ApriCOT Digital Personal Data Protection Policy

PeopleWiz Consulting LLP, operator of ApriCOT (“ApriCOT”, “PeopleWiz”, “we”, “us” or “our”), is committed to handling digital personal data responsibly, transparently and securely.

This Policy explains the principles we follow to protect personal data processed in connection with the ApriCOT website, platform, assessments, development services, coaching services and related business activities.

Our approach is designed to align with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), applicable amendments, orders and other Indian legal requirements as they come into force.

We also draw upon recognised international data-protection principles, including those reflected in the GDPR, UK GDPR and Singapore PDPA, where relevant to our activities.

This Policy should be read together with the applicable ApriCOT Website Privacy Policy, Platform & Assessment Privacy Notice, contractual terms and any specific consent or privacy notice presented to an individual.

We seek to follow the following principles when processing personal data:

Lawful and transparent processing

We process personal data only for lawful and appropriate purposes and seek to explain clearly:

• what information is collected;
• why it is collected;
• how it will be used;
• who may receive it; and
• how individuals may exercise applicable rights.

Purpose limitation

Personal data should be used for the purpose for which it was collected or for another compatible or legally permitted purpose.

We do not intend to use personal data for unrelated purposes without appropriate notice and, where required, consent.

Data minimisation

We seek to collect only the personal data reasonably necessary for the relevant purpose.

Accuracy

Where personal data may be used to make decisions affecting an individual or shared with another organisation, we seek to maintain reasonable processes intended to support its completeness, accuracy and consistency.

Retention limitation

Personal data should not be kept indefinitely where there is no continuing lawful, contractual, security or business need for it.

Security

We seek to apply reasonable technical and organisational safeguards appropriate to the nature and risks of the processing.

Accountability

Responsibility for data protection remains with the relevant organisation determining the purpose and means of processing, subject to applicable law and contractual arrangements.

These principles are also consistent with internationally recognised privacy frameworks emphasising fairness, transparency, minimisation, security and accountability.

Under the DPDP Act, the legal role of PeopleWiz may vary according to the processing activity.

Where PeopleWiz determines the purpose and means

PeopleWiz may act as a Data Fiduciary, for example in relation to:

• Website enquiries;
• business communications;
• customer relationship management;
• legal and compliance activities; and
• other processing determined by PeopleWiz.

Where a customer determines the purpose

Where an employer or customer organisation decides:

• why an ApriCOT assessment is conducted;
• who participates;
• how the results are used; and
• who receives those results,

that organisation may act as the relevant Data Fiduciary, while ApriCOT may process personal data on its behalf as a Data Processor.

The precise allocation of responsibilities may be further governed by the customer contract or Data Processing Agreement.

Where the DPDP Act requires consent, we seek to obtain consent that is:

• informed;
• specific;
• clear;
• related to a defined purpose; and
• expressed through an appropriate affirmative action.

Consent for one purpose will not automatically be treated as consent for a materially different purpose.

Where processing is permitted under another lawful ground recognised by applicable law, we may rely upon that ground instead of consent.

Individuals should be able to withdraw consent where applicable. Withdrawal does not affect processing lawfully undertaken before withdrawal.

Our notices are intended to be clear and understandable rather than relying on broad or bundled consent.

Depending upon the Service used, ApriCOT may process categories of information such as:

• name and business contact details;
• job title, organisation, function and role;
• account and authentication information;
• Website and technical usage information;
• assessment responses;
• written or spoken interactions;
• transcripts;
• competency-related scores and outputs;
• development plans;
• coaching interactions; and
• support or business communications.

More detailed disclosures are provided in the applicable ApriCOT Privacy Policy or Platform & Assessment Privacy Notice.

We do not intend to collect personal data that is unnecessary for the relevant purpose.

Personal data may be used only for appropriate purposes such as:

• delivering ApriCOT services;
• conducting assessments;
• generating reports and development insights;
• providing coaching;
• responding to enquiries;
• maintaining security;
• supporting customers;
• improving service reliability;
• complying with applicable legal requirements.

Personal data may be shared with:

• authorised customer representatives;
• approved technology or service providers;
• professional advisers;
• regulators or authorities where legally required.

We do not sell personal data.

Where a service provider processes personal data on our behalf, we seek to use appropriate contractual and confidentiality safeguards.

We recognise that assessment and development information may be sensitive in a professional context.

We therefore seek to maintain reasonable safeguards appropriate to the processing risk.

The DPDP Rules contemplate safeguards including measures such as access controls, encryption or other protection techniques, monitoring, logging, backups, incident-response arrangements and appropriate processor contracts.

ApriCOT will represent specific security controls publicly only where they are actually implemented and verified.

No digital system can be guaranteed to be completely secure. Accordingly, while reasonable safeguards are applied, absolute security cannot be guaranteed.

If a personal-data breach occurs, we will:

• investigate the incident;
• take reasonable steps to contain and mitigate it;
• assess its impact;
• document appropriate findings and remedial actions; and
• notify affected individuals and relevant authorities where required by applicable law.

As DPDP breach-notification provisions become applicable, we will follow the notification requirements and timelines prescribed under the Rules.

Personal data will ordinarily be retained only for as long as reasonably required for:

• the purpose for which it was collected;
• the applicable customer relationship;
• contractual obligations;
• audit or security requirements;
• legal or regulatory obligations;
• dispute resolution.

Where personal data is no longer required and there is no lawful basis for continued retention, we will take appropriate steps to delete or anonymise it.

Retention periods may differ according to the type of information and the applicable customer arrangement.

Where applicable under the DPDP Act and other applicable law, individuals may have rights to:

• obtain information about personal data being processed;
• correct inaccurate or misleading data;
• update personal data;
• complete incomplete data;
• request erasure;
• withdraw consent;
• seek grievance redressal; and
• nominate another individual to exercise applicable rights in circumstances permitted by law.

We may verify the identity and authority of a person making a rights request before acting upon it.

Where ApriCOT processes personal data on behalf of a customer organisation, we may refer or assist with the request through that organisation.

ApriCOT's standard leadership assessment and development services are intended for adults.

We do not knowingly seek to process children's personal data through our standard Services.

Where processing involving a child or a person with a lawful guardian is undertaken, the applicable requirements concerning verifiable consent and lawful guardianship will be followed where required by law.

India's 2026 Removal of Difficulties Order clarified the wording of section 9 regarding personal data of a child or of a person with disability who has a lawful guardian.

ApriCOT may use technology providers or infrastructure operating in different jurisdictions.

Where personal data is processed outside India or transferred internationally, we will seek to comply with applicable Indian restrictions and any other legally applicable transfer requirements.

Where GDPR, UK GDPR, Singapore PDPA or other foreign privacy law applies to a particular processing activity, additional rights or safeguards may apply.

We do not claim universal compliance with every international privacy law merely because ApriCOT may be accessible from that jurisdiction.

Where reasonably practicable, we seek to consider privacy when designing or materially changing ApriCOT features, including:

• data minimisation;
• access restrictions;
• appropriate retention;
• security;
• transparency;
• third-party processing;
• potential impact on participants.

This approach reflects internationally recognised privacy-by-design and accountability practices.

PeopleWiz seeks to maintain appropriate governance for personal-data processing, including:

• clear internal responsibility;
• contractual safeguards with relevant processors;
• incident-management processes;
• periodic review of privacy practices;
• responding to rights requests and grievances;
• updating policies as laws or technology change.

If PeopleWiz is designated a Significant Data Fiduciary under the DPDP Act in the future, it will implement applicable additional obligations, including those relating to data protection governance, audits and other statutory requirements.

We do not presently represent that PeopleWiz is a Significant Data Fiduciary unless formally notified as such.

Questions, privacy requests or complaints may be directed to:

Privacy & Grievance Contact

Shyne Devasia Kochuveed

Organisation

PeopleWiz Consulting LLP

Email

info@apri-cot.in

We will seek to address requests and grievances within the period required by applicable law.

Where available under the DPDP framework, individuals may also pursue applicable remedies before the Data Protection Board of India after following the relevant grievance process.

We may update this Policy to reflect changes in:

• the DPDP Act or Rules;
• Government notifications or orders;
• ApriCOT technology or services;
• data-processing arrangements;
• recognised privacy standards.

The latest version will be published with an updated “Last Updated” date.

Where a material change requires additional notice or consent, we will provide such notice or obtain consent as required by law.