Convergent Data Protection Policy

Personal Data

Personal data is any information that belongs to an identified or identifiable living individual. Please note that information can be called Personal Data even if you are not aware of the individual's name, email address, mobile numbers, or other phone numbers or other identifiers. Such personal data includes online identifiers such as cookies, HTML, etcetera. Sensitive Personal Data is information about the subject's racial or ethnic origin, political opinions, religious or similar beliefs, memberships (or non-membership), health condition (including physical and mental), criminal offenses, or related proceedings.

Purposes of the Business

The purposes for which Convergent may use such data include, but are not restricted to:

• Conducting research and surveys of various nature

• Gathering statistical evidence to input into the market research data

• Compliance with the legal, regulatory and corporate governance obligations and good practice

• Ensuring business policies are adhered to (such as policies covering email and internet use)

• Operational reasons, such as recording transactions, training & quality control, ensuring the confidentiality of commercially sensitive information, security vetting, credit scoring, and checking

• Checking references, ensuring safe working practices, monitoring and managing staff access to systems and facilities and staff absences, administration, and assessments

• Monitoring staff conduct, disciplinary matters

• Marketing the business of Convergent

Research Methodologies:

As per the industry norms from time to time and which are adopted and innovated by Convergent regularly

Applicability

This policy applies to everyone working with the organization for business purposes. All such stakeholders must be familiar with these policies and comply with their terms at all times. Failure to do so can be treated as a disciplinary offense.

This policy supplements our other policies relating to internet and email use. The policy is subject to modifications through addition or deletion from time to time as deemed necessary by the organization. You will be appraised of the changes from time to time through appropriate training or any other method deemed appropriate by the organization.

Responsibilities

The Project Managers & Administration are responsible for:

• Updating the Convergent management about data protection responsibilities, risks, and issues.

• Review and revise all data protection procedures and policies regularly.

• Organize and conduct data protection training for all staff members.

• Be available to answer questions on data protection that may come from the staff, board members, and other stakeholders

• Be available to individuals, clients, and employees who wish to know which of their data is being held by Convergent

• Conduct due diligence and approve third parties who handle the company's data, any contracts or agreements regarding data processing.

• To ensure all computers, systems, services, software, and equipment meet acceptable security standards

• Identify and research third-party services Convergent is considering using to store or process data

Convergent shall attempt to record data processing activities in a data inventory. We must hold a record of each processor of Personal Data and a list of where this data is stored. Such a record shall include all suppliers, sub-processors, and third parties.

Convergent shall assess risks of data collection and processing activities. Such risk assessment may be done on Convergent's various research methodologies, data collection methods, data processing activities to flag data protection risks, areas that need to be amended or escalated for advice. These assessments of data protection risks should be undertaken and reviewed periodically.

Rights that can be executed

Convergent observes that individuals have the following rights:

1. The right to access

2. The right to rectification

3. The right to erasure

4. The right to be informed

5. The right to restrict processing

6. The right to data portability

7. The right to object

8. The right to withdraw Consent and

9. Rights concerning automated decision making and profiling

If anyone requests that one or more of these rights be exercised, and the relevant conditions are met, Convergent shall review and respond with assistance within 60 days.

Confidentiality Notices

Convergent considers it essential to maintain transparency and provide accessible information to individuals about using personal data. Such transparency would mean including the following details in all confidentiality notices on how we collect data and what we will do with it:

• Nature of the information that is being collected.

• The individuals who are collecting it.

• The method in which it is collected.

• The purpose for which it is collected.

• How it is intended to be used.

• Who are the recipients of this, either in whole or in parts?

• Identity and contact details of data controllers.

• If there is any transfer planned for the third country and related safeguards.

• The period for which the data is planned to be stored.

We have an obligation to the Government, the legal system, and the clients to explain the legal basis for procuring and processing Personal Data. These legal bases are listed below and could be different for each use case:

• We have the required Consent for the use of Personal Data;

• It is necessary for us to use the Personal Data to perform a contract;

• It is necessary for us to process Personal Data to comply with a legal obligation;

• It is necessary for us to Personal Data to protect interests;

• The processing is necessary to perform a task in the public interest; or

• The use of Personal Data is necessary for our (or our clients') legitimate interests (in which case we will explain what those interests are).