© Thermax Limited - All rights reserved.

No part of this document may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, recording, photocopying or otherwise, outside of Thermax Limited (Thermax) without the prior permission of Data Protection Officer / Representative (DPO / DPR).

For any clarifications, please contact at dpr@thermaxglobal.com.

Policy

Thermax Limited, its subsidiaries and affiliates (hereinafter referred to as “Thermax”, “we”) understand that your privacy is important to you, and it is equally important to us. We may process your personal data in the capacity of data controllers / body corporates. We are committed to respecting your privacy and protecting your personal data, which is any information that is capable of identifying you as an individual person.

This privacy policy describes your information that we collect digitally through Thermax websites, mobile applications, email, vendor/ visitor/ HR system and related processes and from any person who is material to the organization; how that information is used, maintained, shared, protected and how you can update it. It also applies to all personal data received by us from the European Economic Area (“EEA”) in any format, including electronic or paper.

We shall process your personal data in accordance with this Privacy Policy, unless such processing conflicts with the requirements of applicable law, in which case, applicable law will prevail.

By submitting your personal data to Thermax, you acknowledge that:

1. You have read and understood this privacy policy and agree to the use of your personal data as set out here. Your personal data may be transferred and processed by business units, processes and systems in respective countries in which Thermax conducts its business and has dealings or other business relationships with third parties, for the purposes and in the manner specified in this policy.

2. You are not obligated to provide any requested information to us but failing to do so may result in not being able to proceed with your requirement.

3. All your representations are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature. Providing any inaccurate information may make you ineligible for availing our products, solutions, services or employment.

Personal Data We Collect

When you use any website/ mobile application of Thermax for contacting us for product or service-related query, services or to apply for any job openings or physically visit Thermax, your personal data is collected by us. The type of personal data that are collected from you with respect to your enquiry/ service or during physical visit to Thermax including but not limited to your name, company name, contact details, address, information about your device and other necessary information required for internal purposes or compliance, legal, regulatory requirement.

If you apply for a job or opportunity as per your skills through this website, you will be asked to submit your resume. We will use the information in your resume to consider you for the job opening that you specify. We may also use the information in your resume to contact you regarding other opportunities, as per your skills advertised on this website.

We may also collect your personal data from third parties, such as professional recruiting firms, your references, prior employers, Thermax employees with who have interviewed you and employment background check providers, to the extent this is permitted by applicable law, and Information to verify the authenticity of the documents or personnel.

We may also ask you for personal data in connection with other interactions you have with this website, including when you answer a survey or report a problem with this website, or services offered on this website.

We may use a third-party service provider to assist us with some features of our website or their services/ tools to provide services to you. Our service provider will receive your information on our behalf and will not be permitted to use it for any other purpose.

Special category data is a subset of personal data and includes ethnicity, health, trade union membership, philosophical beliefs, sexual orientation, as well as other categories as prescribed by law. Thermax does not seek to obtain and will not collect such data about a candidate unless permitted to do so by applicable laws.

How We Use Your Personal Data

By using our services or while visiting, you consent to the collection, use, and sharing of your personal information as described in this Policy. We collect and use your personal data for legitimate, human resources, business management or commercial reasons. This may include the following purposes:

• To respond to your requests.

• To provide you services, including customer services issues.

• To send you communications about current services of Thermax, new products and services or promotions that we are developing, and opportunities that may be available to you.

• Alerts for new features or enhancements to our products and services.

• To communicate about job or career opportunities which you have inquired.

• Identifying and evaluating candidates for potential employment, as well as for future roles that may become available.

• To ensure that our website and our services function in an effective manner for you.

• To authenticate/ authorize the customer/ visitors/ vendors visiting the site/ premises physically or digitally.

• Marketing and events: We use personal data to deliver marketing and event communications to you across various platforms, such as email, telephone, text messaging, direct mail, online, etc. If we send you a marketing email, it will include instructions on how to opt out of receiving these emails in the future. Please remember that even if you opt out of receiving marketing emails, we may still send you important service information related to your accounts and subscriptions.

• Legal obligations: We may be required to use and retain personal information for legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss prevention or fraud. We may also use personal data to meet our internal and external audit requirements, information security purposes, and as we otherwise believe to be necessary or appropriate.

We endeavor to collect only such information that is reasonably necessary to perform services for you or to respond to your inquiries. You are responsible for ensuring that the information you provide is accurate, complete, and current. We will take reasonable steps to ensure that the information we collect and use is relevant to its intended use.

When We Share Personal Data

We share or disclose personal data when necessary to provide services or conduct our business operations.

• Within Thermax: Our businesses around the world are supported by Thermax teams and functions, and personal data will be made available to them, if necessary, for the provision of services, account administration, sales, and marketing, customer, and technical support, business, and product development, for instance. All our employees and contractors are required to follow our Personal Data Protection Policy and Information Security policies when handling personal data.

• Our business partners: We occasionally collaborate with other organizations to deliver co-branded Services, to provide content, or to host events, conferences, and seminars. As part of these arrangements, you may be a customer of both Thermax and of our partners; we may collect and share information about you. We will handle personal data in accordance with the privacy policy.

• Our third-party service providers: We collaborate with and are supported by service providers around the world. Personal data will be made available to these parties only when necessary to fulfil the services they provide to us. E.g., software, system, and platform support; direct marketing services; cloud hosting services; advertising; and order fulfilment and delivery. Our third-party service providers are not permitted to share or use your personal data we make available to them, for any other purpose than to provide services to us.

• Third parties for legal reasons: We will share personal data when we believe it is required, such as:

  1. To comply with legal obligations and to respond to requests from government agencies, including law enforcement and other public authorities, which may include such authorities outside your country of residence.

