Privacy Policy

1. Applicability

This Privacy Policy applies to personal data processed by Driif in connection with:

• visitors to our websites and digital properties;
• individuals who contact us;
• customers, prospective customers and their representatives;
• suppliers, partners, consultants and other business counterparties;
• individuals who attend demonstrations, events, conferences or meetings with us;
• applicants and prospective employees;
• users of Driif’s software, platforms or other Services, where applicable; and
• other individuals whose personal data is lawfully provided to or collected by Driif.

Where Driif processes personal data on behalf of a customer or other organisation as a processor/service provider, the processing may additionally be governed by the applicable customer agreement, data processing terms or other contractual documentation.

2. Applicable Data Protection Law

Driif is committed to complying with applicable Indian data protection and information technology laws, including, as applicable:

• the Digital Personal Data Protection Act, 2023 (“DPDP Act”);
• the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), as and when the relevant provisions become applicable;
• the Information Technology Act, 2000;
• applicable rules, regulations, directions and advisories issued thereunder;
• applicable requirements and directions issued by CERT-In; and
• other applicable laws and regulatory requirements governing privacy, cybersecurity, electronic communications and data protection.

The DPDP Act establishes the concepts of a “Data Fiduciary” and “Data Principal”, together with obligations concerning lawful processing, security safeguards, breach response, erasure and grievance redressal.

Where another jurisdiction’s privacy law applies to particular processing, Driif may apply additional requirements appropriate to that jurisdiction.

3. Information We May Collect

Depending on the nature of your interaction with Driif, we may collect:

3.1 Identity and contact information

This may include:

• name;
• designation and job title;
• organisation/company name;
• business email address;
• telephone or mobile number;
• business address;
• country or jurisdiction; and
• other professional contact information.

3.2 Business and engagement information

This may include:

• information provided in enquiries;
• customer or partner information;
• correspondence and communications;
• meeting and demonstration information;
• purchase or commercial information;
• information relating to contracts, proposals and statements of work; and
• information necessary for account administration and customer support.

3.3 Technical information

When you interact with our websites or digital Services, we may collect information such as:

• IP address;
• browser and device information;
• operating system;
• approximate geographic information derived from technical information;
• referring URLs;
• pages or resources accessed;
• access date and time;
• diagnostic and performance information;
• security and authentication information; and
• logs and other technical information necessary to operate and secure our systems.

3.4 Communications and submitted information

If you contact Driif through email, contact forms, telephone, social media, events or other channels, we may retain the information necessary to respond to your communication and maintain appropriate business records.

3.5 Recruitment information

Where you apply for employment or otherwise engage with Driif in connection with recruitment, we may process information such as:

• name and contact details;
• CV/resume;
• employment and educational history;
• professional qualifications;
• references;
• information provided during interviews;
• information necessary for employment verification; and
• other information lawfully provided during recruitment.

Recruitment-related information may be subject to additional notices or employment documentation.

3.6 Information relating to use of our products and Services

Where applicable, our products and Services may process technical, operational and usage information such as:

• account and authentication information;
• system and device identifiers;
• telemetry and diagnostics;
• software usage information;
• system performance information;
• configuration information;
• security logs;
• error reports; and
• information necessary to provide support, maintenance and security.

Where customer-controlled operational, mission, geospatial, imagery, telemetry or other sensitive information is processed within a Driif product or platform, the treatment of that information may be principally governed by the applicable customer agreement and technical/security terms.

4. Information We Do Not Seek Through Our Public Website

Driif’s public website is not intended to be a channel for submitting classified information, defence-sensitive information, export-controlled technical information, controlled unclassified information, operational mission information, security credentials, cryptographic keys or other information that the sender is not authorised to disclose.

Please do not submit classified, restricted, export-controlled or otherwise sensitive operational information through public website forms or ordinary email unless Driif has expressly authorised such transmission through an approved channel.

5. Sources of Personal Data

We may obtain personal data:

• directly from you;
• from your organisation or employer;
• from our customers, suppliers or business partners;
• from publicly available professional or business sources;
• from recruitment platforms;
• through events, conferences and demonstrations;
• through our websites and digital Services;
• through service providers acting on our behalf; or
• from other lawful sources.

