Data Subject may withdraw their consent to the processing of their personal data at any time by contacting pulse by solutions via Data Management Office. Upon withdrawal, pulse by solutions shall cease processing without undue delay, without prejudice to the lawfulness of any processing carried out prior to such withdrawal.
GRC SPOC under the supervision of the DPO shall review and ensure all requests raised by data subjects are addressed on a timely manner and in compliance with the applicable laws & regulations. The request is raised and reviewed on MS Purview workflow.
DPO shall advocate the feasibility of fulfilling such requests and provide a reasonable justification in writing (physically or electronically) in case of denial of such requests.
GRC SPOC shall maintain records of such requests irrespective of their fulfilling status.
As a Joint Controller, BU/FU Heads of pulse by solutions shall inform its business partners regarding such requests if it pertain to personal data and processing activities that are cover under such arrangements.
Data Subject Request procedures shall be maintained around handling data subject request.
4.10 Data Processor Obligations
Data Privacy Officer shall Identify the data processing activities for which pulse by solutions is a processor.
Data Privacy Officer shall identify the responsibilities as a data processor and shall develop requirements and guidelines on data processor obligations.
DPO shall ensure that the organization is adhering to its obligations towards the Data Controller by lawfully processing the personal data.
GRC SPOC shall support the Technology BUs in reviewing Data Processing Agreements (DPA) shared by customers and addressing privacy queries raised by customers.
Legal Affairs shall review data privacy obligations before finalizing the contract.
DPO shall work with GRC SPOCs to review potential privacy incidents/ breaches that may impact customer data.
Legal Affairs shall support DPO and Technology BUs to report potential privacy incidents/ breaches to customers.
GRC SPOC shall develop and implement procedures and processes to support Data Controllers (customers) and fulfil Data Processor obligations.
4.11 Data Privacy and Breach Management
Data Privacy Officer shall formulate and implement a data privacy incident and breach management process to ensure that exceptions in data privacy compliance are promptly identified and reported to the GRC SPOC. An incident response team will be formulated upon each incident depending on its type.
All the employees shall be aware of the mechanism of raising data privacy incidents.
The GRC SPOC shall work closely with the DTR section to investigate potential data privacy breach incidents resulting from Cybersecurity incidents and track it to closure.
The GRC SPOC shall maintain an inventory of privacy incidents and shall record the lessons learnt.
As a Joint Controller, BU/FU Heads of pulse by solutions shall promptly notify its business partners of any data privacy incidents.
Documented procedures shall be maintained to identify, track, review and notify data breaches to relevant regulatory authorities and data subjects.
In case of a Cybersecurity incident which resulted in a privacy incident Cybersecurity Incident Management Framework and Data Privacy Breach Management Procedure should be triggered.
5. Policy Monitoring
6. Policy Exceptions
Any exception to this Policy shall be formally documented, justified, risk-assessed, and approved prior to implementation.
Exceptions shall only be permitted for legitimate business, legal, regulatory, contractual, or operational requirements.
Exception requests shall include:
1- The policy requirement subject to exception. 2- Business justification.
3- Risk assessment and compensating controls. 4- Exception owner and validity period.
All exceptions shall be reviewed by the Data Privacy Officer (DPO), with involvement from Legal Affairs and GRC where applicable.
Approved exceptions shall be recorded, periodically reviewed, and revoked upon expiration or when no longer justified.
No exception shall permit unlawful processing of personal data or violation of applicable privacy laws and regulations.
7. Conclusion
pulse by solutions is committed to safeguarding personal data and upholding the highest standards of privacy and security. This policy establishes a comprehensive framework to ensure compliance with applicable laws, regulations, and internal governance requirements. All employees, contractors, and third-party partners are expected to adhere to these principles and practices to maintain trust and protect the rights of data subjects. By following this policy, pulse by solutions reinforces its dedication to responsible data management and the protection of individual privacy.
Annex A: RACI Matrix
| Data privacy activity | DPO | BU/FU Heads | GRC / GRC SPOCs | Legal Affairs | Employees / Users |
|---|---|---|---|---|---|
|
Develop data privacy strategy |
A/R |
I |
C |
C |
I |
|
Establish privacy governance framework |
A/R |
C |
C |
C |
I |
|
Conduct privacy risk & compliance assessments |
A |
C |
C |
I |
I |
|
Deliver privacy awareness & training program |
A |
I |
C |
I |
I |
|
Ensure lawful personal data collection |
I |
A/R |
I |
I |
R |
|
Manage consent collection & records |
I |
A/R |
I |
I |
R |
|
Define data retention requirements |
I |
A/R |
I |
C |
I |
|
Implement privacy by design (PbD) |
A |
C |
C |
I |
I |
|
Conduct privacy impact assessments (PIAs) |
A |
C |
C |
I |
I |
|
Vendor privacy due diligence |
A/R |
C |
C |
C |
I |
|
Handle data subject requests |
A |
C |
I |
I |
I |
|
Manage privacy incidents & breaches |
A/R |
C |
C |
C |
I |
|
Review policy exceptions |
A |
R |
C |
C |
I |
|
Review & update privacy policy |
A/R |
I |
C |
C |
I |