Privacy Notice

We may collect the following types of personal data about you. In this privacy notice, "You" refers to you as an individual, as relevant if you are:

• A client
• A representative of, or an individual related to, a client or
• A representative of, or an individual related to a company, business or organisation that is our business or corporate client.

Personal data we collect with respect to business and corporate client relationships is primarily limited to the information on directors and officers, other employees, direct and indirect beneficial owners and authorised persons we need to enable us to meet our due diligence obligations, signatory details and contact information of individuals we interact with to enable the provision of products and services to clients.

If you give us someone else's personal data, you must have their permission and explain to them how we'll use such personal data as permitted under the Applicable Law (as defined hereinafter).

We may collect the following types of personal data about you, as relevant and with your consent or where allowed by Applicable Law. The types of personal data may change from time to time as required by Applicable Law:

• Identification data - information that identifies (uniquely or semi uniquely) you. For example, your name, your date of birth, your gender, your photographs, CCTV and video recordings of you and other identifiers, including official/government identifiers such as national identification number, passport number and tax identification number
• Contact data - information that allows addressing, sending or communicating a message to you. For example, your email address, your phone or mobile number and your residential or business address
• Professional data - information about your educational or professional background
• Geo-location data - information that provides or contains a device's location. For example, your internet protocol (IP) address or your cookies identifier
• Behavioural data - analytics information that describes your behavioural characteristics relating to your use of our products and services. For example, usual transactional activities, browsing behaviour on our websites and how you interact as a user of our products and services, or those provided by third-party organisations, such as our advertising partners and social media platform providers
• Personal relationship data - information about associations or close connections between individuals or entities that can determine your identity. For example, spouse or employer relationships
• Communications data - information relating to you contained in voice, messaging, email, live chats and other communications we have with you. For example, service requests.

We may sometimes need to collect more sensitive personal data or information about you, but we only do this if it's necessary and with your consent or where allowed by Applicable Law. This sensitive personal data (sometimes known as special category personal data in other jurisdictions) may include things like:

• Financial and commercial data - your account and transaction information or information that identifies your financial position and background, status and history as necessary to provide relevant products and services. For example, your account details, your debit or credit card details, your source of funds, your financial and credit rating history and any payment instrument details
• Health data - information relating to your health status. For example, disability information relevant to accessibility
• Criminal convictions, proceedings or allegations data - information about criminal convictions or related information that we identify in relation to our financial crime prevention obligations, for example, details about any criminal convictions or related information. This includes details of offences or alleged offences or convictions.

We usually get your personal data directly from you, but we may also obtain your personal data from other sources as necessary, depending on the relevant products and services that we are providing, including from:

• People you know - such as:
  • Parents or guardians of minors. If you are a minor (normally this means if you are under 18 years old, but this might be younger depending on where you live). We will get your parent or guardian's consent before collecting, using or sharing your personal data
  • Your joint applicants to our products
  • Your referees
  • Your guarantors; and
  • Other people you appoint to act on your behalf
• Businesses and other organisations - such as:
  • Your employer and/or company, business or organisation you represent or is related to you
  • Other financial institutions and financial service providers
  • Service partners, such as advertising and market research companies and social media platform providers
  • Credit reference and fraud prevention agencies
  • Regulatory and other entities with authority over the Standard Chartered Group, such as tax authorities, law enforcement or authorities imposing financial sanctions
• Our corporate and business clients - where you receive the benefit of our services in relation to our contract with the company, business or organisation you interact with. For example, resolving payment disputes with our merchant clients
• Publicly available resources - such as online registers or directories or online publications, social media posts and other information that is publicly available
• Cookies - when you visit, browse, or use our websites, online or mobile applications, we may use cookies to automatically collect certain information from your device. We may use such information, where relevant, for internal analysis and troubleshooting, to recognise you and remember your preferences, to improve the quality of and to personalise our content and to determine the security status of your account. For more information on how we use cookies and how you can control them when visiting our websites, please see our Cookie Policy
.

We collect your personal data so that we can provide our products and services, manage our relationship with our clients and operate our business. This is necessary when you hold an account with us and also when you represent, or are associated with, other individuals, companies, businesses or organisations who transact with us, for example, if you act as a guarantor, employee, shareholder, director, officer or authorised person.

If you have or are associated with more than one account with Standard Chartered Group, we may link all your accounts and personal data to enable us to have an overall picture of our client relationships.

We generally process your personal data including sensitive personal data or information with your consent where required by Applicable Law or where otherwise permitted or required by Applicable Law.

What we use your personal data for is often referred to as our purposes of processing and these are detailed below. We generally process your personal data with your consent where required by law or where otherwise permitted or required by Applicable Law.

We may not be able to offer or provide our products and services if you choose not to provide us with your consent or subsequently withdraw your consent to process the personal data that we consider is necessary and/or is required to meet our legal and regulatory obligations.

Purposes of Processing
We process your personal data for the following purposes, as necessary to provide relevant products and services, depending on whether you have your own loan account with us (including when applying for our products) or you represent, or are associated with, other individuals, companies, businesses or organisations who transact with us. The term "Specified Purposes" shall mean the purposes set forth hereunder.

Assessing and providing products and services to our clients
This includes:

• Assessing eligibility, merits and /or suitability of product and service applications for clients; we may retain a record of the application if our eligibility criteria are not met
• Assessing your suitability as an individual guarantor
• Conducting relevant due diligence and know-your-customer (KYC) checks as required by Applicable Law
• Conducting credit checks and financial assessments as required by Applicable Law and regulations
• Setting credit limits for clients
• Opening loan accounts.

Managing relationships and administering client accounts
This includes:

• Establishing, continuing and managing client relationships and accounts with us or, where applicable, any member of the Standard Chartered Group
• Providing clients with appropriate access to our lending products and services
• Operating, providing, reviewing and evaluating the lending products and services, offered by or through us or any member of Standard Chartered Group, to fulfil our contractual obligations with clients for products and services
• Maintaining up-to-date records of authorised persons and signature lists
• Maintaining statements detailing the amount of indebtedness owed by you to us and by us to you
• Administering, for example, credit facilities or loans for clients
• Maintaining contact information
• Responding to questions or managing any complaints, including monitoring social media posts to identify conversations, sentiments, and complaints about the Standard Chartered Group
• Issuing notifications about changes to the terms and conditions of our products and services
• Recording our communications for record-keeping and evidential purposes including email and telephone
• Contacting clients relating to the products and services we are providing

Operating our business
This includes:

• Managing authentication for clients
• Audits of our business operations
• Creating and maintaining our credit scoring models relating to clients
• Conducting relevant credit management activities, which includes maintaining client credit history for present and future reference, updating credit bureaus and credit reference agencies and ensuring ongoing credit worthiness and credit checks
• Assisting other banks and third parties to recover funds that have entered client loan accounts as a result of erroneous payments received.
• Performing administrative tasks relating to the products and services we provide, monitoring and reporting of our financial portfolio, risk management activities, audits and ensuring operation and security of our communications and processing systems, systems development and testing, business planning and decision-making.
• Enabling an actual or potential assignee of all or any part of our business and/or asset or participant or sub-participant of our rights in respect of the data subject, to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation.

