1. About Us — Shakti Enterprises

Shakti Enterprises (hereinafter referred to as "the Company", "we", "us", or "our") is a privately held multi-site manufacturing and distribution enterprise headquartered in India. We design, manufacture, and supply precision-engineered components and assemblies to Original Equipment Manufacturers (OEMs) across the automotive, industrial, and allied sectors.

This Privacy Policy applies to all natural persons ("Data Principals") whose personal data is collected, received, stored, or processed by Shakti Enterprises in connection with its website(s), vendor/customer portals, employee/contractor management systems, and all other digital and physical touchpoints operated by the Company.

2. Scope and Applicability

This Policy applies to the following categories of individuals whose personal data Shakti Enterprises may process:

• Website visitors and enquiry form submitters
• Prospective and existing vendors, suppliers, and sub-contractors
• OEM customers, procurement managers, and authorised representatives
• Employees, workers (permanent and contractual), and trainees across all facilities
• Contractor company representatives (including PF/ESIC registered personnel)
• Logistics partners, freight forwarders, and transporter contacts
• Any other individual whose personal data is submitted to the Company in the ordinary course of business

This Policy does not apply to aggregated or anonymised data that cannot identify an individual, nor to third-party websites linked from our platforms.

3. Categories of Personal Data Collected

3.1 Data You Provide Directly

3.2 Data Collected Automatically (Website & Portals)

• IP address, browser type, device identifiers
• Pages visited, time spent, clickstream data
• Cookies and similar tracking technologies (see Section 10)
• Login timestamps and session metadata on our vendor/customer portal

3.3 Data Received from Third Parties

• Credit/trade reference checks from authorised commercial databases
• PF/ESIC data from contractor payroll submissions
• OEM-mandated supplier qualification data from procurement platforms (e.g., MACE, supplier portals)

4. Purposes of Processing

Shakti Enterprises processes personal data for the following lawful purposes:

5. Sensitive Personal Data or Information (SPDI)

Shakti Enterprises collects the following categories of Sensitive Personal Data or Information (SPDI) as defined under Rule 3 of the IT (SPDI) Rules, 2011:

• Financial information (bank account, payment card details) — collected only for vendor/employee payment processing
• Biometric data (fingerprint/iris scans for attendance) — collected only at manufacturing facilities with prior written consent
• Aadhaar-linked data — collected only to the extent mandated by applicable law (PF/ESIC registration); full Aadhaar numbers are masked in storage

SPDI is collected only after obtaining express written consent. You may withdraw consent at any time; however, withdrawal may affect our ability to fulfil contractual or statutory obligations.

6. Disclosure and Sharing of Personal Data

We do not sell, rent, or trade personal data. Personal data may be shared on a need-to-know basis with:

All third-party processors are required to maintain equivalent data protection standards through contractual obligations.

7. Data Retention

Shakti Enterprises retains personal data only as long as necessary for the purpose for which it was collected, or as required by applicable law:

8. Data Security

Shakti Enterprises has implemented reasonable security practices and procedures as required under Rule 8 of the IT (SPDI) Rules, 2011 and the DPDPA 2023. Our security measures include:

8.1 Technical Measures

• Encrypted data transmission (SSL/TLS) for all web-based data collection
• Password-protected and role-based access controls for ERP/HR systems
• Firewall protection and intrusion detection on servers
• Regular data backups with off-site/cloud storage
• Anti-malware and endpoint security on all company devices

8.2 Organisational Measures

• Access to personal data restricted to authorised personnel on a need-to-know basis
• Confidentiality obligations included in all employment and vendor contracts
• Regular training for staff handling personal data
• Incident response procedures for data breaches

8.3 Data Breach Response

In the event of a personal data breach that is likely to cause harm to individuals, Shakti Enterprises will notify affected Data Principals and the Data Protection Board of India (once operationalised) in accordance with the DPDPA 2023 within the prescribed timeframe.

9. Rights of Data Principals

Under the Digital Personal Data Protection Act, 2023 and applicable IT Rules, you have the following rights regarding your personal data:

To exercise any of the above rights, please submit a written request to info@shaktienterprises.in. We will acknowledge receipt within 72 hours and resolve the request within 30 days.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. By continuing to browse our website, you consent to the use of cookies in accordance with this Policy.

You may manage or disable cookies through your browser settings. Disabling strictly necessary cookies may affect website functionality.

11. Grievance Officer (Mandatory — IT Rules 2011, Rule 5(9))

In accordance with Rule 5(9) of the IT (SPDI) Rules, 2011, Shakti Enterprises has designated a Grievance Officer to address complaints and concerns regarding the processing of personal data:

If your grievance is not resolved to your satisfaction by the Grievance Officer, you may escalate the matter to the Data Protection Board of India (once constituted under the DPDPA 2023).

12. Cross-Border Data Transfers

Shakti Enterprises processes and stores personal data primarily within India. In cases where personal data is shared with OEM customers, technology vendors, or logistics partners located outside India (e.g., for global supplier portals or cloud-based ERP systems), we ensure that such transfers are carried out in compliance with applicable Indian law, including any data localisation requirements under the DPDPA 2023 and notified regulations.

13. Children's Data

Our website and business services are directed exclusively at adults (18 years and above) operating in a professional B2B capacity. We do not knowingly collect personal data from individuals below the age of 18. If we become aware that personal data of a minor has been inadvertently collected, we will promptly delete such data.

14. Changes to This Privacy Policy

Shakti Enterprises reserves the right to update this Privacy Policy periodically to reflect changes in applicable law, our business operations, or data processing practices.

The revised Policy will be posted on our website with an updated "Last Updated" date.

For material changes, we will notify registered vendors and customers via email.

Continued use of our website or services after notification constitutes acceptance of the revised Policy.

15. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Republic of India, including the Information Technology Act, 2000 (as amended), the IT (SPDI) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

Any disputes arising out of or relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts located in Mumbai, Maharashtra, India.