Privacy Policy

Pion Global Private Limited ("Pion Global", "we", "our" or "us") is a technology, consulting and engineering company. This Policy applies to personal data processed by Pion Global in connection with its corporate website, platform websites and Enterprise Ecosystem website, including www.pionglobal.com, www.grcnest.ai, www.nexgenqe.com, www.dpdpaconsent.in and www.piedap.io, as well as business development, client and partner interactions, events, marketing communications, support interactions, recruitment and other direct interactions with Pion Global.

The platforms and the PIEDAP Enterprise Ecosystem may maintain platform-specific or ecosystem-specific Privacy Policies, Data Processing Agreements, Acceptable Use Policies, security terms or other legal notices. Those documents govern the relevant platform, ecosystem or service processing. For Customer Personal Data, a signed customer agreement and applicable Data Processing Agreement take precedence to the extent of any inconsistency.

This corporate Privacy Policy continues to govern Pion Global's independent processing of website visitor, business contact, marketing, account-administration, recruitment and similar data unless a more specific notice applies.

This Policy is designed to support compliance with applicable privacy and data-protection laws, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as relevant provisions come into force, the EU General Data Protection Regulation (GDPR), the UK GDPR and related laws where applicable, and other applicable privacy laws.

2.1 When Pion Global determines the purpose and means of processing
For our corporate website, platform websites, Enterprise Ecosystem website, direct business relationships, marketing, events, recruitment, account administration and similar activities, Pion Global generally acts as the Data Fiduciary under Indian law and as the controller under the GDPR / UK GDPR or comparable privacy laws. This can include business contact, website-usage, security, account-administration and marketing data collected across pionglobal.com, grcnest.ai, nexgenqe.com, dpdpaconsent.in and piedap.io.

2.2 When we process data for a client
When Pion Global processes Customer Personal Data on behalf of an enterprise client through GRCNest, NexGenQE, Talenaise, the Consent Management Platforms, the PIEDAP Enterprise Ecosystem or a contracted service, Pion Global may act as a Data Processor / processor / service provider. In those circumstances, the client determines the purposes and instructions for processing, and the applicable customer agreement, platform-specific or ecosystem-specific privacy terms and Data Processing Agreement govern our handling of that data.

The categories of personal data we collect depend on how you interact with Pion Global. They may include:

Contact and identity information: name, business email address, telephone number, country, and other contact details you provide.

Professional and business information: employer, job title, department, seniority, business role, professional profile information, and company-related information.

Inquiry and commercial information: information submitted through contact forms, demo requests, proposals, project requirements, business needs, budget or procurement information, and communications with us.

Account and authentication information: usernames, authentication information and account-related records where a Pion Global-operated service provides user accounts.

Website, device and technical information: IP address, device type, browser type, operating system, referring URL, date and time of access, and security or diagnostic logs.

Usage and interaction information: pages viewed, navigation activity, interactions with website features, campaign or referral information, and similar analytics data where permitted.

Support and service information: support requests, service communications, issue details, meeting notes and information needed to deliver or support agreed services.

Recruitment information: CV or résumé, employment history, education, skills, interview information, compensation expectations, references and other information you choose to provide during recruitment.

Public and third-party business information: professional information obtained from company websites, professional networks, business directories, event providers, referral partners or other lawful business-information sources.

Sensitive or Special-Category Information
Pion Global does not intentionally request sensitive personal data through general website forms. Where sensitive or special-category information is necessary for recruitment, employment, legal compliance, accessibility, security or another legitimate purpose, we will process it only where permitted by applicable law and with appropriate safeguards.

• Directly from you when you complete a form, request a demo, contact us, subscribe to communications, attend an event, enter into a business relationship, submit a support request or apply for a role.

• Automatically when you use our websites or online services, through server logs, cookies and similar technologies, subject to applicable consent requirements.

• From your employer or organisation where you are a business contact, authorised user, project stakeholder or representative.

• From publicly available or permitted third-party business sources, including professional networks, company websites, directories, event organisers and business-information providers.

• From clients and partners where they lawfully provide information needed for contracted services or collaboration.

India
Where the Digital Personal Data Protection Act, 2023 applies, Pion Global will process personal data on the basis of valid consent or another basis / legitimate use permitted by applicable law. Where consent is relied upon, it will be sought through clear notice and may be withdrawn using the methods we make available, subject to lawful retention or processing requirements.

European Economic Area and United Kingdom
Where the GDPR or UK GDPR applies, our legal basis may include:

• Consent, where you have given a valid choice for a specific purpose.
• Performance of a contract or steps taken at your request before entering into a contract.
• Compliance with a legal obligation.
• Legitimate interests, such as operating and securing our business, responding to B2B inquiries, improving services and managing professional relationships, where those interests are not overridden by your rights and interests.

Other Jurisdictions
Where another privacy law applies, we rely on the lawful basis or permission available under that law and provide any additional notices or choices required for the relevant processing.