Improving our products and services to our clients
This includes:

• Developing, testing and analysing our systems, products and services
• Monitoring and recording our communications with you, for example, phone calls, for training and quality purposes
• Conducting market research and customer satisfaction surveys
• Designing our products and services for your use, conducting demographic analytics and gathering insights by aggregating data such as behavioural data from the use of our products and services and our applications to provide you with more tailored products and services.

Complying with Applicable Laws, regulations and other requirements
This includes:

• Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
• Complying with relevant local and foreign law, regulations, rules, directives, judgments or court orders, requests, guidelines, government sanctions, embargo, reporting requirements, restrictions, demands from or agreements with any authority (including domestic or foreign tax authorities), court or tribunal, enforcement agency or exchange body in any relevant jurisdiction where the Standard Chartered Group operates. For example, we may share personal data relating to your client account with a local tax authority in accordance with applicable law or regulations. The local tax authority may share or may require us to share such information with other overseas tax authorities in accordance with applicable law or regulations (for example, tax law and regulations relating to automatic exchange of financial account information). We may need to collect extra information from you for such purpose to comply with applicable law or regulations ("Applicable Law")
• Following any voluntary guidelines or recommendations as may be updated from time to time issued by legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.

General Purposes of Processing

The term "General Purposes" shall mean the purposes set forth hereunder. Notwithstanding anything set out hereinabove, your personal data may be processed (including without your consent as permissible under Applicable Law) for the following purposes:

• The performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function including in our role as a sponsor bank or an authorized dealer bank
• In the interests of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India
• Processing your personal data when you are not within the territory of India pursuant to any contract entered into with any person outside the territory of India
• Necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to you and such processing is carried on in accordance with such standards as may be prescribed under law
• For any specified purpose for which you have voluntarily provided your personal data to us and in respect of which you have not indicated to us that you do not consent to the use of your personal data
• For fulfilling any obligation under any law for the time being in force in India on us to disclose any information to the state or any of its instrumentalities subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force
• For us to comply with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India
• For responding to a medical emergency involving a threat to the life or immediate threat to your health or that of any other individual
• To take measures to ensure health and safety of, or provide assistance or services to, any individual during any epidemic, outbreak of disease, or any other threat to public health
• To take measures to provide medical treatment or health services to any individual during any disaster, or any breakdown of public order
• Where personal data is processed outside the territory of India, if such processing is not in connection with any activity related to offering of goods or services to data principals within the territory of India
• Where your personal data is processed for any purpose where such personal data is made or caused to be made publicly available by yourself any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.
• Exercising Standard Chartered Group's legal rights and conducting legal proceedings
  This includes:
  • Tracing and exercising our rights and protecting ourselves against harm to our rights and interests
  • Retaining records as may be necessary as evidence for any potential litigation or investigation
  • Recovering debts and arrears
  • Conducting litigation to enforce our rights or the rights of any other member of the Standard Chartered Group
  • Obtaining professional advice
  • Investigating or making an insurance claim
  • Responding to any insurance related matter, action or proceeding
  • Defending or responding to any current or prospective legal, governmental or quasi-governmental, regulatory, or industry bodies or associations related matter, action or proceeding or for establishing, exercising or defending legal rights
  • For ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from us
• Facilitating Standard Chartered Group mergers, acquisitions, and divestments
  This includes:
  • Evaluating our business and providing continuity of services to you after a transfer of our business as a result of a merger, acquisition, sale or divestment
  • Where necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force
• Keeping you and our people safe
  This includes:
  • Conducting identity verification security checks for building access
  • Using CCTV surveillance recordings at our branches and premises for the purposes of preventing and detecting fraud and/or other crimes, such as theft
  • investigating and reporting on incidents or emergencies on our properties and premises
  • For the security of our systems and networks in order to keep your data safe and confidential
  • For other health and safety compliance purposes
• Detecting, investigating and preventing financial crimes
  This includes:
  • Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
  • Any other use of data and information in accordance with any group-wide programmes for compliance with sanction or prevention or detection of money laundering, terrorist financing or other unlawful activities
  • Conducting identity verification security checks against government and other official centralised databases, as required by law
  • Monitoring and recording voice and electronic communications and screening applications and transactions in connection with actual or suspected fraud, financial crime or other criminal activities, for example to detect unusual transaction behaviour
  • Recording and monitoring voice and electronic communications with us, to the extent permitted by Applicable Law, to ensure compliance with our legal and regulatory obligations and internal policies
  • Conducting checks against government and non-government third parties' fraud prevention and other financial crime prevention databases to prevent money laundering, terrorism, fraud and other financial crimes, to protect you, our clients and the integrity of the financial market. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies and may result in others refusing to provide services or employment to you.

We may share your personal data within the Standard Chartered Group. Standard Chartered Group may share your personal data for the purposes of processing as set out in this privacy notice, including with our service providers, our business partners, other third parties and as required by Applicable Law or requested by any authority. Who these are depends on your interactions with us as an individual.

We limit how, and with whom, we share your personal data and take steps to ensure your personal data is kept confidential and protected when we share it. We may share your personal data for our purposes of processing with the following, where relevant and with your consent or if allowed by Applicable Law:

• Other members of the Standard Chartered Group
• Authorised third parties
• Legal guardians, joint account holders, actual or intended guarantors/sureties, trustees, beneficiaries, executors, or authorised persons of our clients, any actual or potential participants or sub-participants in relation to any of our obligations in respect of any agreement, assignees, novatees or transferees (or any officers, employees, agents or advisers of any of them)
• Any other person you have authorised us by your consent to share your personal data with.
• Third parties that can verify your information
  • Credit bureaus or credit reference agencies (including the operator of any centralised database used by credit reference agencies), credit protection providers, rating agencies, debt collection agencies, fraud prevention agencies and organisations
  • Other non-government third parties' that conduct financial crime prevention databases checks to prevent money laundering, terrorism, fraud and other financial crimes.
• Our service partners
  • Professional advisers, such as auditors, legal counsel,
  • Service providers, such as operational, administrative, data processing and other technology service providers, including anyone engaged or partnered with to analyse and facilitate improvements or enhancements in Standard Chartered Group's operations or provision of products and services
  • Providers of professional services, such as market researchers, forensic investigators and management consultants
• Other financial services organisations
  • Other financial institutions, such as merchant banks, correspondent banks or national banks
  • Market infrastructure providers and securities clearing providers
  • Payment service providers, including digital payment service providers, Account Information Service Providers (AISP)
  • Any financial institution with which you have or propose to have dealings.
• Government authorities and law enforcement
  • As required by Applicable Law or as requested by any authority, which includes any government, quasi-government, regulator, administrative, regulatory or supervisory body, court, tribunal, enforcement agency, exchange body or domestic or foreign tax authorities, having jurisdiction over any Standard Chartered Group member, whether within or outside your jurisdiction and whether or not that Standard Chartered Group member has a relationship with you
  • Self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.
• Other third parties
  • The individual, company, business or organisation, as applicable, that you represent or is related to you
  • Third parties in case of a merger, acquisition or divestment: if we transfer (or plan to transfer) or assign any part of our business or assets. If the transaction goes ahead, the interested party may use or disclose your personal information in the same way as set out in this privacy notice, and subsequently notify you of any changes they may make in terms with how they process your personal data
  • Any other person under a duty of confidentiality to us, including any other members of the Standard Chartered Group, which has undertaken to keep such information confidential

Your personal data may be processed, stored, shared, transferred or disclosed by us within the Standard Chartered Group or with other third parties for the purposes described in this privacy notice and as permitted under Applicable Laws. We do this in order to operate effectively, efficiently and securely in facilitating transactions and providing products and services to our clients, to improve and support our processes and business operations and to comply with our legal and regulatory obligations. This may involve processing, storing, sharing, transferring or disclosing your personal data cross border to other jurisdictions.