6. Purposes of Processing

Driif may process personal data for purposes including:

• providing, operating and maintaining our websites and Services;
• responding to enquiries and requests;
• communicating with customers, prospective customers, partners and suppliers;
• managing business relationships;
• providing demonstrations, evaluations and technical support;
• administering accounts and access;
• performing contractual obligations;
• processing payments and maintaining business records;
• improving reliability, performance and security;
• detecting, preventing and investigating fraud, abuse and cyber incidents;
• protecting our intellectual property, systems and personnel;
• managing recruitment;
• communicating information about Driif, our technology, events or Services;
• complying with applicable laws and regulatory obligations;
• responding to lawful requests from government, law-enforcement or regulatory authorities;
• establishing, exercising or defending legal rights; and
• other purposes communicated to you at or before the time of collection.

We seek to process only such personal data as is reasonably necessary for the relevant purpose.

7. Legal Basis / Authority for Processing

Where the DPDP Act applies, Driif will process personal data in accordance with the lawful grounds available under applicable law, including consent and certain legitimate uses recognised by applicable law.

Where consent is required, Driif will seek consent in an appropriate manner and provide information reasonably necessary for the Data Principal to understand the relevant processing.

Consent may be withdrawn in accordance with applicable law. Withdrawal of consent will not affect the lawfulness of processing undertaken before withdrawal.

Where processing is necessary for contractual, legal, security or other permitted purposes, Driif may process information without relying solely on consent, to the extent permitted by applicable law.

8. Cookies and Similar Technologies

Our websites may use cookies, pixels, local storage and similar technologies.

These technologies may be used for:

• essential website functionality;
• security;
• authentication;
• remembering preferences;
• performance monitoring;
• analytics;
• understanding website usage; and
• improving our digital Services.

Where required by applicable law, Driif will seek appropriate consent before deploying non-essential cookies or similar technologies.

You may control cookies through your browser or other available mechanisms. Disabling certain cookies may affect website functionality.

Where third-party analytics, embedded content or similar technologies are used, those providers may process information in accordance with their own privacy policies and applicable contractual arrangements.

9. Marketing Communications

Where permitted by law, Driif may send business communications relating to our Services, events, technology, publications or other activities.

Where consent is required, we will obtain such consent.

You may opt out of marketing communications at any time through the unsubscribe mechanism included in the communication or by contacting us.

We may nevertheless continue sending essential transactional, security, legal or service-related communications where permitted or required by law.

10. Disclosure of Personal Data

Driif does not sell personal data as a business practice.

We may disclose personal data, where lawful and necessary, to:

• affiliated entities;
• employees and authorised representatives;
• professional advisers;
• technology and infrastructure providers;
• cloud and hosting providers;
• analytics and communications providers;
• payment and accounting providers;
• recruitment service providers;
• security and cybersecurity service providers;
• auditors;
• legal advisers;
• insurers;
• contractors and subcontractors;
• business partners involved in providing Services; and
• governmental, regulatory, judicial or law-enforcement authorities where required or permitted by law.

Third-party service providers may process personal data on Driif’s behalf subject to appropriate contractual and security controls.

11. Business Transactions

In connection with a proposed or completed:

• merger;
• acquisition;
• investment;
• restructuring;
• financing;
• sale of assets;
• transfer of business; or
• similar corporate transaction,

personal data may be disclosed to relevant advisers, counterparties and successors subject to appropriate confidentiality and legal safeguards.

12. Government, Defence and Security-Related Requests

Driif operates in sectors that may involve government, defence, aerospace, security, critical infrastructure and other regulated or sensitive environments.

Where required by law, Driif may disclose or process personal data in response to lawful governmental, regulatory, judicial, law-enforcement or national-security requests.

Nothing in this Privacy Policy limits Driif’s obligations to comply with applicable law or lawful governmental directions.

13. Cross-Border Data Transfers

Driif may use service providers, infrastructure or business partners located outside India.

Where personal data is transferred outside India, Driif will do so in accordance with applicable law, including any restrictions or requirements prescribed by the Central Government.

The DPDP Rules permit transfer outside India subject to requirements that may be specified by the Central Government concerning access by foreign states or entities under their control.

Additional contractual, technical or organisational safeguards may apply depending upon the nature of the data and applicable legal requirements.

14. Data Security

Driif maintains reasonable technical and organisational measures designed to protect personal data against unauthorised access, use, disclosure, alteration, destruction or loss.

Depending upon the nature and risk of processing, these measures may include:

• access controls;
• role-based permissions;
• authentication controls;
• encryption or equivalent protections;
• network and infrastructure security;
• logging and monitoring;
• vulnerability management;
• backup and recovery mechanisms;
• security testing;
• incident response procedures;
• personnel confidentiality obligations;
• vendor and processor controls; and
• other appropriate administrative, technical and physical safeguards.

