Digital Personal Data Protection Policy

Effective Date: 26.10.2026
Last Updated: 26.10.2026

1. Introduction

Nitin Lifesciences Limited, including its parent company, subsidiaries, affiliates, group companies and entities under common ownership or control, as applicable (collectively referred to as the “Company”, “NITIN”, “we”, “us” or “our”) recognises the importance of protecting personal data and respecting the privacy of individuals who interact with the Company through its website, business communications, recruitment processes, customer enquiries and other business activities.

This Digital Personal Data Protection Policy (“Policy”) sets out the principles and framework adopted by the Company for handling digital personal data in accordance with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), to the extent applicable and in force from time to time.

This Policy is intended to supplement the Company’s Privacy Policy and should be read together with it. The Privacy Policy provides website users with more specific information about the collection and use of their personal data.

2. Scope and Applicability

This Policy applies, to the extent relevant, to the Company’s processing of digital personal data relating to:

a. visitors and users of the Company’s website;

b. individuals submitting contact forms, business enquiries or contract-manufacturing proposals;

c. customers, distributors, suppliers, vendors and business representatives acting as individuals;

d. job applicants and other individuals interacting with the Company’s recruitment process; and

e. other individuals whose digital personal data is processed by the Company in connection with its lawful business activities.

This Policy applies subject to the scope, exclusions and commencement provisions of applicable law. It does not override any separate contractual arrangement or statutory obligation applicable to the Company.

3. Meaning of Personal Data and Processing

For the purposes of this Policy, “personal data” means data about an individual who is identifiable by or in relation to such data, as defined under applicable law.

“Processing” includes operations performed on digital personal data, such as collection, recording, organisation, storage, use, sharing, disclosure, alteration or erasure.

The Company seeks to process personal data only for specified, lawful and legitimate purposes connected with its business operations and legal obligations.

4. Categories of Personal Data

Depending on the nature of the interaction, the Company may process the following categories of personal data:

a. Identification and contact information: Name, email address, telephone number, postal address and professional contact details.

b. Business information: Organisation name, designation, business correspondence, enquiry details and information required to evaluate a commercial proposal.

c. Recruitment information: Details voluntarily provided by applicants, including qualifications, employment history, contact information and CVs or resumes.

d. Website and technical information: IP address, browser information, device details, access logs, cookies and similar technical data, where collected through the website.

e. Communication records: Emails, enquiry submissions, requests, feedback and other communications with the Company.

The Company does not intend to collect personal data that is unnecessary for the relevant purpose. Individuals should avoid submitting sensitive, confidential or unrelated personal information unless it is specifically requested and appropriate to do so.

5. Purposes of Processing

The Company may process personal data, as applicable, for the following purposes:

a. responding to enquiries and requests;

b. evaluating business proposals, customer requirements and contract-manufacturing opportunities;

c. communicating with customers, suppliers, distributors and business partners;

d. receiving and evaluating job applications;

e. maintaining website functionality, security and performance;

f. preventing fraud, unauthorised access, misuse and other unlawful activities;

g. maintaining business records and correspondence;

h. complying with applicable legal, regulatory, judicial and governmental requirements; and

i. establishing, exercising or defending legal claims and protecting the Company’s legitimate business interests, where permitted by applicable law.

Personal data shall not be used for a purpose that is incompatible with applicable law or the information provided to the individual, except where otherwise permitted by law.

6. Notice, Consent and Lawful Processing

Where required under applicable law, the Company shall provide individuals with appropriate information regarding the personal data to be processed, the purpose of processing and the means available to exercise applicable rights.

Where consent is the applicable legal basis, the Company shall seek consent in the manner required by law. Such consent shall be obtained through an appropriate affirmative action and shall relate to the specified purpose.

Where applicable, individuals may withdraw their consent through the prescribed or communicated mechanism. Withdrawal of consent shall not affect the lawfulness of processing undertaken before the withdrawal, and the Company may retain or process data where continued processing is permitted or required by law.

The Company may process personal data without consent where a specific statutory provision or legally recognised permitted use applies.

7. Data Sharing and Disclosure

The Company may share personal data, where necessary and legally permitted, with:

a. its employees and authorised personnel who require the information for legitimate business purposes;

b. service providers, website administrators, IT service providers and other vendors engaged to support Company operations;

c. professional advisers, including legal, financial and compliance advisers;

d. business partners, customers or suppliers, where necessary for the relevant transaction or interaction;

e. courts, regulatory authorities, law enforcement agencies or government bodies where disclosure is legally required or otherwise permitted; and

f. other persons where the individual has provided the necessary consent or disclosure is otherwise lawful.

The Company shall take appropriate steps, as required by applicable law and the relevant engagement, to ensure that persons processing personal data on its behalf handle such data appropriately.

The Company does not intend to sell personal data to third parties as a commercial data product.

8. Data Security

The Company seeks to implement reasonable technical and organisational safeguards to protect personal data against unauthorised access, disclosure, alteration, destruction, loss or misuse.

