Our Policies
Context
This policy governs Convergent's handling of Personal Data under the legal frameworks applicable to our work. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP") govern the processing of digital personal data of individuals in India, including our respondents, panellists, employees, and other Data Principals. DPDP's substantive obligations take effect in phases, with full compliance required by 13 May 2027; the Data Protection Board of India is already established and operational. In addition, the General Data Protection Regulation (GDPR), which came into existence in 2018, governs the processing of personal data of individuals in the European Union, and calls for a better focus on the data regulatory framework in Europe and for specific protocols to which all Convergent staff must adhere. As part of the work we are executing, Convergent collects and holds Identification and Personal Data about respondents, panellists, staff, clients, and suppliers to conduct business. The protocol mandates adherence to procedures and systems that all Convergent staff, consultants, and concerned people must seek to follow. This policy details how we intend to protect Personal Data and ensure that all Convergent staff are familiarized with the rules governing their use of Personal Data to which they have access during their work. All staff must know Convergent's designated Grievance Officer (see below), who handles data protection queries and can be contacted when needed.
Definitions
Personal Data
Personal data is any information that belongs to an identified or identifiable living individual. Please note that information can be called Personal Data even if you are not aware of the individual's name, email address, mobile numbers, or other phone numbers or other identifiers. Such personal data includes online identifiers such as cookies, HTML, etcetera. Sensitive Personal Data is information about the subject's racial or ethnic origin, political opinions, religious or similar beliefs, memberships (or non-membership), health condition (including physical and mental), criminal offenses, or related proceedings. This "Sensitive Personal Data" category reflects GDPR Article 9 and applies where GDPR governs the processing in question. DPDP does not use a distinct sensitive-data category in this form; DPDP instead applies heightened requirements to the processing of children's data and the data of persons with disabilities who have a lawful guardian (see "Research on Special Groups & Consent" below).
Data Fiduciary
An entity that, alone or with others, determines the purpose and means of processing personal data. Convergent acts as a Data Fiduciary, under DPDP, for personal data it collects directly from respondents, panellists, employees, and other individuals.
Data Principal
The individual to whom personal data relates, under DPDP. Under GDPR, the equivalent term is "data subject." Both terms may appear in this policy depending on which framework a given provision addresses.
Purposes of the Business
The purposes for which Convergent may use such data include, but are not restricted to:
Conducting research and surveys of various nature
Gathering statistical evidence to input into the market research data
Compliance with the legal, regulatory and corporate governance obligations and good practice
Ensuring business policies are adhered to (such as policies covering email and internet use)
Operational reasons, such as recording transactions, training & quality control, ensuring the confidentiality of commercially sensitive information, security vetting, credit scoring, and checking
Checking references, ensuring safe working practices, monitoring and managing staff access to systems and facilities and staff absences, administration, and assessments
Monitoring staff conduct and disciplinary matters.
Marketing the business of Convergent
Research Methodologies
As per the industry norms from time to time and which are adopted and innovated by Convergent regularly
Applicability
This policy applies to everyone working with the organization for business purposes. All such stakeholders must be familiar with these policies and comply with their terms at all times. Failure to do so can be treated as a disciplinary offence.
This policy supplements our other policies relating to internet and email use. The policy is subject to modifications through addition or deletion from time to time as deemed necessary by the organization. You will be appraised of the changes from time to time through appropriate training or any other method deemed appropriate by the organization.
Responsibilities
The Project Managers and Administration are responsible for:
Updating the Convergent management about data protection responsibilities, risks, and issues.
Review and revise all data protection procedures and policies regularly.
Organize and conduct data protection training for all staff members.
Be available to answer questions on data protection that may come from the staff, board members, and other stakeholders
Be available to individuals, clients, and employees who wish to know which of their data is being held by Convergent
Conduct due diligence and approve third parties who handle the company's data, any contracts or agreements regarding data processing.
To ensure all computers, systems, services, software, and equipment meet acceptable security standards
Identify and research third-party services Convergent is considering using to store or process data
Designating and publishing the contact details of Convergent's Grievance Officer for data protection queries and grievances under DPDP (see Grievance Officer below).
Data Processing Activities
Convergent shall attempt to record data processing activities in a data inventory. We must hold a record of each processor of Personal Data and a list of where this data is stored. Such a record shall include all suppliers, sub-processors, and third parties.
Convergent shall assess risks of data collection and processing activities. Such risk assessment may be done on Convergent's various research methodologies, data collection methods, data processing activities to flag data protection risks, areas that need to be amended or escalated for advice. These assessments of data protection risks should be undertaken and reviewed periodically.
Rights That Can Be Executed
Convergent observes that Data Principals have the following rights under DPDP:
The right to access information about how their personal data is being processed
The right to correction and erasure of their personal data
The right to grievance redressal
The right to nominate another individual to exercise these rights on their behalf in the event of death or incapacity
Where GDPR applies, individuals have the following rights:
The right to access
The right to rectification
The right to erasure
The right to be informed
The right to restrict processing
The right to data portability
The right to object
The right to withdraw Consent and
Rights concerning automated decision making and profiling
If anyone requests that one or more of these rights be exercised, and the relevant conditions are met, Convergent shall review and respond with assistance within the timeframe applicable under GDPR. For DPDP requests, Convergent will acknowledge and respond within the timeframe set out in the DPDP Rules. If a Data Principal is not satisfied with Convergent's response to a DPDP request, they may escalate the matter to the Data Protection Board of India.