Where recipients of your personal data are in jurisdictions that are outside India, and local laws may not have similar data protection laws as India, we will take all reasonable steps necessary to ensure that your personal data has an appropriate adequate level of protection and safeguards to comply with Applicable Law.

We take the privacy and security of your personal data available with us very seriously. To protect your personal data, we use a range of appropriate technical, physical and organisational measures as required under Applicable Law to safeguard and keep your personal data confidential, for example, by using contracts with appropriate confidentiality, data protection and security terms in our arrangements with third parties. Standard Chartered Group has implemented information security data privacy policies, including incident management and reporting procedures, rules and technical measures to protect personal data and to comply with legal and regulatory requirements. We train and require staff who access your personal data to comply with our data privacy and security standards. We require our service providers, or other third parties we engage with and to whom we disclose your personal data to implement similar confidentiality, data privacy and security standards and measures when they handle, access or process your personal data

For the purposes described in this privacy notice, we keep your personal data for business operational or legal reasons while you engage with us and may retain your personal data for a period of time afterwards, depending on the type of personal data, in accordance with our data retention policy standards and as required by Applicable Law and regulations. We will delete, anonymise, destroy and/or stop using personal data when we no longer need it or retention thereof, after a period of time, is not permitted by Applicable Law.

We respect your personal data, and you have the following rights about how we use your information:

• Your right to access your data - you have the right to check whether we hold personal data about you, and you can ask us for a copy of such data and information on how we have used it.
• Your right to correct your data – if your personal details have changed, or you believe we have incorrect or out-of-date information about you, you can ask us to update it.
• Your right to delete your data – you can ask us to delete your personal data. However, we may need certain personal details to provide our products and services to you.
• Your right not to provide or change or withdraw consent –we may from time to time ask for your consent to process your personal data. You can choose not to provide such consent or let us know at any time if you change your mind about the consent already provided. However, we may not be able to provide our products and services or engage with you without certain personal data.

We will respond to requests to exercise your personal data rights in line with Applicable Law. We may ask you to verify your identity before processing your request. If you have any questions about your rights, please contact us using the details below.

The following Standard Chartered Group company acts as the body corporate (sometimes known as controller in other jurisdictions) responsible for processing your personal data in India:

We may collect the following types of personal data about you. In this privacy notice, "You" refers to you as an individual, as relevant if you are:

• A visitor to our websites, social media pages, premises or ATMs
• A marketing recipient, for example, where you take part in responding to our surveys, quizzes, invitations to events or webinars
• A sponsorship or donation beneficiary
• A subscriber, where you subscribe to receive our publications, reports and research
• Someone who contacts us for information
• Someone who reports an issue or complaint, for example, via an online form or through email
• A payment transaction beneficiary or remitter; or
• Any other individual who is not a client or related to a client, a recruitment job applicant, a vendor/service provider or a shareholder.

If you give us someone else's personal data, you must have their permission and explain to them how we'll use such personal data as permitted under Applicable Law (as defined hereinafter). We may collect the following types of personal data about you, as relevant and allowed by Applicable Law. The types of personal data may change from time to time as required by Applicable Law:

• Identification data - information that identifies (uniquely or semi uniquely) you. For example, your name, your photographs, CCTV and video recordings of you, building access data to our premises social media profile details and other identifiers, including official/government identifiers such as national identification number, passport number and tax identification number if you make a report, for example, via an online form or through email
• Contact data - information that allows addressing, sending or communicating a message to you. For example, your email address, your phone or mobile number and your residential or business address
• Professional data - information about your educational or professional background, for example, if you make a report via an online form or through email
• Geo-location data - information that provides or contains a device's location. For example, your internet protocol (IP) address or your cookies identifier
• Behavioural data - analytics information that describes your behavioural characteristics relating to your use of our products and services. For example, usual transactional activities, browsing behaviour on our websites and how you interact as a user of our products and services, or those provided by third-party organisations, such as our advertising partners and social media platform providers
• Personal relationship data - information about associations or close connections between individuals or entities that can determine your identity. For example, the agency, company, business or organisation you represent or is related to you
• Communications data - information relating to you contained in voice, messaging, email, live chats and other communications we have with you. For example, via online forms and online subscriptions.

We may sometimes need to collect more sensitive personal data or information about you if you make a report, for example, via an online form or through email, but we only do this if it's necessary and with your consent or where allowed by law. This sensitive personal data (sometimes known as special category personal data in other jurisdictions) may include things like:

• Financial and commercial data - information that identifies your financial history. For example, your bank account number when you are the recipient of a payment by our client, payment instrument details
• Health data - information relating to your health status
• Sexual orientation and gender identity data - information concerning your sex life or sexual orientation
• Criminal convictions, proceedings or allegations data - information about criminal convictions or related information that we identify in relation to our financial crime prevention obligations, for example, details about any criminal convictions or related information. This includes details of offences or alleged offences or convictions.

We usually get your personal data directly from you, but we may also obtain your personal data from other sources as necessary, including from:

• People you know - such as parents or guardians of minors. If you are a minor (normally this means if you are under 18 years old, but this might be younger depending on where you live). We will get your parent or guardian's consent before collecting, using or sharing your personal data
• Businesses and other organisations - such as:
  • The agency, company, business or organisation you represent or is related to you
  • Other financial institutions and financial service providers
• Publicly available resources - such as online registers or directories or online publications, social media posts and other information that is publicly available
• Cookies – when you visit, browse, or use our websites, online banking or mobile applications, we may use cookies to automatically collect certain information from your device. We may use such information, where relevant, for internal analysis and troubleshooting, to recognise you and remember your preferences, to improve the quality of and to personalise our content and to determine the security status of your account. For more information on how we use cookies and how you can control them when visiting our websites, please see our Cookie Policy.

We collect your personal data so that we can manage our relationship with you, respond to your requests, operate our business and provide our products and services.

What we use your personal data for is often referred to as our purposes of processing and these are detailed below. We generally process your personal data with your consent where required by Applicable Law or where otherwise permitted or required by Applicable Law.

We may not be able to offer or provide our products and services if you do not provide us with or do not want us to process the personal data that we consider is necessary and/or is required to meet our legal and regulatory obligations.

