Privacy Notice

01Purpose

Coremantle AI Private Limited (“Coremantle,” “we,” “us,” or “our”) provides AI data annotation, dataset creation, and Indian-language data services. We are committed to protecting the privacy and personal data of our customers, employees, job applicants, contributors, business partners, website visitors, and other stakeholders. This Privacy Notice explains how we collect, use, store, disclose, and protect personal data, in accordance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (“DPDPA”) as our primary applicable law, and the EU General Data Protection Regulation (“GDPR”) where relevant to our international stakeholders.

Where Coremantle processes personal data on behalf of a client under a signed Data Processing Agreement — for example, annotation datasets a client supplies to us — Coremantle acts as a Data Processor, and that engagement is governed by the client’s own instructions and privacy notice, not this document.

02Scope

This Privacy Notice applies to:

• Customers and prospective customers
• Employees and former employees
• Job applicants
• Contributors, consultants, and contractors
• Business partners and vendors
• Website visitors
• Event participants
• Individuals who otherwise communicate with Coremantle

03Information We Collect

3.1 Customer Information

• Name, company name, job title, business address, email address, phone number
• Payment and billing details
• Government identification, where legally required
• Communication records and contractual information
• Service usage information

3.2 Employee Information

• Personal identification details, employee ID, date of birth, contact information
• Educational qualifications and employment history
• Background verification information and government-issued identification
• Bank account, salary, payroll, and tax information
• Attendance, performance review, and training records
• Emergency contacts and, where required by law, medical information
• System access logs and device/network usage information

3.3 Job Applicant Information

• Resume/CV, employment history, educational qualifications, references
• Interview notes and assessment results
• Background verification information, where consented

3.4 Website Visitor Information

• IP address, browser type, device information, operating system
• Approximate geographic location, pages visited, date/time of visit, referral source
• Cookies, similar technologies, and website usage analytics

3.5 Business Partner Information

• Contact details and company information
• Banking information and tax registration details
• Contract information and communication records

04How We Collect Information

We collect personal data through direct interactions, website forms, email communications, employment applications, recruitment agencies, business contracts, cookies, analytics tools, security systems, publicly available sources, and third-party service providers.

05Purpose of Processing

5.1 Customer Data

• Manage customer relationships and respond to inquiries
• Process payments and improve services
• Meet legal obligations and prevent fraud

5.2 Employee Data

• Recruitment and employment administration
• Payroll and benefits administration
• Performance management, training, and workforce planning
• Regulatory compliance, information security, and business continuity

5.3 Website Visitors

• Operate and secure the website; improve user experience
• Analyze website performance and respond to requests
• Marketing communications, only where consent has been provided

We do not use personal data to make any solely automated decision that produces a legal or similarly significant effect on an individual.

06Legal Basis for Processing

Where required by applicable law, we process personal data based on one or more of: individual consent; performance of a contract; compliance with a legal obligation; legitimate business interests, balanced against individual rights; protection of vital interests; or public interest obligations. Under the DPDPA specifically, this generally means your consent for a specified purpose, or a “legitimate use” recognised by the Act, such as an employment relationship or a request you have voluntarily made.

07Cookies

Our website uses cookies and similar technologies to maintain website functionality, remember user preferences, analyze website traffic, improve user experience, support security, and measure marketing effectiveness. You may control cookies through your browser settings; disabling certain cookies may affect website functionality. Where required by applicable law, we present a cookie consent banner and activate non-essential analytics only after consent.

08Sharing of Personal Information

We do not sell personal data. We may share personal data with group companies, professional advisors, auditors, payroll providers, cloud and IT service providers, recruitment partners, banks, government authorities where legally required, regulatory bodies, and law enforcement agencies. We share data only under contract and strictly for the purposes described in this Notice. For security reasons, we do not publish the identities of specific vendors or the precise locations of our infrastructure on this page; this information is available to clients under a signed Data Processing Agreement, and to regulators or auditors on lawful request. If Coremantle is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this Notice or a materially similar one.

09International Transfers

Coremantle primarily stores and processes personal data within India. Where personal data is transferred outside the country of collection — for example, to certain analytics, email, or language-processing providers — we implement appropriate contractual and technical safeguards in accordance with applicable data protection laws. For security reasons, specific data-centre locations and provider names are not published here; this information can be made available under a signed confidentiality or Data Processing Agreement. If you are located in the EEA, we transfer personal data outside the EEA only where an adequate safeguard, such as Standard Contractual Clauses or an adequacy decision, is in place.

10Information Security

Coremantle implements appropriate technical and organizational safeguards, including access controls, encryption, multi-factor authentication, secure network architecture, security monitoring, endpoint protection, vulnerability management, secure software development practices, employee awareness training, physical security controls, and backup and disaster recovery procedures.

11Data Retention

Personal data is retained only for as long as necessary to fulfil business purposes, meet contractual obligations, comply with legal and regulatory requirements, resolve disputes, and enforce agreements. Following the applicable retention period, personal data is securely deleted, anonymized, or destroyed. As a general guide: website enquiry data is retained for up to 24 months from the last interaction unless a contractual relationship begins; job application data is retained for up to 12 months unless applicable law requires otherwise; employee data is retained per statutory and contractual requirements for the duration of employment and any legally mandated period thereafter.

12Individual Rights

Subject to applicable law, individuals have the following rights as Data Principals under the DPDPA:

If the GDPR applies to you, you additionally have the right to data portability, the right to object to processing based on legitimate interests or for direct marketing, and the right to lodge a complaint with your local supervisory authority. Requests may be submitted using the contact information in Section 17.

13Employee Monitoring

Coremantle may monitor the use of company systems, devices, networks, email, and other information assets for information security, regulatory compliance, business continuity, fraud prevention, protection of company assets, and investigation of security incidents. Monitoring is conducted in accordance with applicable law and internal company policy, and employees are notified of monitoring practices separately.

14Children’s Privacy

Our services and website are not intended for individuals under the age of 18. We do not knowingly collect personal data from children without appropriate authorization where required by applicable law. If you believe a child has provided us with personal data, please contact us so we can delete it.

15Third-Party Websites

Our website may contain links to external websites. Coremantle is not responsible for the privacy practices or content of third-party websites, and we encourage you to review their privacy notices before providing personal data.

16Data Breach Management

In the event of a personal data breach, Coremantle will investigate the incident, contain and remediate the issue, assess potential risks, notify affected individuals where required, notify regulators where legally required — including the Data Protection Board of India within the timelines prescribed under the DPDPA, and, where the GDPR applies, within 72 hours of becoming aware of the breach where feasible — and implement corrective actions.

17Contact Information

For questions regarding this Privacy Notice, or to exercise applicable privacy rights, please contact:

• Data Protection Officerdpo@coremantle.ai
• Grievance Officer (data protection matters)grievance@coremantle.ai
• Registered OfficeCoremantle AI Private Limited, 3rd Floor, 334, Sector 2, 27th Main, HSR Layout, Bengaluru, 560102

18Changes to This Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in our practices, our services, or applicable law. Material changes will be communicated through appropriate channels, including updates on our website with a revised “Last Reviewed” date.

19Consent

Where required by applicable law, by using our services, submitting information, applying for employment, or accessing our website, individuals acknowledge that they have read and understood this Privacy Notice and consent to the processing of their personal data as described herein.