Pion Global may use business contact information to communicate about platforms, services, events, insights and related business topics where permitted by applicable law. Marketing communications will include an unsubscribe or opt-out mechanism where required. You may also ask us to stop marketing communications at any time by contacting us.

We may use professional information obtained from public or permitted third-party business sources for B2B relationship development, subject to applicable privacy and electronic-marketing laws.

We do not sell personal data for monetary consideration.

Pion Global websites, including pionglobal.com, grcnest.ai, nexgenqe.com, dpdpaconsent.in and piedap.io, may use cookies, pixels, local storage and similar technologies for security, essential functionality, preferences, analytics and, where enabled, marketing or campaign measurement. Cookie use can differ by site or platform.

Strictly necessary technologies may operate without consent where permitted; non-essential technologies are used only after obtaining consent where applicable.

• Essential cookies: support security, session management, load balancing and core website functionality.
• Analytics cookies: help us understand website performance and how visitors use pages and features.
• Functional cookies: remember preferences or enable enhanced functionality.
• Advertising or campaign technologies: where used, support campaign measurement or relevant business communications and are controlled through applicable consent choices.

You can manage available choices through our cookie banner or Cookie Preferences control where provided. Browser settings may also allow you to block or delete cookies, although some website functions may be affected.

We may disclose personal data only where reasonably necessary and lawful, including to:

Where you interact with more than one Pion Global website or platform, including GRCNest, NexGenQE, Talenaise, the Consent Management Platforms, or the PIEDAP Enterprise Ecosystem, Pion Global may associate relevant business-contact, account, support or relationship information across those properties where necessary to administer your relationship, provide requested services, maintain security or support a consistent customer experience, subject to applicable law and platform-specific or ecosystem-specific contractual restrictions.

• Service providers and processors that support hosting, cloud services, security, analytics, CRM, communications, collaboration, recruitment, customer support and other business operations.
• Professional advisers such as legal counsel, auditors, accountants, insurers and consultants.
• Affiliates or group entities, where applicable, for legitimate internal business purposes and subject to appropriate safeguards.
• Clients, partners or implementation participants where disclosure is necessary for an agreed project, service or business relationship and is permitted by law.
• Government bodies, regulators, courts, law-enforcement agencies or other authorities where disclosure is legally required or reasonably necessary to protect rights, safety or security.
• Potential buyers, investors or transaction advisers in connection with a merger, acquisition, financing, restructuring or sale of all or part of a business, subject to appropriate confidentiality safeguards.

We require service providers that process personal data on our behalf to handle it under appropriate contractual, confidentiality and security obligations.

Pion Global operates in a global business environment and may use service providers or work with clients and partners in multiple countries. As a result, personal data may be processed outside the country in which it was collected.

Where international transfer restrictions apply, we use appropriate legal and contractual safeguards, which may include adequacy mechanisms, standard contractual clauses, contractual data-protection commitments, transfer assessments or other lawful safeguards.

Transfers from India will be subject to any applicable requirements or restrictions prescribed under Indian law.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to maintain appropriate business and security records, or to satisfy contractual, legal, regulatory, accounting or dispute-resolution requirements.

• Client and business records: generally retained for the duration of the relationship and for an appropriate period afterward to meet legal, audit, tax, contractual or dispute-resolution needs.
• Website and security logs: retained for periods appropriate to security, diagnostics, legal requirements and incident investigation.
• Marketing records: retained while there is an active business relationship or relevant marketing purpose, together with suppression records needed to honour opt-out requests.
• Recruitment records: generally retained for up to 12 months after the relevant recruitment process unless a longer period is required by law or you agree to longer consideration for future opportunities.
• Data processed for clients: retained and deleted or returned in accordance with the applicable customer agreement, documented instructions and legal requirements.

When personal data is no longer required, we take reasonable steps to delete, anonymise or securely dispose of it, subject to lawful retention obligations.

Pion Global applies reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss or misuse. Depending on the systems and risks involved, safeguards may include:

• Encryption, masking, tokenization or other data-protection techniques where appropriate.
• Role-based access controls, authentication controls and least-privileged practices.
• Logging, monitoring and reviewing to support detection and investigation of unauthorised activity.
• Backup, resilience, continuity and recovery measures.
• Vulnerability management, security testing and remediation processes appropriate to the environment.
• Security and confidentiality obligations for personnel and service providers.
• Data-protection and security awareness measures for relevant employees.

No internet transmission or information system can be guaranteed to be completely secure. We therefore continuously assess and improve safeguards in proportion to the nature and risk of the processing.

If Pion Global becomes aware of a personal data breach, we will assess, contain, investigate and remediate the incident in accordance with our incident-response processes. Where required by applicable law, we will notify affected individuals and the appropriate regulator or authority within the required timeframe and provide relevant information about the incident and protective steps.

Pion Global develops and uses AI-enabled technologies. In our own corporate operations, we may use automated or AI-assisted tools to support analytics, security, inquiry routing, service improvement, workflow automation or recruitment administration. Such tools are intended to assist business processes and human decision-making.

