Privacy Notice

At Nagarro, we recognize the importance of your personal privacy and are committed to safeguarding it. Our Global Privacy Notice provides comprehensive details on how Nagarro and its group companies ("Nagarro," "we") process your personal data and outlines your rights concerning this processing. This Privacy Notice applies to all Nagarro entities and their business operations.

We adhere to the highest standards of data protection and comply with all relevant data protection laws. For information specific to certain jurisdictions with unique requirements, please refer to the relevant section of our Privacy Notice.

This policy covers various categories of data subjects, including employees, website visitors, suppliers, and other individuals whose personal data we process, depending on our role and the context of the processing. Depending on your relationship with us, you may find more detailed information about the purpose of data processing and the legal basis in the specific sections below.

Our Global Privacy Statement describes Nagarro’s practices regarding the collection and use of your personal data and outlines your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will, from time to time, update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.

At Nagarro, safeguarding the security and privacy of the data entrusted to us by our clients is paramount. We understand our role as a data processor and we are committed to adhering to all applicable data privacy laws, as stipulated in our Data Protection Agreements (DPA) or other contractual documents with our clients.

Personal data provided by our clients will be retained only for the duration specified by our clients (Data controller). Nagarro may engage its group companies or third parties, for which we assume responsibility for ensuring compliance with data protection standards and regulations. In cases where cross-border data transfers are necessary, Nagarro commits to implementing additional technical and contractual safeguards as required by applicable laws and agreements.

2.1.Categories of the personal data

Depending on the services contracted with our client(s), the types of personal data processed may vary according to the nature and scope of the services provided. In some instances, this may also involve processing sensitive personal information.

2.1. Purpose of personal data processing

Nagarro may process personal data only to fulfill the purpose of the contracted services in accordance with our contractual document and data processing agreement. Nagarro undertakes not to use personal data for any purposes beyond those agreed upon for the provision of contracted services.

2.2. Legal basis of processing

Nagarro may process the information based on the legal basis of performance of contract for the sole purpose of providing the contracted services. Nagarro shall enter into a data processing agreement with the client, as mandated by applicable laws.

At Nagarro, we are committed to protecting the privacy of our employees, consultants and contractors. Nagarro maintains a separate privacy notice for employees which is provided at the time of onboarding. We encourage all our employees to refer to the Global Privacy Notice - Employee available on our intranet site.

This Privacy Notice provides our colleagues with clear, concise, and easy-to-read information about Nagarro and its group companies’ privacy practices and how we collect, use, process, and transfer personal data. We also maintain a separate privacy notice for job applicants which is provided at the time of registration and/or applying for a job. For details, you may refer to the Applicant Privacy Notice.

3.1. Categories of the Personal data processed

Nagarro collect personal data directly from the individual at the time of applying for the job, before releasing the employment offer, at the time of onboarding, and during the course of employment. We may collect or process (or may have collected or processed in the proceeding 12 months) the following categories of personal data.

• Identify and contact information
• Education information
• Employment information
• Skill and performance information
• Passport and Visa information, as and when required for travel purposes
• Biometric information, where applicable for the access management
• Financial information such as Bank, Salary, Loan, Tax, Investment and Insurance
• Health information such as Medical reports and Sick leaves etc.

Kindly note that the type of personal data collected may vary depending on the jurisdiction where you have been hired. Nagarro may also be required to process sensitive personal information in certain jurisdictions depending on the local regulatory requirements.

3.2. Purpose of personal data processing

Nagarro may be required to process the data for the following purposes:

• The purposes of employment (payroll, employee training, maintenance of employee records)
• safeguarding the employer from liability (implementing security measures such as access controls, encryption and user authentication, or conducting security audits on our IT system)
• providing benefits to the employee (such as gratuity, traveling, Work permits/Visa, provident fund, healthcare benefits, insurance coverage, or wellness programs)

3.3. Legal basis of processing

Nagarro may process the data for the following legal basis :

• Performance of a Contract – Nagarro may process your Personal Information when it is necessary for the performance of a contract to which you are the party or in order to take steps at your request prior to entering into a contract.
• Legitimate interest - Nagarro may use this legal basis to manage employment processes
• Consent - Nagarro may be required to seek explicit consent from an employee when the processing does not fall under the legitimate use and other legal basis.
• Legal Obligation – Nagarro may process your personal information to comply with any applicable Legal obligations

We process personal data about our suppliers (including subcontractors, and individuals associated with our suppliers and contractors) to manage our relationship and contract and to receive services from our suppliers. The Nagarro legal entity with which you have contracted acts as the Data Controller. As applicable, some Nagarro Affiliates might act as Data Processors or Data Sub-Processors.