Purposes of Processing
The term "Specified Purposes" shall mean the purposes set forth hereunder.] We process your personal data for the following purposes, as necessary:

Operating our business
This includes:

• Engaging in business operational management, such as performing administrative tasks, risk management activities, audits and ensuring operation and security of our communications and processing systems
• Developing, testing and analysing our systems, products and services, for example, to offer a well-functioning website or other applications to users
• Monitoring and recording our communications with you, for example, phone calls, for training and quality purposes
• Effecting transactions and acting on instructions or requests, such as transferring money between accounts and making payments to third parties for clients.
• Enabling an actual or potential assignee of all or any part of our business and/or asset or participant or sub-participant of our rights in respect of the data subject, to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation.

Improving our products and services
This includes:

• Developing, testing and analysing our systems, products and services
• Monitoring and recording our communications with you, for example, phone calls, for training and quality purposes
• Conducting market research
• Conducting demographic analytics and gathering insights by aggregating data such as behavioural data.

Promoting and protecting our brand
This includes:

• Branding and corporate affairs management, creating publications, marketing campaigns and producing advertisements
• Gathering insights by aggregating data from the use of our products and services and our applications, for example, social media listening to identify, assess and discover key
• Social media monitoring to identify our brand mentions to protect our brand and reputation
• Facilitating sponsorship, donations and events.

Getting in touch with you
This includes:

• Sending you requested publications, newsletters, reports and relevant content
• Providing you with information and our range of products and services as requested
• Responding to your reports of wrongdoing and complaints, including whistleblowing.

Complying with Applicable Laws, regulations and other requirements
This includes:

• Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
• Complying with relevant local and foreign law, regulations, rules, directives, judgments or court orders, requests, guidelines, government sanctions, embargo, reporting requirements, restrictions, demands from or agreements with any authority (including domestic or foreign tax authorities), court or tribunal, enforcement agency or exchange body in any relevant jurisdiction where the Standard Chartered Group operates ("Applicable Law")
• Following any voluntary guidelines or recommendations as may be updated from time to time issued by legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.

General Purposes of Processing

The term "General Purposes" shall mean the purposes set forth hereunder. Notwithstanding anything set out hereinabove, your personal data may be processed (including without your consent as permissible under Applicable Law) for the following purposes:

• The performance of any judicial or quasi-judicial or regulatory or supervisory function
• In the interests of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India
• Processing your personal data when you are not within the territory of India pursuant to any contract entered into with any person outside the territory of India
• Necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to you and such processing is carried on in accordance with such standards as may be prescribed under law
• For any specified purpose for which you have voluntarily provided your personal data to us and in respect of which you have not indicated to us that you do not consent to the use of your personal data
• For fulfilling any obligation under any law for the time being in force in India on us to disclose any information to the state or any of its instrumentalities subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force
• For us to comply with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India
• For responding to a medical emergency involving a threat to the life or immediate threat to your health or that of any other individual
• To take measures to ensure health and safety of, or provide assistance or services to, any individual during any epidemic, outbreak of disease, or any other threat to public health
• To take measures to provide medical treatment or health services to any individual during any disaster, or any breakdown of public order
• Where personal data is processed outside the territory of India, if such processing is not in connection with any activity related to offering of goods or services to data principals within the territory of India
• Where your personal data is processed for any purpose where such personal data is made or caused to be made publicly available by yourself or any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available]
• Exercising Standard Chartered Group's legal rights and conducting legal proceedings
  This includes:
  • Tracing and exercising our rights and protecting ourselves against harm to our rights and interests
  • Retaining records as may be necessary as evidence for any potential litigation or investigation
  • Recovering debts and arrears
  • Conducting litigation to enforce our rights or the rights of any other member of the Standard Chartered Group
  • Obtaining professional advice
  • Investigating or making an insurance claim
  • Responding to any insurance related matter, action or proceeding
  • Defending or responding to any current or prospective legal, governmental or quasi-governmental, regulatory, or industry bodies or associations related matter, action or proceeding or for establishing, exercising or defending legal rights.
  • For ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from us]
• Facilitating Standard Chartered Group mergers, acquisitions, and divestments
  This includes:
  • Evaluating our business and providing continuity of services to you after a transfer of our business as a result of a merger, acquisition, sale or divestment
  • Where necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force
• Keeping you and our people safe
  This includes:
  • Conducting identity verification security checks for building access
  • Using CCTV surveillance recordings at our branches, premises and ATMs for the purposes of preventing and detecting fraud and/or other crimes, such as theft
  • Investigating and reporting on incidents or emergencies on our properties and premises
  • For the security of our systems and networks in order to keep your data safe and confidential
  • For other health and safety compliance purposes.
• Detecting, investigating and preventing financial crimes
  This includes:
  • Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
  • Any other use of data and information in accordance with any group-wide programmes for compliance with sanction or prevention or detection of money laundering, terrorist financing or other unlawful activities
  • Monitoring and recording voice and electronic communications and screening applications and transactions in connection with actual or suspected fraud, financial crime or other criminal activities
  • Recording and monitoring voice and electronic communications with us, to the extent permitted by Applicable Law, to ensure compliance with our legal and regulatory obligations and internal policies.]

We may share your personal data within the Standard Chartered Group. Standard Chartered Group may share your personal data for the purposes of processing as set out in this privacy notice, including with our service providers, our business partners, other third parties and as required by Applicable Law or requested by any authority. Who these are depends on your interactions with us as an individual.

We limit how, and with whom, we share your personal data and take steps to ensure your personal data is kept confidential and protected when we share it. We may share your personal data for our purposes of processing with the following, where relevant and allowed by Applicable Law:

• Other members of the Standard Chartered Group
• Authorised third parties
• Any other person you have authorised us by your consent to share your personal data with.
• Third parties that can verify your information
• Fraud prevention agencies and organisations
• Other non-government third parties' that conduct financial crime prevention databases checks to prevent money laundering, terrorism, fraud and other financial crimes.
• Our service partners
• Professional advisers, such as auditors and legal counsel
• Service providers, such as operational, administrative, data processing and other technology service providers, including anyone engaged or partnered with to analyse and facilitate improvements or enhancements in Standard Chartered Group's operations or provision of products and services
• Providers of professional services, such as market researchers, forensic investigators and management consultants
• Other financial services organisations
• Other financial institutions, such as merchant banks, correspondent banks or national banks
• Any financial institution and merchant acquiring company with which you have or propose to have dealings.
• Government authorities and law enforcement
• As required by Applicable Law or as requested by any authority, which includes any government, quasi-government, regulator, administrative, regulatory or supervisory body, court, tribunal, enforcement agency, exchange body or domestic or foreign tax authorities, having jurisdiction over any Standard Chartered Group member, whether within or outside your jurisdiction and whether or not that Standard Chartered Group member has a relationship with you.
• Self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.
• Other third parties
• Any other person under a duty of confidentiality to us, including any other members of the Standard Chartered Group, which has undertaken to keep such information confidential.