We do not intend to make solely automated decisions about website visitors or business contacts that produce legal or similarly significant effects unless we provide a specific notice, lawful basis and safeguards required by applicable law.

Your rights depend on your location and the law that applies to the relevant processing. Subject to applicable conditions and exemptions, you may have the following rights.

15.1 India
• Request information about personal data processed by Pion Global and certain information about processing, where applicable.
• Request correction, completion, updating or erasure of personal data.
• Withdraw consent where processing is based on consent, without affecting processing that was lawful before withdrawal.
• Use Pion Global's grievance-redressal mechanism for privacy concerns.
• Nominate another individual to exercise applicable rights in the event of death or incapacity, where the relevant provisions of Indian law apply.

Pion Global will publish and maintain appropriate means for exercising these rights as the relevant provisions of the Digital Personal Data Protection Act and Rules become applicable.

15.2 EEA and United Kingdom
• Access your personal data and obtain information about its processing.
• Rectify inaccurate or incomplete personal data.
• Request erasure in applicable circumstances.
• Request restriction of processing.
• Object to processing based on legitimate interests and, where applicable, direct marketing.
• Receive data portability where the legal conditions are met.
• Withdraw consent at any time where processing is based on consent.

Automated Decisions: Where applicable, you may have the right to request human review of important decisions made entirely by automated systems, including AI or profiling, when those decisions have a significant effect on you.

Direct Marketing: You can ask us at any time to stop using your personal data to send you marketing communications. Once you opt out, we will no longer use your personal data for direct marketing, although we may still contact you for service-related, contractual, security or legally required communications.

15.3 California, USA
If the California Consumer Privacy Act (CCPA), as amended, applies to Pion Global for a particular processing activity, eligible California consumers may have rights to know, access, delete and correct personal information; to opt out of sale or sharing where applicable; to limit certain uses of sensitive personal information where applicable; and to be free from unlawful discrimination for exercising CCPA rights. Pion Global does not sell personal information for monetary consideration. If a legal opt-out right applies to a technology or processing activity, we will provide the required method for exercising that right.

15.4 Other Jurisdictions
Additional privacy rights may apply under other national or state laws. We will respond to valid requests in accordance with the law that applies to the relevant processing.

15.5 Rights Are Subject to Applicable Law
Privacy rights are not absolute and may be subject to conditions, limitations, exemptions or legal retention requirements under applicable law. For example, Pion Global may be required to retain certain information for legal, regulatory, contractual, security, fraud-prevention, audit or dispute-resolution purposes even after an erasure request is received.

To exercise a privacy right, withdraw consent, raise a grievance or ask a question about our processing of personal data, contact us using the details in Section 21. Please provide enough information for us to understand your request and, where necessary, verify your identity. We will acknowledge and respond within the period required by applicable law.

Where the grievance provisions of the Digital Personal Data Protection Rules apply, our grievance process will operate within the applicable published response period, which will not exceed the statutory maximum.

We may need to retain limited information about a request or opt-out in order to demonstrate compliance and prevent future unwanted processing or communications.

Verification of Requests
To protect personal data from unauthorized access or disclosure, Pion Global may take reasonable steps to verify the identity and authority of the person making a privacy request. We will request only the information necessary for verification and handling of the request.

Authorised Representatives
Where permitted by applicable law, you may authorize another person to submit a privacy request on your behalf. We may request evidence of that person's authority and may also verify your identity directly where permitted or required.

Response Timeframes
Pion Global will acknowledge and respond to valid privacy requests within the timeframe required by applicable law. The applicable timeframe may vary depending on the individual's jurisdiction, the type and complexity of the request and any legally permitted extension.

Pion Global's corporate websites and business services are intended for enterprises, professionals and adults. We do not knowingly seek to collect personal data from children through general website interactions.

For India, a child is an individual under 18 years of age under the Digital Personal Data Protection Act, 2023. Where processing of a child's personal data is required and permitted, Pion Global will implement age / parental-consent measures and other safeguards required by applicable law.

If you apply for a role with Pion Global, we process candidate information to assess qualifications, communicate about opportunities, manage interviews and recruitment workflows, conduct permitted verification or reference checks, make hiring decisions and meet legal obligations.

Candidate information may be obtained directly from you, from recruitment partners, referrals, professional networks or other lawful sources.

Recruitment data is generally retained for up to 12 months after the relevant hiring process unless a longer period is required by law or you agree to be considered for future roles.

Our websites may contain links to third-party websites, social networks, embedded services or external platforms. Those services are governed by their own privacy practices. Pion Global is not responsible for the privacy practices of third parties that independently determine how they process personal data.

We may update this Privacy Policy periodically to reflect changes in our business, technologies, legal requirements or privacy practices. The revised date will be displayed at the top of the Policy.

Where a change is material and applicable law requires additional notice, we may provide notice through our website, email or another appropriate channel.