Employee Privacy Policy

1. Purpose
   The Company values the privacy of our employees and are committed to protecting their personal data. This Employee Privacy Policy (“the Policy”) explains how we collect, use, disclose, store and safeguard personal data of our current, former and prospective employees, consultants, contractors and other personnel engaged by the Company.

   This Policy aims to provide transparency regarding our data processing practices and should be read alongside applicable employment agreements, internal policies and applicable laws.

2. Applicable Entities

   This Policy applies to:

   (a) Sixdis Technologies Private Limited ("STPL"); and

   (b) Oolka Financial Services Private Limited ("OFSPL"), a wholly owned subsidiary of STPL, collectively referred to as the "Oolka Group" or the "Company".

   This Policy has been adopted by STPL and OFSPL through their respective Board approvals.

3. Scope
   This Policy applies to:

   1. Permanent employees

   2. Contractors

   3. Consultants

   4. Prospective employees during recruitment process

   5. Interns and trainees

4. Personal Data Collected:
The Company collects following categories of personal data:

A. Identification Information

• Full name
• Date of Birth
• Photograph
• Gender
• Nationality
• Government issued Identification Number (such as PAN, Aadhaar etc)

B. Contact Information

• Phone number
• Email address
• Emergency contact details
• Residential and correspondence address

C. Employment Information

• Resume/CV
• Educational Qualifications
• Employment History
• References
• Offer Letters/Employment Agreement
• Appraisal/Promotional Details
• Disciplinary Records

D. Payroll and Financial Information

• Bank account details
• Salary information
• Provident Fund details
• Tax-related information
• Reimbursement details
• Gratuity information

E. Health Information (where permitted by law)

Where necessary for employment, workplace, safety, insurance, statutory compliances, or employees welfare, the Company may process limited health-related information in accordance with applicable law.

F. IT and Security Information

• Log-in Credentials
• Device Identifiers
• IP Address
• System access logs
• CCTV recordings (when at our premises)
• Access cards records

G. Family/Dependent Information

• Spouse details
• Children's details
• Nominee details
• Dependent information

H. Professional Information

• Skills and certifications
• Leave records
• Training records

5. How do we collect information?
The Company may collect personal information:

• Directly from you
• Through recruitment agency
• Through onboarding documentation
• Through company-issued devices
• From background verification agencies
• From government sites and portals
• From benefit providers and
• From publicly available sources.

6. Purpose for Collection of Personal Data
The Company may process your personal data for legitimate employment related purposes such as-

1. Recruitment and hiring
2. Employee onboarding
3. Employee administration
4. Employee benefits
5. Tax compliances
6. Statutory reporting
7. Performance management
8. IT administration
9. Cyber security
10. Fraud prevention
11. Regulatory compliances
12. Legal proceedings
13. Business continuation
14. Protection of company assets

7. Monitoring
To protect Company systems information, and assets, the Company may monitor:

1. Use of Company devices

2. Use of VPN

3. Corporate email accounts and other Company communication platforms (including Slack, Microsoft Teams or similar collaboration tools)

4. Internet usage

5. Network traffic

6. Security logs

7. CCTY footage at Company premises and

8. Physical assets records.

   Monitoring of the above shall be done only for legitimate business, security, legal, compliances and operational purposes and in accordance with applicable laws.

8. Legal Basis

We process personal data for lawful employment-related purposes, including compliance with applicable laws, performance of employment obligations, protection of Company assets, prevention of fraud, and other legitimate business requirements.

9. Sharing of Personal Data
We share your personal data only on a need-to-know basis and in accordance with applicable laws. We share your personal data with following parties:

• Payroll providers

• Insurance companies

• Banks

• Government authorities

• Statutory bodies

• Background verification agencies

• IT service providers

• Auditors

• Professional advisors

The personal information is shared in accordance with applicable laws.

10. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes set out in this Policy, including the duration of your employment and thereafter for so long as required under applicable law, contractual obligations or for the establishment, exercise or defence of legal claims. Thereafter, your personal data will be securely deleted, anonymised, or archived in accordance with our data retention practices and applicable law.

11. Security Measures
Your personal data collected is secure with the Company. We maintain appropriate technical, organizational and administrative safeguards to protect your personal data against unauthorized access, use, disclosure, alteration, loss or destruction.

Some of the safeguards which we follow are:

• Role-based access controls and least-privilege access;
• Multi-factor authentication and password protection;
• Encryption of personal data, where appropriate;
• Network and endpoint security controls;
• Security monitoring and logging;
• Regular security assessments and vulnerability management;
• Secure backup and disaster recovery measures; and
• Confidentiality obligations applicable to employees, contractors and service providers who have access to personal data.
• Periodic employee awareness and information security training.

12. Employee Rights
Subject to applicable law, employees may have certain rights in relation to their personal data, including the right to:

• Request access to information regarding the personal data processed by the Company;
• Request correction or updating of inaccurate or incomplete personal data;
• Request erasure of personal data where such retention is no longer necessary or where permitted under applicable law;
• Withdraw consent, where the processing is based on consent, subject to applicable legal or contractual obligations;
• Raise concerns or grievances regarding the processing of their personal data; and
• Exercise such other rights as may be available under applicable data protection laws.
  All requests may be subject to verification of identity and applicable legal or employment-related limitations.

13. Storage of Personal Data

The Company stores and maintains employee personal data on systems and infrastructure located in India. Personal data is processed and accessed only by authorized personnel and service providers on a need-to-know basis for legitimate employment, operational, legal and regulatory purposes.

14. Employee Responsibilities

Employees are responsible for ensuring that the personal data provided to the Company is accurate, complete and up to date. Employees shall promptly notify the Company of any changes to their personal information, including but not limited to their contact details, residential address, bank account details, emergency contact information, nominee details, tax information or any other information relevant to their employment.

Failure to provide accurate or updated information may affect the Company's ability to administer employment-related benefits, comply with statutory obligations, process payroll or communicate important employment-related matters. The Company shall not be responsible for any consequences arising from an employee's failure to provide accurate or updated personal data.

15. Changes to this Policy

The Company may amend or update this Employee Privacy Policy from time to time to reflect changes in applicable laws, business practices, operational requirements or information security measures.

Where practicable, the Company will notify employees of any material changes to this Policy through appropriate internal communication channels, including email, the employee portal or other official communication mechanisms. The revised Policy shall become effective from the date specified in the updated version.

Employees are encouraged to review the updated Policy upon receiving such notification to remain informed about how the Company processes and protects their personal data.

16. Grievance Redressal

If you have any questions, concerns or grievances regarding the processing of your personal data or this Policy, or if you wish to exercise your rights under applicable data protection laws, you may contact the Company's Grievance Officer or the Human Resources Department using the contact details below:

Grievance Officer: Jatin Mazalcar
Email: grievance@oolka.in
Phone: +91 72047 12789

17. Applicable Law

This Policy is intended to be read in conjunction with applicable laws governing the processing and protection of personal data, including:

• The Digital Personal Data Protection Act, 2023;
• The Information Technology Act, 2000 and the rules framed thereunder, to the extent applicable; and
• Other applicable employment, labour and regulatory laws

18. Governing Law

This Policy shall be governed by and construed in accordance with the laws of India.

Effective Date- This Privacy Statement was last modified 11th August 2026.