Your personal data may be processed, stored, shared, transferred or disclosed by us within the Standard Chartered Group or with other third parties for the purposes described in this privacy notice and as permitted under Applicable Laws. We do this in order to operate effectively, efficiently and securely in facilitating transactions and providing products and services to our clients, to improve and support our processes and business operations and to comply with our legal and regulatory obligations. This may involve processing, storing, sharing, transferring or disclosing your personal data cross border to other jurisdictions.

Where recipients of your personal data are in jurisdictions that are outside India, and local laws may not have similar data protection laws as India, we will take all reasonable steps necessary to ensure that your personal data has an appropriate adequate level of protection and safeguards to comply with Applicable Law.

We take the privacy and security of your personal data very seriously. To protect your data, we use a range of appropriate technical, physical and organisational measures as required under Applicable Law to safeguard your personal data under our control to keep it confidential, for example, by using contracts with appropriate contractual confidentiality, data protection and security terms in our arrangements with third parties. Standard Chartered Group has implemented information security data privacy policies, including incident management and reporting procedures, rules and technical measures to protect personal data and to comply with legal and regulatory requirements. We train and require staff who access your personal data to comply with our data privacy and security standards. We require our service providers, or other third parties we engage with and to whom we disclose your personal data to implement similar confidentiality, data privacy and security standards and measures when they handle, access or process your personal data.

For the purposes described in this privacy notice, we keep your personal data for business operational or legal reasons while you engage with us and may retain your personal data, depending on the type of personal data, in accordance with our data retention policy standards and as required by Applicable Law and regulations. We will delete, anonymise, destroy and/or stop using personal data when we no longer need it or retention thereof, after a period of time, is not permitted by Applicable Law.

We respect your personal data, and you have the following rights about how we use your information:

• Your right to access your data – you have the right to check whether we hold personal data about you, and you can ask us for a copy of such data and information on how we have used it.
• Your right to correct your data – if your personal details have changed, or you believe we have incorrect or out-of-date information about you, you can ask us to update it.
• Your right to delete your data – you can ask us to delete your personal data. However, we may need certain personal details to provide our products and services to you.
• Your right not to provide or change or withdraw consent – we may from time to time ask for your consent to process your personal data. You can choose not to provide such consent or let us know at any time if you change your mind about the consent already provided. However, we may not be able to provide our products and services or engage with you without certain personal data.

We will respond to requests to exercise your personal data rights in line with Applicable Law. We may ask you to verify your identity before processing your request. If you have any questions about your rights, please contact us using the details below.

The following Standard Chartered Group company acts as the body corporate (sometimes known as controller in other jurisdictions) responsible for processing your personal data in India:

We may collect the following types of personal data about you, when you apply for a job with us or are engaged to provide services to us, as relevant and allowed by Applicable Law (as defined hereinafter). The types of personal data may change from time to time as required by Applicable Law. If you give us someone else's personal data, you must have their permission and explain to them how we'll use such personal data as permitted under Applicable Law:

• Identification data - information that identifies (uniquely or semi uniquely) you. For example, your name, your gender, your date of birth, your nationality, your photographs, CCTV and video recordings of you, video, photographic images or audio recordings submitted as part of the recruitment process, and other identifiers, including official/government identifiers such as national identification number, passport number and tax identification number
• Contact data - information that allows addressing, sending or communicating a message to you. For example, your email address, your phone or mobile number and your residential address
• Professional data - information about your educational or professional background. For example, academic background (such as your university or school diplomas/certificates and other educational achievements), current and previous employment details (including salary/bonus and employee benefits scheme), curriculum vitae/resume, professional qualifications, references and work visa
• Geo-location data - information that provides or contains a device's location. For example, your internet protocol (IP) address or your cookies identifier
• Behavioural data - analytics information that describes your behavioural characteristics. For example, results of any pre-employment testing such as psychometric testing
• Personal relationship data - information about associations or close connections between individuals or entities that can determine your identity. For example, politically exposed person, public official, client, close personal or close financial relationships
• Communications data - information relating to you contained in voice, messaging, email and other communications we have with you, for example, via online forms.

We may sometimes need to collect more sensitive personal data or information about you, but we only do this if it's necessary and with your consent or where allowed by Applicable Law. This sensitive data (sometimes known as special category personal data in other jurisdictions) may include things like:

• Financial and commercial data - information that identifies your financial position and background, status and history as necessary. For example, your credit reports, payslips, and other financial information
• Health data - information relating to your health status
• Criminal convictions, proceedings or allegations data - information about criminal convictions or related information that we identify in relation to our financial crime prevention obligations, for example, details about any criminal convictions or related information. This includes details of offences or alleged offences or convictions.

We are committed to providing equal opportunities and fair treatment in employment and recruitment. As part of this, we ask optional demographic questions as part of our application process. These questions are asked for the purposes of furthering those aims, addressing underrepresentation and creating a diverse and inclusive working environment. The answers to these questions are not shared with the hiring manager or relevant decision makers as part of the recruitment process. You have the choice not to answer these questions.

We usually get your personal data directly from you, but we may also obtain your personal data from other sources as necessary, including from:

• People you know - such as:
  • Friends or relatives who have referred you to us
  • Your previous employers
  • Recruitment agencies
  • Other people you appoint to act as your referees
  • Other people you appoint to act on your behalf
• Businesses and other organisations - such as:
  • Your employer and/or company, business or organisation you represent or is related to you
  • Credit reference and fraud prevention agencies
  • Criminal records bureau
  • Standard Chartered career webpage
  • Social network sites, for example LinkedIn, Facebook and Google+
• Publicly available resources - such as online directories, career platforms, publications, social media posts and other information that is publicly available
• Cookies - when you visit, browse, or use our websites, online banking or mobile applications, we may use cookies to automatically collect certain information from your device. We may use such information, where relevant, for internal analysis and troubleshooting, to recognise you and remember your preferences, to improve the quality of and to personalise our content and to determine the security status of your account. For more information on how we use cookies and how you can control them when visiting our websites, please see our Cookie Policy.

Our recruitment activities are generally not aimed at minors (normally this means if you are under 18 years old, but this might be younger depending on where you live). If you are a minor in the relevant jurisdiction, you must obtain the consent of your parents or guardian before contacting us in relation to recruitment.

We collect your personal data so that we can manage our recruitment process and operate our business.

What we use your personal data for is often referred to as our purposes of processing and these are detailed below. We generally process your personal data with your consent where required by law or where otherwise permitted or required by Applicable Law.

We may not be able to proceed with your job application if you choose not to provide us with your consent or subsequently withdraw your consent to process the personal data that we consider is necessary and/or is required to meet our legal and regulatory obligations.

Purposes of Processing
The term "Specified Purposes" shall mean the purposes set forth hereunder. We process your personal data for the following purposes, as necessary:

Assessing and processing your job application
This includes:

• Reviewing your application (which may include interview videos)
• Assessing your skills, qualifications and suitability for the job role or engagement you applied for (including results of psychometric tests)
• Processing your application
• Conducting pre-employment or pre-engagement searches, background checks to verify your identity
• Obtaining references
• Communicating with you in relation to your application. We may also notify you of other potential career opportunities or job vacancies that we think might suit you.

