Privacy Policy

Introduction


Your privacy is important to us. We believe it is important for you to know what personal data we, Tata Consultancy Services (“TCS” or “we”), collect from you (and third parties), why we collect it, how we use it and what rights you might be entitled to as a data subject or consumer.

For residents (data subjects) of the European Union, when we collect and use personal data (information) about you, we may be subject to the General Data Protection Regulation (‘GDPR’) of the European Union and responsible as a ‘data controller’ for such personal data.

For residents (consumers) of the United States, when we collect and use personal information about you, we may be subject to the California Consumer Protection Act (CCPA) and responsible as a ‘business’ or ‘service provider’ for such personal data.

Please note: all information in this privacy notice is applicable to you unless otherwise indicated based on your residency status. If you are a resident of the European Union, references to GDPR will be applicable to you. If you are a resident of the Unites States, references to the CCPA will be applicable to you.

We are required under data protection legislation to notify you of the information contained in this privacy notice. It is important that you read this notice, together with any additional and more specific information we may provide to you on various occasions when we are collecting or processing personal data on certain specific websites, products or applications, events and initiatives so that you are aware of how and why we are using such information. (We issue a different privacy statement which applies where there is an employment relationship between TCS and its employees.)

How we will use your personal information


We may collect different kinds of personal information in a number of different ways and use it for a number of different purposes:

This information is aggregated to measure the number of visits, average time spent on the site, pages viewed and similar information. TCS uses this information to measure the site usage, improve content and to ensure safety and security as well as enhance performance and user experience of the website. In few situations, you are required to register to access a reserved area of the website: in these cases, we will also collect your username and the password.

We may also obtain data from third parties including:

TCS uses cookies (small text files placed on your device) and similar technologies to facilitate proper functioning of our websites and to help collect data: please read here our full cookie policy. Please note that our websites may include links to websites of third parties whose privacy practices differ from those of TCS; if you provide personal data to any of those websites, your data is governed by their privacy statements.

Under the GDPR, the lawful basis for this processing is our legitimate interest in enabling and improving our website and online services, or consent, where requested and obtained.

If you contact us with queries, requests for more information about initiatives or products or other generic support inquiries, we will need to collect information about you such as:

For information about managing your contact data, email subscriptions and promotional communications, please use the form at the bottom of this page or contact our Data Protection Officers or Chief Privacy Officer (see contact details below).

Under the GDPR the lawful basis for this processing may be for the performance of a contract with you or to take steps at your request before entering into a contract with you, or for our legitimate interests in behaving as a responsible organization in dealing with these matters, or consent, where requested and obtained.

If you sign up to receive promotional communications from TCS we may send these by email, SMS/text messages, post, telephone or any other means of communication. For information about managing your contact data, you may reach out to the contact details provided in the event privacy notice or in the emails you receive, use the form at the bottom of this page or contact our Data Protection Officers or Chief Privacy Officer (see contact details below).

Under the GDPR the lawful basis for this processing is the consent, where requested and obtained.

Where a hospitality service is provided, we may also collect, store and process “special categories” of more sensitive personal data, such as information regarding any dietary requirements or personal disabilities. This will be done only and to the extent permitted by the law. Events might be recorded hence pictures and video of you may be collected too; in such case, you will be informed via a specific notice at the location of recording. This material can be used later by TCS for further compatible purposes if you don't object to it. In the course of these events we may collect your personal data and contact you again in order to receive feedback and provide further commercial information about TCS; this will be done with your consent, when necessary.

We may also obtain data from third parties including:

Under the GDPR the lawful bases for this processing is our legitimate interest in organizing and running such events, or consent, where requested and obtained.

Under the GDPR and depending on the processing activity, the lawful bases for this processing may be for the performance of a contract with you or to take steps at your request before entering into a contract with you, our legitimate interest in providing services to your company or employer, or legal obligation.


From time to time, we may use your name, quotes, pictures or videos to promote and amplify TCS’ brand and activities. In any such case, you will receive appropriate additional information about the usage of your personal data.

Under the GDPR the lawful basis for this processing are TCS’ legitimate interests in promoting its brand, products, initiatives and values, or consent, where requested and obtained.

If you do not provide certain information when requested, it may delay or prevent us from administering a service you requested from us, replying to your queries and/or letting you join our initiatives.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose and applicable law. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we will share your personal information


We may share your data with third parties, including third-party service providers and other entities in the TCS Group. Please note, TCS has not in the past, nor does it currently, under any circumstances buy or sell your personal data from or to any third party. Further, TCS does not use your personal data for any other purpose (as outlined below) unless required to fulfill a legitimate business purpose.

Why might you share my personal data with third parties?

We may share your personal data with third parties where required by law, where it is necessary for one of the activities mentioned above or where we have another legitimate legal basis in doing so. We require third parties to respect the security of your data and to treat it in accordance with the law. Where required by the law, we will request your consent before transferring data to third parties which are not part of the TCS Group.

Which third-party service providers process my personal data?

”Third parties” includes third-party service providers (including contractors and designated agents) and other entities within our group. The following activities may be carried out by third-party service providers: hosting and other internet services, data storage and analytics, marketing research and campaign management, event organizers and caterers. All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. We may also need to share your personal data with regulators or to otherwise comply with the law.

When might you share my personal data with other entities in the group?

We may share your personal data with other entities in the TCS Group as part of our regular reporting activities on company performance, in the context of a business reorganization or group restructuring exercise, for system maintenance support and hosting of data and when it is required to do so in order to perform one of the activities listed above (see "How we will use information about you"). Other entities in the TCS Group are required to take appropriate security measures to protect your personal data in line with our policies.

Transferring EU Data Subject information outside the EU/EEA for GDPR

We may transfer the personal data we collect about you to one of more countries outside the EU/EEA, including India, in order to perform one of the activities listed above (see "How we will use information about you"). Where there isn't an adequacy decision by the European Commission in respect of those countries - meaning that these are not deemed to provide an adequate level of protection for your personal data - we have put in place the appropriate measures to ensure that your personal data will be secure. These measures include Data Transfer Agreements based on the European Commission's Standard Contractual Clauses. If you require further information about these protective measures, you can request it from our Data Protection Officers (see contacts below).

How we will keep your information safe


We have put in place appropriate technical, organizational and security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long we will keep your information


We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal data are available in our retention policy upon request from our Data Protection Officers (see contact details below). To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

How to contact us


If you have a privacy concern, complaint or a question regarding this privacy statement, please direct it to the Chief Privacy Officer of Tata Consultancy Services at tcs.cpo@tcs.com or contact us through the form at https://www.tcs.com/contact-us.

For the purposes of the your data processed under this statement, the controller (under GDPR) or business/service provider (under CCPA) for the data processing of your personal information collected through our websites is Tata Consultancy Services Limited, TCS House, 2nd Floor, Raveline Street, Fort Mumbai 400 001, India. For all the other purposes indicated above, the controller (under GDPR) or business/service provider (under CCPA) is the same entity unless indicated otherwise in other privacy statement communicated in each situation.

Rights of EU data subjects under GDPR


If the processing of your personal information is subject to the EU General Data Protection Regulation ("GDPR") (or any United Kingdom replacement legislation), you are entitled to the rights listed below.

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Your rights in connection with personal data

Under certain circumstances, by law you have the right to:

If you are an EU or United Kingdom resident and want to exercise a data subject right in connection to your personal data, please contact our Data Protection Officers for the EU or United Kingdom (see contacts below).

Rights of US Consumers under the CCPA


If the processing of your personal information is subject to the CCPA, you are entitled to the rights listed below.

Changes to your personal data

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Your rights in connection with personal data

Under certain circumstances, by law you have the right to:

If you are a US resident and want to exercise one of the above rights in connection to your personal data, please contact our US Privacy Officer (see contacts below).

What we may need from you

If you exercise one of the above rights, we may need to request specific information from you to help us confirm your identity and that you are entitled to make such a request. This is to ensure that personal data is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Protection Officers (see contacts below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legal basis for doing so.

Data Protection Officer


We have appointed Data Protection Officers (DPOs) to oversee compliance of TCS with applicable data protection laws and with this privacy notice. If you have any questions about this privacy notice or how we handle your personal data, please contact the DPO in your region:

Data Protection Officer for UK and Ireland

DPO.uki@tcs.com

Data Protection Officer for the United States:

US.Privacy@tcs.com

Data Protection Officer for Continental Europe

DPO.Europe@tcs.com

Data protection supervisory Authority under GDPR


If you're not satisfied of how we process your personal data and the processing of your personal information is subject to the EU GDPR, you can lodge a complaint at any time to our Data Protection Officers or to the relevant data protection supervisory Authority; you can find the complete list of the European Authorities here.

Changes to this privacy statement


We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

[ Last updated : 1 Jan 2020 ]