The DPDP Rules specifically contemplate encryption, masking/obfuscation or equivalent controls, access controls, logging and monitoring, backups and processor security obligations.

No method of transmission or storage can be guaranteed to be completely secure. Accordingly, Driif cannot guarantee absolute security of information transmitted through the Internet.

15. Data Breaches and Security Incidents

Driif maintains processes intended to detect, investigate, contain, remediate and respond to security incidents.

Where a personal data breach occurs and applicable law requires notification, Driif will make the required notifications to the relevant authority and affected Data Principals in the manner and within the timelines prescribed by law.

Under the DPDP Rules, applicable breach requirements include notification to affected Data Principals without delay and specified information to the Data Protection Board, including detailed information within seventy-two hours unless a longer period is permitted.

Driif may also be required to comply with separate cybersecurity incident reporting obligations, including applicable CERT-In directions.

16. Data Retention

Driif retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including:

• providing Services;
• maintaining business and transaction records;
• complying with legal obligations;
• resolving disputes;
• enforcing agreements;
• protecting our legitimate business interests; and
• detecting and investigating security incidents.

Different categories of data may have different retention periods.

Where personal data is no longer required and no legal or legitimate reason for continued retention exists, Driif will delete, anonymise or otherwise appropriately dispose of it.

Certain security, processing and transaction records may be retained for longer periods where required by applicable law.

17. Data Principal Rights

Subject to applicable law, Data Principals may have rights including:

• the right to obtain information regarding processing;
• the right to correction or updating of personal data;
• the right to request erasure where applicable;
• the right to withdraw consent;
• the right to access applicable mechanisms for grievance redressal; and
• the right to nominate another individual to exercise rights in accordance with applicable law.

The scope and exercise of such rights may be subject to statutory exceptions, legal obligations, contractual requirements, security considerations and other limitations prescribed by law.

Requests may be submitted using the contact information provided below.

Driif may take reasonable steps to verify the identity and authority of an individual making a request before processing it.

18. Children’s Data

Driif’s public Services are primarily intended for business, professional and adult users.

Driif does not knowingly seek to collect personal data of children through its public website except where permitted and handled in accordance with applicable law.

Where the DPDP Act and Rules require verifiable parental consent or other safeguards for processing children’s personal data, Driif will implement such safeguards to the extent applicable.

19. Third-Party Websites

Our websites may contain links to third-party websites, applications, social media platforms or services.

Driif is not responsible for the privacy practices, security or content of third-party websites.

We encourage users to review the privacy policies of such third parties before providing personal data.

20. International Users

Driif is an Indian company and this Privacy Policy is principally designed around Indian law.

Individuals located outside India may be subject to additional privacy rights under the laws applicable to them. Where such laws apply to Driif’s processing, Driif may implement additional measures as reasonably required.

21. Confidentiality of Customer and Operational Information

Personal data is distinct from confidential business information, intellectual property, technical information and operational information.

Driif may receive highly confidential information from customers and partners in connection with its Services.

Such information may be protected under:

• confidentiality agreements;
• non-disclosure agreements;
• master service agreements;
• SaaS agreements;
• statements of work;
• security agreements;
• government or procurement requirements; and
• other applicable contractual or legal obligations.

Where applicable, those contractual obligations will govern the treatment of such information in addition to this Privacy Policy.

22. Grievance Redressal

If you have a question, concern, complaint or request relating to your personal data, you may contact Driif through:

Where required under applicable law, Driif will publish the business contact details of its Data Protection Officer or designated person responsible for responding to questions concerning personal data.

Driif will maintain an appropriate grievance redressal mechanism and respond within applicable statutory timelines.

23. Changes to This Privacy Policy

Driif may update this Privacy Policy from time to time to reflect:

• changes in law;
• regulatory requirements;
• changes to our Services;
• technological developments;
• security requirements; or
• changes in our data processing practices.

The revised version will be published on our website with an updated “Last Updated” date.

Where required by applicable law, Driif will provide additional notice or obtain consent for material changes.

24. Governing Law

This Privacy Policy shall be governed by the laws of India, except to the extent mandatory provisions of another applicable jurisdiction apply.

Nothing in this Privacy Policy limits any rights or protections that cannot lawfully be excluded under applicable law.