4.1. Categories of the Personal data processed

Nagarro may collect your personal data directly from the Supplier at or before the time of Vendor registration and financial transaction. We may collect or process (or may have collected or processed in the proceeding 12 months) the following categories of personal data

• Contact information
• Billing and payment related information

4.2. Purpose of personal data processing

We process your personal data for various payment and administrative purposes essential to our operations. This includes managing contractual relationships effectively and ensuring compliance with relevant regulatory requirements. Additionally, we conduct due diligence procedures prior to onboarding new suppliers to maintain the integrity and security of our business relationships. These processes are designed to safeguard both your interests and ours, ensuring that all interactions involving personal data are conducted transparently and in accordance with applicable legal standards.

4.3. Legal basis of processing

Nagarro may process the data for the following legal basis:

• Performance of a contract - Nagarro may process your Personal Information when it is necessary for the performance of a contract to which you are the party or in order to take steps at your request prior to entering into a contract.
• Legal Obligation – Nagarro may process your personal information to comply with any applicable Legal obligations
• Legitimate interest - Nagarro may use this legal basis to manage supplier processes

When you visit our offices, we process your personal data to identify you and authorize your access to our premises and maintain security of our premises and prevent any unauthorized access or impersonation by malicious individuals.

5.1. Categories Personal data processed

Nagarro may collect your personal data directly when you visit our offices. We make every practical effort to avoid excessive or irrelevant collection of data, however, the following information is being collected:

• Contact Information - Name, Mobile number, Signature, Email.
• Identification – Business card or Govt. issue iD card for verification
• Device - Device Identification numbers if you are carrying a device
• Photo and Video - for access ID card, CCTV recording at reception

Kindly note that the type of personal data collected may or may not apply depending on the jurisdiction where you are visiting.

5.2. Purpose of personal data processing

We use your personal data solely for the purposes specified below and will not use it for any other purposes:

• To identify you and authorize your access to our premises.
• To maintain the security of our premises and prevent any unauthorized access or impersonation by malicious individuals.

5.3. Legal basis of processing

Nagarro may process the data for the following legal basis:

• Legitimate interest - Nagarro may use this legal basis to protect our offices from unauthorized access and maintain the security of the premises.
• Legal Obligation – Nagarro may use this legal basis in certain circumstances, as per the local jurisdiction requirements for preventing and detecting crime.

Nagarro collects personal data at its websites in two ways: (1) directly (for example, when you provide personal data to sign up for a newsletter or register on website); and (2) indirectly (for example, through our website's technology such as cookies and web beacons).

6.1. Categories of the Personal data processed

Nagarro may collect your personal data directly from the website visits and some information will be collected automatically. Nagarro may use, store, and track your personal data within our Customer Relationship System (CRM)/Content Management System (CMS) to effectively manage our website operations.

We may collect or process (or may have collected or processed in the proceeding 12 months) the following categories of personal data.

• Contact Information - The information provided by you directly via the contact form
• Diagnostic information – The information is automatically collected from your device by the website such as internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system
• Usage information - The information about the use of Nagarro’s website, including history of the pages you view, browsing time, navigation behavior, click tracking, and resources you access or download
• Interaction information: provided by you such as any query, form submissions, survey, comment or upload any content on our website.
• Preference Information: User-provided preferences for receiving communications about our activities, publications, and details about how you engage with our communications.

We are dedicated to protecting your privacy and want to assure you that our website does not intentionally collect sensitive personal information. Sensitive personal information includes data such as your ethnic origin or race, marital status, political opinions or affiliations, ideological views or activities, trade union membership, religious beliefs, physical or mental health, genetic or biometric information, sexual orientation, social security details, or information about administrative or criminal proceedings. To ensure your privacy, we advise that you refrain from providing any of this sensitive personal information through our website.