  2. In the event of a merger, sale, restructuring, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings.)

Where We Store and Process Personal Data

Thermax is a global organization, and your personal data may be stored and processed globally. We take steps to ensure that the information we collect is processed according to this privacy policy and the requirements of applicable law wherever the data is located. Thermax has networks, databases, servers, systems, support, and helpdesks located throughout our offices around the world. We collaborate with third parties such as cloud hosting services, suppliers, and technology support located around the world to serve the needs of our business, workforce, and customers. We take appropriate steps to ensure that personal data is processed, secured, and transferred according to applicable law thus protecting the confidentiality, availability, and integrity of your personal data.

How We Secure Personal Data

We take data security seriously, and we use appropriate technologies and procedures to protect personal data. Our information security policies and procedures are closely aligned with widely accepted international standards and are reviewed regularly and updated as necessary, to meet our business needs, changes in technology, and regulatory requirements.

For example:

• Policies and procedures: Thermax employ reasonable technological, physical, and operational security procedures intended to protect your personal data from loss, misuse, alteration, or unintentional destruction. Our security measures are periodically reviewed and updated with an effort to provide appropriate security for all your data collected through website/ applications/ systems.

• We place appropriate restrictions on access to personal data.

• We implement appropriate measures and controls, including monitoring and physical measures, to store and transfer data securely.

• We conduct privacy, information security, and other applicable trainings on regular basis for our employees and contractors who have access to personal data and other sensitive data.

• We require our third-party vendors and providers to protect any personal data with which they are entrusted, in accordance with our information security policies and procedures.

How Long We Keep Your Personal Data

We retain personal data for so long as is reasonably required for legal or business purposes. In determining data retention periods, Thermax takes into consideration local laws, contractual obligations, and the expectations and requirements of our customers. When we no longer need personal information, we securely delete or destroy it. For detailed information on how we manage and retain records, please refer to our Record Retention Policy.

Your choice to unsubscribe or opt-out

If you wish to unsubscribe or withdraw consent at any time from Thermax, you can send us an email at dpr@thermaxglobal.com.Please note that withdrawing consent may affect your ability to use certain features of our services. We will retain your information for as long as our legal or business requirements dictate.

Your rights

We take reasonable steps that are designed to keep your personal data accurate, complete, and up-to-date for the purposes for which it is collected and used. Thermax has also implemented measures that are designed to ensure that processing of your personal data complies with this privacy policy and applicable law(s).

• You may have the right to request access to your personal data that Thermax has collected, for the purposes of reviewing, modifying, or requesting deletion of your data.

• You may have the right to request a copy of your personal data Thermax has collected and to have any inaccuracies corrected.

• You may also request Thermax to cease the processing of your personal data (e.g., if you choose to withdraw from our recruiting or for products and services program), although note that we may need to retain certain personal data where required or permitted under applicable law.

• You may also have a right to object to processing of your personal data that Thermax has collected.

If you would like to make a request to access, review or correct your personal data that Thermax has collected, or to discuss how we process your personal data, please contact us at dpr@thermaxglobal.com.

*The above rights are as per the GDPR requirements and can be exercised by EU data subjects and as per Digital Personal Data Protection Act (DPDP), 2023 requirements.

*Additionally, under provisions of Indian IT Act 2000, G.S.R. 313(E), Rules for Reasonable security practices and procedures for sensitive personal data or information, providers of sensitive personal information within India can exercise these rights for the sensitive personal information provided by them to Thermax. These providers of the sensitive personal information can also report the discrepancies or grievances with respect to processing of their information at the above-mentioned email address i.e., dpr@thermaxglobal.com. which represents the contact detail of Data Protection Representative or the Grievance Officer at Thermax for redressing such grievances.

To help protect privacy and security, we will take reasonable steps to verify your identity before granting you access to your personal data. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by applicable law. Depending upon the circumstances and the request, we may not be permitted to provide access to personal data or otherwise fully comply with your request; for example, where producing your information may reveal the identity of someone else. Thermax reserves the right to charge an appropriate fee for complying with your request where allowed by applicable law, and/or to deny your requests which, in Thermax’s discretion, may be unfounded, excessive, or otherwise unacceptable under applicable law.

Cookies

From time to time, we may, like many other commercial websites/ web applications, use a standard technology called a “cookie”. A cookie is a small text file that is placed on a computer or other device and is used to identify the user or device and to collect information. Cookies are typically assigned to one of four categories, depending on their function and intended purpose: necessary cookies, performance cookies, functional cookies, and cookies for marketing purposes. A cookie cannot retrieve any other data from your hard drive, pass on computer viruses, or capture your e-mail address. Currently, websites use cookies to enhance the user’s visit; in general, cookies can securely store a user’s ID and password, personalize home pages, and identify which parts of a website have been visited. It is possible to set your browser to inform you when a cookie is being placed. This way you have the opportunity to decide whether to accept the cookie. By showing how and when our visitors use this website/ web application, this information can help us to improve our website/ web application on a continual basis.

Children

Thermax does not intend to collect or maintain personal data of individuals under 18 (eighteen) years of age or as per local jurisdiction/ laws. IF YOU ARE UNDER 18 YEARS OF AGE, PLEASE DO NOT USE OR ACCESS THIS WEBSITE/ APPLICATION/ SYSTEM. If Thermax learns that personal data of an individual under 18 years old has been collected without verifiable parental consent, then Thermax will take the appropriate steps to delete such information.

Contact

If Contact you have any questions about this privacy policy, please contact us at dpr@thermaxglobal.com.

Thermax reserves the right to modify this privacy policy. Thermax will post changes to the privacy policy on this page. Please check this page at regular intervals for updates.