Improving our applicant screening procedures
This includes:

• Engaging in business operational management, such as performing administrative tasks, risk management activities, audits and ensuring operation and security of our communications and processing systems
• Auditing business operations
• Gathering insights by aggregating data from our recruitment process to improve the recruitment process, including the process of screening job applicants.

Complying with Applicable Laws, regulations and other requirements
This includes:

• Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
• Complying with relevant local and foreign law, regulations, rules, directives, judgments or court orders, requests, guidelines, government sanctions, embargo, reporting requirements, restrictions, demands from or agreements with any authority (including domestic or foreign tax authorities), court or tribunal, enforcement agency or exchange body in any relevant jurisdiction where the Standard Chartered Group operates ("Applicable Law")
• Following any voluntary guidelines or recommendations as may be updated from time to time issued by legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.

General Purposes of Processing

The term "General Purposes" shall mean the purposes set forth hereunder. Notwithstanding anything set out hereinabove, your personal data may be processed (including without your consent as permissible under Applicable Law) for the following purposes:

• The performance of any judicial or quasi-judicial or regulatory or supervisory function
• In the interests of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India
• Processing your personal data when you are not within the territory of India pursuant to any contract entered into with any person outside the territory of India
• Necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to you and such processing is carried on in accordance with such standards as may be prescribed under law
• For any specified purpose for which you have voluntarily provided your personal data to us and in respect of which you have not indicated to us that you do not consent to the use of your personal data
• For fulfilling any obligation under any law for the time being in force in India on us to disclose any information to the state or any of its instrumentalities subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force
• For us to comply with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India
• For responding to a medical emergency involving a threat to the life or immediate threat to your health or that of any other individual
• To take measures to ensure health and safety of, or provide assistance or services to, any individual during any epidemic, outbreak of disease, or any other threat to public health
• To take measures to provide medical treatment or health services to any individual during any disaster, or any breakdown of public order
• Where personal data is processed outside the territory of India, if such processing is not in connection with any activity related to offering of goods or services to data principals within the territory of India
• Where your personal data is processed for any purpose where such personal data is made or caused to be made publicly available by yourself any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available
• Exercising Standard Chartered Group's legal rights and conducting legal proceedings
  This includes:
  • Tracing and exercising our rights and protecting ourselves against harm to our rights and interests
  • Retaining records as may be necessary as evidence for any potential litigation or investigation
  • Conducting litigation to enforce our rights or the rights of any other member of the Standard Chartered Group
  • Obtaining professional advice
  • Investigating or making an insurance claim
  • Responding to any insurance related matter, action or proceeding
  • Defending or responding to any current or prospective legal, regulatory, or industry bodies or associations related matter, action or proceeding.
  • For ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from us
• Keeping you and our people safe
  This includes:
  • Conducting identity verification security checks for building access
  • Using CCTV surveillance recordings at our branches, premises and ATMs for the purposes of preventing and detecting fraud and/or other crimes, such as theft
  • Investigating and reporting on incidents or emergencies on our properties and premises
  • For the security of our systems and networks in order to keep your data safe and confidential
  • For other health and safety compliance purposes.
• Detecting, investigating and preventing financial crimes
  This includes
  • Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
  • Conducting pre-employment or engagement identity verification screening, including searches with a credit reference agency, sanctions screening checks and criminal record checks to the extent permitted by Applicable Law
  • Recording and monitoring voice and electronic communications with us, to the extent permitted by applicable law, to ensure compliance with our legal and regulatory obligations and internal policies.

We may share your personal data within the Standard Chartered Group. Standard Chartered Group may share your personal data for the purposes of processing as set out in this privacy notice, including with our service providers, our business partners, other third parties and as required by Applicable Law or requested by any authority. Who these are depends on your interactions with us as an individual.

We limit how, and with whom, we share your personal data and take steps to ensure your personal data is kept confidential and protected when we share it. We may share your personal data for our purposes of processing with the following, where relevant and allowed by Applicable Law:

• Other members of the Standard Chartered Group
• Authorised third parties
• Any other person you have authorised us by your consent to share your personal data with.
• Third parties that can verify your information
  • Ex-employers
  • Credit bureaus or credit reference agencies (including the operator of any centralised database used by credit reference agencies), credit protection providers, rating agencies and fraud prevention agencies and organisations.
• Our service partners
  • Recruitment agencies
  • Professional advisers, such as auditors and legal counsel
  • Insurers or insurance brokers
  • Service providers, such as operational, administrative, data processing and other technology service providers, including anyone engaged or partnered with to analyse and facilitate improvements or enhancements in Standard Chartered Group's operations or provision of products and services
  • Providers of professional services, such as screening and authentication providers, pre-employment health test providers, market researchers and management consultants
• Government authorities and law enforcement
  • As required by law or as requested by any authority, which includes any government, quasi-government, regulator, administrative, regulatory or supervisory body, court, tribunal, enforcement agency, exchange body or domestic or foreign tax authorities, having jurisdiction over any Standard Chartered Group member, whether within or outside your jurisdiction and whether or not that Standard Chartered Group member has a relationship with you
  • Self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.
• Other third parties
  • Third parties in case of a merger, acquisition or divestment: if we transfer (or plan to transfer) or assign any part of our business or assets. If the transaction goes ahead, the interested party may use or disclose your personal information in the same way as set out in this privacy notice, and subsequently notify you of any changes they may make in terms with how they process your personal data

  Any other person under a duty of confidentiality to us, including any other members of the Standard Chartered Group, which has undertaken to keep such information confidential.

Your personal data may be processed, stored, shared, transferred or disclosed by us within the Standard Chartered Group or with other third parties for the purposes described in this privacy notice and as permitted by Applicable Law. We do this in order to improve and support our processes and business operations and to comply with our legal and regulatory obligations. This may involve processing, storing, sharing, transferring or disclosing your personal data cross border to other jurisdictions.

Where recipients of your personal data are in jurisdictions that are outside India, and local laws may not have similar data protection laws as India, we will take all reasonable steps necessary to ensure that your personal data has an appropriate adequate level of protection and safeguards to comply with Applicable Law.

We take the privacy and security of your personal data available with us very seriously. To protect your personal data, we use a range of appropriate technical, physical and organisational measures as required under Applicable Law to safeguard and keep your personal data under our control to keep it confidential, for example, by using contracts with appropriate confidentiality, data protection and security terms in our arrangements with third parties. Standard Chartered Group has implemented information security data privacy policies, including incident management and reporting procedures, rules and technical measures to protect personal data and to comply with legal and regulatory requirements. We train and require staff who access your personal data to comply with our data privacy and security standards. We require our service providers, or other third parties we engage with and to whom we disclose your personal data to implement similar confidentiality, data privacy and security standards and measures when they handle, access or process your personal data.

For the purposes described in this privacy notice, we keep your personal data for business operational or legal reasons while you engage with us and may retain your personal data for a period of time afterwards, depending on the type of personal data, depending on the type of personal data, in accordance with our data retention policy standards and as required by Applicable Law and regulations. We will delete, anonymise, destroy and/or stop using personal data when we no longer need it or retention thereof, after a period of time, is not permitted by Applicable Law.