6.2. Purpose of personal data processing

We use your personal data solely for the purposes specified below and will not use it for any other purposes to

• Identify you once you register on our website and to provide better usability, troubleshooting and site maintenance
• Enable marketing and sales related communications and related purposes
• Offer curated content tailored to your preferences
• Know your interest in participating in marketing and promotional events
• Facilitate communication with you, including contacting you and responding to your queries or requests

6.3. Legal basis of processing

The applicable privacy and data protection laws provide for certain justifiable grounds for collection and processing of personal data, commonly referred to as legal basis of processing. We primarily rely on the following legal bases:

• Consent - Nagarro may need to obtain your explicit consent for processing your data when it does not fall under legitimate interests or other legal bases. You have the right to withdraw your consent at any time. To do so, you can click the "Unsubscribe" link, update your preferences, or contact our global data privacy team at globalprivacy@nagarro.com.
• Legitimate interest- Nagarro may use this legal basis to administer usage of our website and your interaction with the website.

6.4. Children’s Privacy

Nagarro website is not intended for children under eighteen (18) years. We do not knowingly collect, disclose, or otherwise process the personal data of children under 18 years of age through our website.

6.5. Transfer of personal data to third parties

Your data collected on the website is stored on HubSpot servers hosted in the EU region. For more details, you can read HubSpot’s privacy policy here.

6.6. Cookies

To enhance your experience on our website, we may use cookies. A cookie banner is displayed to inform you that cookies may be stored on your device.

Cookies are small pieces of data that a website sends to your computer’s web browser while you are navigating through it. Cookies serve many purposes, but mainly, they enable you to navigate between pages easily, remember your preferences, and eventually improve user experience. These cookies stored on your machine can also help identify your computer. Cookies used on this website can be either set up by our website or by a third-party website. Moreover, these cookies can be “session” or “persistent” cookies: a session cookie is a cookie that is automatically deleted when the user closes the browser, whereas a persistent cookie is a cookie that remains stored in the user’s terminal device until it reaches a defined expiration date.

Nagarro also use cookies to improve the quality of our service, including logging in, storing your preferences, and tracking your web page visits and actions. Kindly note that Nagarro does not currently respond to Do Not Track (DNT) signals from your web browser.

For more details on tracking technology, please visit Cookie Policy.

6.7. Third-party websites

Our websites may include links to third-party websites for your convenience and information. Nagarro does not endorse, control, or make any representations or warranties about those third-party sites, which may have their privacy policies and practices.

Nagarro encourages you to review the privacy policies of any third-party site before providing any personal information.

Nagarro may send you sales and marketing emails to develop or maintain a business relationship in accordance with applicable marketing laws. Our targeted e-mail messages typically include web beacons, cookies, and similar technologies that allow us to know whether you open, read, and click on any links. Based on your interactions with our website, you may receive targeted advertisements from Nagarro on platforms such as LinkedIn, Twitter, Facebook, and Google. We tailor these ads to match your interests and preferences, ensuring relevant content.

7.1 Categories of Personal Data

We may collect or process (or may have collected or processed in the past 12 months) the following categories of personal data:

• Contact Information: Includes details such as your name, email address, phone number, city, country, social media profiles
• Job profile information: includes company name, designation, industry, job function, area of Interest
• Preference Information: Includes your preferences for receiving communications from us
• Interaction Data: includes records of your interactions with us, such as website activities, form submissions, responses to surveys and questionnaires, email engagement such as opens or link clicks, and other personal engagements with Nagarro.

7.2. Sources of Personal Data

We may collect personal data directly or indirectly through the following means:

Direct Engagement:

• Individuals contacted directly for marketing our services
• Individuals who work with our clients (current, former) or potential leads
• Individuals who contact us through our website for services
• Individuals who subscribe to our marketing materials and communication
• Individuals who registered or expressed interest in our marketing campaigns
• Individuals who attended events where Nagarro is present

Public Sources and Social Media

Individuals identified through public sources or social media platforms

Third-Party Providers

Personal data is sourced from third-party providers such as Cognism and ZoomInfo. Please note that these third parties are responsible for the legitimacy of the data collection practices.

7.3. Purpose of personal data processing

Nagarro may use, store, and track your personal data within our Customer Relationship Management (CRM) database to effectively manage and optimize our marketing initiatives.

To enhance our marketing campaigns, Nagarro may share your marketing contact details with our affiliates, partners, and third-party marketing agencies.

Your personal data may be transferred outside of your country of residence. Rest assured, Nagarro will implement appropriate safeguards to ensure that your data is protected in accordance with applicable data protection laws.

7.4. Legal basis of processing

We primarily rely on the following legal bases:

• Consent: In certain jurisdictions, we may seek your explicit consent before using your personal data for marketing activities. You have the right to withdraw your consent at any time. To do so, you can click the "Unsubscribe" link,
• Legitimate interest: Nagarro may process your personal data for legitimate use to support and enhance our marketing activities to improve our services and offerings.