Depending on the nature of the processing, safeguards may include access restrictions, password protection, appropriate security controls, confidentiality obligations, secure storage and review of access permissions.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, the Company shall take such measures as are required under applicable law and appropriate to the nature of the personal data and associated risks.

9. Data Retention and Erasure

The Company shall retain personal data only for as long as reasonably necessary for the purpose for which it was collected, or for the period required under applicable law, contractual obligations, record-retention requirements or the establishment, exercise or defence of legal claims.

When personal data is no longer required and no legal or other permitted ground for retention remains, the Company shall take appropriate steps to erase or dispose of it in accordance with its applicable retention procedures and legal obligations.

Erasure may be subject to statutory retention requirements, legal proceedings, regulatory directions or other lawful grounds for continued retention.

10. Rights of Individuals

Subject to the applicability and commencement of the relevant provisions of the DPDP Act and DPDP Rules, and any applicable conditions or exceptions, individuals may be entitled to:

a. obtain information about personal data processed by the Company and the purposes of such processing;

b. request correction, completion or updating of personal data, as applicable;

c. request erasure of personal data, subject to lawful retention requirements;

d. withdraw consent where processing is based on consent;

e. seek grievance redressal in relation to the processing of personal data; and

f. nominate another individual to exercise applicable rights in the event of death or incapacity, as provided under the DPDP Act.

Individuals may submit requests through the contact details specified in this Policy. The Company may require reasonable information to verify the identity of the requester and clarify the request, as permitted by applicable law.

Requests shall be handled within the time limits and in the manner prescribed by applicable law once the relevant requirements become operative. The Company may decline or limit a request where permitted or required by law and shall communicate its response appropriately.

11. Grievance Redressal

Any individual who has a concern, complaint or request relating to the processing of personal data by the Company may contact the designated grievance contact below.

Email: ithelpdesk@synokempharma.com

The Company shall endeavour to acknowledge and address complaints within a reasonable period and in accordance with the requirements applicable at the relevant time.

Where applicable, individuals may pursue further remedies available under the DPDP Act, including approaching the competent authority or the Data Protection Board of India in accordance with law.

12. Personal Data Breaches

The Company shall maintain appropriate procedures for identifying, assessing and responding to personal data breaches.

Where a breach occurs, the Company shall take appropriate steps to contain the incident, assess its impact, mitigate harm and make notifications to affected individuals or competent authorities to the extent and within the timelines required by applicable law.

13. Children’s Personal Data

The Company does not intend its website or ordinary business enquiry channels to be directed towards children.

Where the processing of children’s personal data is subject to specific requirements under applicable law, the Company shall implement the relevant safeguards, including verifiable parental consent or other applicable requirements, where required.

The Company shall not knowingly use children’s personal data for prohibited purposes.

14. Data Processors and Third-Party Services

The Company may use third-party service providers for website hosting, communications, information technology, recruitment or other operational purposes.

Where such providers process personal data on behalf of the Company, the relevant arrangements shall be governed by applicable contracts and legal requirements.

Third-party websites or services linked to or accessible through the Company’s website may have their own privacy policies and data-handling practices. The Company is not responsible for the independent practices of third parties, except to the extent responsibility is imposed by applicable law or agreement.

15. Cookies and Website Technologies

The Company’s website may use cookies or similar technologies to support website functionality, security, performance and user experience.

Information about the relevant cookies, their purposes and available controls should be provided through the Company’s Privacy Policy or a separate Cookie Policy, where appropriate.

Where consent or another specific requirement is applicable, the Company shall implement the relevant mechanism in accordance with applicable law.

16. Cross-Border Transfer of Personal Data

Where personal data is transferred outside India, the Company shall comply with the restrictions, conditions and requirements applicable to such transfer under Indian law and any other applicable legal or contractual obligations.

The Company shall not treat the mere availability of a third-party service outside India as overriding any applicable restriction on the transfer or processing of personal data.

17. Accountability and Internal Procedures

The Company may adopt internal procedures, access controls, employee instructions, contractual safeguards and other measures to support appropriate handling of personal data.

Personnel handling personal data are expected to follow applicable Company procedures and to access or use personal data only for authorised purposes.

The Company may review and update its processes as necessary to address changes in its operations, applicable law and regulatory requirements.

18. Amendments to this Policy

The Company reserves the right to amend or update this Policy from time to time to reflect changes in applicable law, regulatory requirements, business operations or data-handling practices.

The updated version shall be published on the Company’s website with a revised “Last Updated” date, where appropriate. Individuals are encouraged to review this Policy periodically.

19. Governing Law

This Policy shall be interpreted in accordance with the laws of India, including applicable data protection and privacy legislation. Nothing in this Policy is intended to exclude or restrict any mandatory statutory right or obligation.

20. Contact Information

For questions, requests or concerns regarding this Policy or the processing of personal data by Nitin Lifesciences Limited, please contact:

Nitin Lifesciences Limited
Email: cs@synokempharma.com