We respect your personal data, and you have the following rights about how we use your information:

• Your right to access your data - you have the right to check whether we hold personal data about you, and you can ask us for a copy of such data and information on how we have used it.
• Your right to correct your data – if your personal details have changed, or you believe we have incorrect or out-of-date information about you, you can ask us to update it.
• Your right to delete your data – you can ask us to delete your personal data. However, we may need certain personal details to provide our products and services to you.
• Your right not to provide or change or withdraw consent – we may from time to time ask for your consent to process your personal data. You can choose not to provide such consent or let us know at any time if you change your mind about the consent already provided. However, we may not be able to provide our products and services or engage with you without certain personal data.

We will respond to requests to exercise your personal data rights in line with Applicable Law. We may ask you to verify your identity before processing your request. If you have any questions about your rights, please contact us using the details below.

The following Standard Chartered Group company acts as the body corporate (sometimes known as controller in other jurisdictions) responsible for processing your personal data in India:

We may collect the following types of personal data about you. In this privacy notice, "You" refers to you as an individual, as relevant if you are:

• An individual vendor
• A representative of, or an individual related to, an individual vendor or
• A representative of, or an individual related to a company, business or organisation that is our business or corporate vendor.

Personal data we collect with respect to our vendors is primarily limited to the information on directors and officers, other employees, direct and indirect beneficial owners and authorised persons we need to enable us to meet our due diligence obligations, signatory details and contact information of individuals we interact with to enable the provision of products and/or services to the Standard Chartered Group.

If you give us someone else's personal data, you must have their permission and explain to them how we'll use such personal data as permitted under the Applicable Law (as defined hereinafter).

We may collect the following types of personal data about you, as relevant and allowed by Applicable Law. The types of personal data may change from time to time as required by Applicable Law:

• Identification data - information that identifies (uniquely or semi uniquely) you. For example, your name, your photographs, CCTV and video recordings of you, building access data to our premises and other identifiers, including official/government identifiers such as national identification number, passport number and tax identification number
• Contact data - information that allows addressing, sending or communicating a message to you. For example, your email address, your phone or mobile number and your residential or business address
• Professional data - information about your educational or professional background. For example, occupation, title, licenses, and professional memberships, documents evidencing industrial track-record, client testimonials, current and previous employment details, curriculum vitae/resume, professional qualifications, references and work visa
• Geo-location data - information that provides or contains a device's location. For example, your internet protocol (IP) address or your cookies identifier
• Behavioural data - analytics information that describes your behavioural characteristics. For example, browsing behaviour on our websites and how you interact as a user of the products and services or those provided by third-party organisations, such as our advertising partners and social media platform providers
• Personal relationship data - information about associations or close connections between individuals or entities that can determine your identity. For example, the agency, company, business or organisation you represent or is related to you.
• Communications data - information relating to you contained in voice, messaging, email and other communications we have with you.

We may sometimes need to collect more sensitive personal data or information about you, but we only do this if it's necessary and with your consent or where allowed by Applicable Law. This sensitive personal data (sometimes known as special category personal data in other jurisdictions) may include things like:

• Financial and commercial data - information that identifies your financial position and background, status and history. For example, your account details when you are the recipient of a payment by us, your background information, such as your business financial credit report and score and any payment instrument details
• Criminal convictions, proceedings or allegations data - information about criminal convictions or related information that we identify in relation to our financial crime prevention obligations, for example, details about any criminal convictions or related information. This includes details of offences or alleged offences or convictions.

We usually get your personal data directly from you, but we may also obtain your personal data from other sources as necessary, including from:

• People you know - such as such as your colleagues, contractors and associates
• Businesses and other organisations - such as:
  • Your employer and/or company, business or organisation you represent or is related to you
  • Other financial institutions and financial service providers
• Publicly available resources - such as online registers or directories or online publications, social media posts and other information that is publicly available
• Cookies - when you visit, browse, or use our websites, online banking or mobile applications, we may use cookies to automatically collect certain information from your device. We may use such information, where relevant, for internal analysis and troubleshooting, to recognise you and remember your preferences, to improve the quality of and to personalise our content and to determine the security status of your account. For more information on how we use cookies and how you can control them when visiting our websites, please see our Cookie Policy.

We collect your personal data so that we can manage our relationship with you, or the individual, company, business or organisation you represent or is related to, and operate our business.

What we use your personal data for is often referred to as our purposes of processing and these are detailed below. We generally process your personal data including sensitive personal data or information with your consent where required by Applicable Law or where otherwise permitted or required by Applicable Law.

You or the individual, company, business or organisation that you are related to or represent, may not be able to offer or provide products and/or services to us if you do not provide us with or do not want us to process the personal data that we consider is necessary and/or is required to meet our legal and regulatory obligations

Purposes of Processing
We process your personal data for the following purposes, as necessary, depending on whether you provide goods and/or services to us directly or you represent, or are associated with, other individuals, companies, businesses or organisations who provide goods and/or services to us. The term "Specified Purposes" shall mean the purposes set forth hereunder.

Onboarding, managing and monitoring our vendor relationships
This includes:

• Conducting vendor due diligence at onboarding, contract renewal and as required during the contract performance
• Engaging with you as a representative of our vendor/service provider for the purpose of providing goods and/or services to us
• Creating and maintaining our vendor account
• Contacting you
• Monitoring the performance of vendor contracts
• Settling bills and accounts

Operating our business
This includes:

• Engaging in business operational management, such as performing administrative tasks, risk management activities, audits and ensuring operation and security of our communications and processing systems
• Developing, testing and analysing our systems, products and services, for example, to offer a well-functioning website or other applications to users
• Monitoring and recording our communications with you, for example, phone calls, for training and quality purposes.

Complying with Applicable Laws, regulations and other requirements
This includes:

• Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
• Complying with relevant local and foreign law, regulations, rules, directives, judgments or court orders, requests, guidelines, government sanctions, embargo, reporting requirements, restrictions, demands from or agreements with any authority (including domestic or foreign tax authorities), court or tribunal, enforcement agency or exchange body in any relevant jurisdiction where the Standard Chartered Group operates ("Applicable Law")
• Following any voluntary guidelines or recommendations as may be updated from time to time issued by legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.