Confidentiality Notices
Convergent considers it essential to maintain transparency and provide accessible information to individuals about using personal data. Such transparency would mean including the following details in all confidentiality notices on how we collect data and what we will do with it:
Nature of the information that is being collected.
The individuals who are collecting it.
The method in which it is collected.
The purpose for which it is collected.
How it is intended to be used.
Who are the recipients of this, either in whole or in parts?
Identity and contact details of data controllers.
If there is any transfer planned for the third country and related safeguards.
The period for which the data is planned to be stored.
Where Convergent relies on consent under DPDP, the notice will additionally: be presented as a standalone notice, understandable independently of any other document; be written in clear, plain language, itemising the specific personal data collected and the specific purpose for each item; and be available in English or, on request, in any language listed in the Eighth Schedule to the Constitution of India.
Lawful Collection and Use of Personal Data
Under DPDP, Convergent processes personal data on the basis of consent (obtained through a notice meeting the standards described above) or a "certain legitimate use" specifically enumerated in Section 7 of the DPDP Act — including voluntary provision of data by the Data Principal for a specified purpose, processing required by the State for permits, licences, benefits, or services, compliance with a judgment or order, medical emergencies, and employment-related purposes, among others specified in the Act. DPDP does not recognise an open-ended "legitimate interests" basis.
We have an obligation to the Government, the legal system, and the clients to explain the legal basis for procuring and processing Personal Data. Where GDPR applies, these legal bases are listed below and could be different for each use case:
We have the required Consent for the use of Personal Data
It is necessary for us to use the Personal Data to perform a contract
It is necessary for us to process Personal Data to comply with a legal obligation
It is necessary for us to Personal Data to protect interests
The processing is necessary to perform a task in the public interest
The use of Personal Data is necessary for our (or our clients') legitimate interests (in which case we will explain what those interests are)
Research on Special Groups & Consent
As per the Data Protection norms, children, mentally challenged, hospitalized individuals, and people undergoing severe treatments might not be in a condition to provide Consent to allow their data to be processed and such consents obtained are not valid. The Consent on behalf of the children must be given by parents or legally authorized guardians (the legal definition will depend on each jurisdiction). The default age of a child under the data protection differs as per the country's norms unless specific legislation in a jurisdiction permits it to be lower. Any collection of Children's data must follow the country's norms and should have the approval of the requisite authority if necessary.
Where DPDP applies, Section 9 of the Act and Rule 10 of the DPDP Rules specifically require verifiable consent from a parent or lawful guardian before processing a child's (under-18) personal data, and prohibit behavioural monitoring, tracking, or targeted advertising directed at children, regardless of consent obtained.
Institutional Review Board
The researchers are advised to apply and seek a review of their research approach, research tools, and the ethical protocols proposed for the study through an Institutional Review Board or Independent Ethics Committees. This decision can be taken on a case-to-case basis in consultation with the client organization and the stakeholders involved.
IT Policies
All Convergent staff should comply with the organization's IT policies, which are detailed and updated from time to time. The IT policies are directly linked to protecting the data and the necessary impact on the data protection norms the organization intends to follow.
Data and Duration Minimisation
Convergent has a policy not to hold data longer than necessary for legitimate business interests. It shall minimize the amount of data and its duration that is collected regarding data subjects wherever necessary.
International Data Transfers
Under DPDP, Convergent may transfer personal data outside India except to countries or territories specifically restricted by notification of the Central Government. Where GDPR applies, transfers of personal data outside the European Economic Area require an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another valid transfer mechanism recognised under GDPR Chapter V.
Capacity Building
All Convergent staff must complete data protection training each year, which will either be provided online or face to face. It is the responsibility of all line managers to ensure that all relevant staff attends such training, and the same must be confirmed to the human resources managers. Failure to deliver on this may be considered a disciplinary offense.
Data Handling
All data processing shall be undertaken following Convergent's data handling protocol. Risk assessments should be conducted regularly to assess compliance.
Data Incidents
In the event of a data incident or if you have any concerns, you must carry out the data incident notification procedure immediately. Under DPDP, this procedure includes: notifying the Data Protection Board of India, including a description of the breach, the categories and approximate number of Data Principals affected, likely consequences, and measures taken or proposed; and notifying affected Data Principals within 72 hours of becoming aware of the breach, in plain language, describing the breach, the data involved, protective measures they can take, and Convergent's contact details for queries. The designated Grievance Officer is responsible for coordinating this process.
Audits to Ensure Compliance
Regular internal audits may be carried out to ensure that Convergent complies with this policy. All staff, partners, stakeholders, and suppliers are obliged to assist with such audits. We may also have audits from clients from time to time, and we shall endeavor to comply with such exercises when necessary to meet our contractual obligations.
Grievance Officer
Convergent's designated contact for data protection questions and grievances is:
Dr. Subrato Mondal
Senior Director & Partner
subrato@convergentview.com
If a Data Principal's grievance is not resolved to their satisfaction through this contact, they may escalate the matter to the Data Protection Board of India.