If you prefer not to receive marketing communications, you can easily opt-out by clicking the “Unsubscribe” link in any marketing email we send you. You can also update your preferences. Once you have submitted a request to opt out, we will cease processing your personal data for marketing purposes.

Nagarro may engage third parties as processor for certain data processing tasks, but this does not diminish our responsibility to ensure privacy compliance. Nagarro remains fully accountable for the actions of any processor acting on its behalf. Nagarro ensures that a data processing agreement is in place with processors, which mandates adequate privacy and security measures to protect personal data and address data subject requests.

In addition, Nagarro has implemented appropriate safeguards when transferring personal data to jurisdictions that do not provide equivalent data protection as required by the applicable laws. These safeguards help maintain robust data protection standards and ensure compliance with relevant regulations.

Nagarro has a data-sharing framework that facilitates data transfer between the Nagarro group companies. Nagarro does not sell or share your Personal Information with third parties for their direct marketing purposes.

Nagarro has a well-established privacy program designed to comply with applicable privacy laws and implement effective privacy controls. The privacy program includes establishing and maintaining data privacy framework, conducting Data Protection Impact Assessments (DPIAs), managing Data Subject Rights, and providing comprehensive Data Privacy Training.

Nagarro employs comprehensive security controls, encompassing administrative, physical, and technical measures, to safeguard your personal information. Nagarro’s ISMS is ISO 27001:2022 certified, demonstrating adherence to the highest standards of information security. Nagarro’s practices are designed to meet its clients’ security controls and industry standards for data security and privacy, ensuring robust protection of your personal data.

Personal data will not be retained for longer than necessary to fulfill the purposes described in this privacy notice, unless a longer retention period is mandated by law or for legitimate business reasons. Once personal data is no longer required for legal or business purposes, it will be securely disposed of to ensure its protection.

Subject to the laws of your country, you may have certain rights as a data subject including but not limited to right to information, access, rectification, erasure, object, restriction of processing, right to lodge a complaint with a supervisory authority, relating to your personal data that we process.

You can raise any concerns regarding the processing of your personal data by contacting us at dpo@nagarro.com. To help protect your privacy and security, Nagarro will take reasonable steps to verify your identity before taking steps to execute your rights e.g. access to your personal data. When Nagarro receives your request, Nagarro will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests, as may be required by applicable law.

Depending upon the circumstances and the request, Nagarro may not be permitted to provide access to personal data or otherwise fully comply with your request. Nagarro reserves the right to charge an appropriate fee for complying with your request where allowed by applicable law, and/ or to deny your requests in case your request is unfounded, excessive or otherwise unacceptable under applicable law.

Nagarro is committed to complying with the strictest data protection laws applicable in each jurisdiction where we operate or conduct business with clients. If you are a resident of California, this section of our policy applies to you (in addition to the Nagarro Global Privacy Notice) under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). 

For purposes of this section "Personal Information", “Business”, and “Consumer” has the meaning given in the California Consumer Privacy Act (“CCPA”). For California consumers, the CCPA requires businesses to disclose about Personal Information processing and their rights such as:

Don’t Sell and share Personal information
Nagarro does not sell Personal Information, however, we may share Personal Information with authorized service providers or business partners who are bound by contractual limitations regarding their retention, use, and disclosure of such Personal Information. Nagarro may share your Personal Information within Nagarro or with any of its affiliates, Business partners, Service providers; Auditors, and government authorities, where applicable.

Kindly note that Nagarro does not offer any financial incentives, price, or service differences in exchange for personal information. Therefore, we are not required to provide a Notice of Financial Incentive under the CCPA/CPRA.

Limit use and disclosure of sensitive information, Alternative Opt-out
Nagarro values your privacy and does not collect California residents' sensitive personal data unless necessary.. To exercise your data subject rights, including limiting the use and disclosure of sensitive information or opting out, please reach out at dpo@nagarro.com.

Right to non-discrimination
Nagarro is committed to protecting your privacy rights under the California Consumer Privacy Act (CCPA). We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you goods or services, charge you different prices or rates, or provide a different level or quality of goods or services as a result of exercising your rights under the CCPA.

If you are a resident of California and you wish to exercise your data subject rights as called out above, please refer to section "Your Data Privacy Rights."