General Purposes of Processing

The term "General Purposes" shall mean the purposes set forth hereunder. Notwithstanding anything set out hereinabove, your personal data may be processed (including without your consent as permissible under Applicable Law) for the following purposes:

• The performance of any judicial or quasi-judicial or regulatory or supervisory function
• In the interests of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India
• Processing your personal data when you are not within the territory of India pursuant to any contract entered into with any person outside the territory of India
• Necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to you and such processing is carried on in accordance with such standards as may be prescribed under law
• For any specified purpose for which you have voluntarily provided your personal data to us and in respect of which you have not indicated to us that you do not consent to the use of your personal data
• For fulfilling any obligation under any law for the time being in force in India on us to disclose any information to the state or any of its instrumentalities subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force
• For us to comply with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India
• For responding to a medical emergency involving a threat to the life or immediate threat to your health or that of any other individual
• To take measures to ensure health and safety of, or provide assistance or services to, any individual during any epidemic, outbreak of disease, or any other threat to public health
• To take measures to provide medical treatment or health services to any individual during any disaster, or any breakdown of public order
• Where personal data is processed outside the territory of India, if such processing is not in connection with any activity related to offering of goods or services to data principals within the territory of India
• Where your personal data is processed for any purpose where such personal data is made or caused to be made publicly available by yourself any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available
• Where necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force.
• Exercising Standard Chartered Group's legal rights and conducting legal proceedings
  This includes:
  • Tracing and exercising our rights and protecting ourselves against harm to our rights and interests
  • Retaining records as may be necessary as evidence for any potential litigation or investigation
  • Recovering debts and arrears
  • Conducting litigation to enforce our rights or the rights of any other member of the Standard Chartered Group
  • Obtaining professional advice
  • Investigating or making an insurance claim
  • Responding to any insurance related matter, action or proceeding
  • Defending or responding to any current or prospective legal, governmental or quasi-governmental, regulatory, or industry bodies or associations related matter, action or proceeding or for establishing, exercising or defending legal rights.
  • For ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from us
• Keeping you and our people safe
  This includes:
  • Conducting identity verification security checks for building access
  • Using CCTV surveillance recordings at our premises for the purposes of preventing and detecting fraud and/or other crimes, such as theft
  • Investigating and reporting on incidents or emergencies on our properties and premises
  • For the security of our systems and networks in order to keep your data safe and confidential
  • For other health and safety compliance purposes.
• Detecting, investigating and preventing financial crimes
  This includes:
  • Meeting or complying with Standard Chartered Group policies, including identifying individuals and performing investigative procedures, measures or arrangements for sharing data and information within the Standard Chartered Group
  • Any other use of data and information in accordance with any group-wide programmes for compliance with sanction or prevention or detection of money laundering, terrorist financing or other unlawful activities
  • Conducting identity verification security checks against government and other official centralised databases, as required by law
  • Monitoring and recording voice and electronic communications and screening applications and transactions in connection with actual or suspected fraud, financial crime or other criminal activities
  • Recording and monitoring voice and electronic communications with us, to the extent permitted by applicable law, to ensure compliance with our legal and regulatory obligations and internal policies.

We may share your personal data within the Standard Chartered Group. Standard Chartered Group may share your personal data for the purposes of processing as set out in this privacy notice, including with our other service providers, our business partners, other third parties and as required by Applicable Law or requested by any authority. Who these are depends on your interactions with us an individual.

We limit how, and with whom, we share your personal data and take steps to ensure your personal data is kept confidential and protected when we share it. We may share your personal data for our purposes of processing with the following, where relevant and allowed by Applicable Law:

• Other members of the Standard Chartered Group
• Authorised third parties
  • Any other person you have authorised us by your consent to share your personal data with.
• Third parties that can verify your information
  • Credit bureaus or credit reference agencies (including the operator of any centralised database used by credit reference agencies) and fraud prevention agencies and organisations
  • Other non-government third parties' that conduct financial crime prevention databases checks to prevent money laundering, terrorism, fraud and other financial crimes.
• Our service partners
  • Professional advisers, such as auditors and legal counsel
  • Service providers, such as operational, administrative, data processing and other technology service providers, including anyone engaged or partnered with to analyse and facilitate improvements or enhancements in Standard Chartered Group's operations or provision of products and services
  • Providers of professional services, such as market researchers, forensic investigators and management consultants
• Other financial services organisations
  • Other financial institutions, such as merchant banks, correspondent banks or national banks
• Government authorities and law enforcement
  • As required by law or as requested by any authority, which includes any government, quasi-government, regulator, administrative, regulatory or supervisory body, court, tribunal, enforcement agency, exchange body or domestic or foreign tax authorities, having jurisdiction over any Standard Chartered Group member, whether within or outside your jurisdiction and whether or not that Standard Chartered Group member has a relationship with you
  • Self-regulatory or industry bodies or associations of financial services providers in any relevant jurisdiction where the Standard Chartered Group operates.
• Other third parties
  • The individual, company, business or organisation, as applicable, that you represent or is related to you
  • Third parties in case of a merger, acquisition or divestment: if we transfer (or plan to transfer) or assign any part of our business or assets. If the transaction goes ahead, the interested party may use or disclose your personal information in the same way as set out in this privacy notice, and subsequently notify you of any changes they may make in terms with how they process your personal data
  • Any other person under a duty of confidentiality to us, including any other members of the Standard Chartered Group, which has undertaken to keep such information confidential.

Your personal data may be processed, stored, shared, transferred or disclosed by us within the Standard Chartered Group or with other third parties for the purposes described in this privacy notice. We do this in order to operate effectively, efficiently and securely in facilitating transactions and providing products and services to our clients, to improve and support our processes and business operations and to comply with our legal and regulatory obligations. This may involve processing, storing, sharing, transferring or disclosing your personal data cross border to other jurisdictions.

Where recipients of your personal data are in jurisdictions that are outside India, and local laws may not have similar data protection laws as India, we will take all reasonable steps necessary to ensure that your personal data has an appropriate adequate level of protection and safeguards to comply with Applicable Law.

We take the privacy and security of your personal data available with us very seriously. To protect your personal data, we use a range of appropriate technical, physical and organisational measures as required under Applicable Law to safeguard your personal data under our control to keep it confidential, for example, by using contracts with appropriate confidentiality, data protection and security terms in our arrangements with third parties. Standard Chartered Group has implemented information security data privacy policies, including incident management and reporting procedures, rules and technical measures to protect personal data and to comply with legal and regulatory requirements. We train and require staff who access your personal data to comply with our data privacy and security standards. We require our service providers, or other third parties we engage with and to whom we disclose your personal data to implement similar confidentiality, data privacy and security standards and measures when they handle, access or process your personal data.

For the purposes described in this privacy notice, we keep your personal data for business operational or legal reasons while you engage with us and may retain your personal data for a period of time afterwards, depending on the type of personal data, in accordance with our data retention policy standards and as required by Applicable Law and regulations. We will delete, anonymise, destroy and/or stop using personal data when we no longer need it or retention thereof, after a period of time, is not permitted by Applicable Law.

We respect your personal data, and you have the following rights about how we use your information:

• Your right to access your data - you have the right to check whether we hold personal data about you, and you can ask us for a copy of such data and information on how we have used it.
• Your right to correct your data – if your personal details have changed, or you believe we have incorrect or out-of-date information about you, you can ask us to update it.
• Your right to delete your data – you can ask us to delete your personal data. However, we may need certain personal details to provide our products and services to you.
• Your right not to provide or change or withdraw consent – we may from time to time ask for your consent to process your personal data. You can choose not to provide such consent or let us know at any time if you change your mind about the consent already provided. However, we may not be able to provide our products and services or engage with you without certain personal data.

We will respond to requests to exercise your personal data rights in line with applicable law. We may ask you to verify your identity before processing your request. If you have any questions about your rights, please contact us using the details below.

The following Standard Chartered Group company acts as the body corporate (sometimes known as controller in other jurisdictions) responsible for processing your personal data in India: