Employee Privacy Notice

Version 1.0  ·  Effective June 2025  ·  Yara Fertilisers India Private Limited

Version	Date	Author	Description
1.0	June 2025	Yara Legal & HESQ	Initial Release

---

1. Purpose and Scope

This policy notice governs the collection, processing, and use of personal data of employees of Yara Fertilisers India Private Limited who use the SafetyConnect mobile application.

SafetyConnect is used exclusively for tracking driving behaviour and travel metrics for the purpose of processing employee reimbursement claims during official visits and field operations.

The application captures at-risk driving behaviours, including harsh acceleration, harsh braking, harsh cornering, over-speeding, and phone handling during transit. Based on these metrics, the application assigns a Safety Score to each employee using a proprietary AI-based algorithm.

The SafetyConnect application is used during official/business hours. Employees may switch on "personal trip" mode to opt out of tracking during personal trips.

This policy applies to approximately 400 field staff employees of Yara Fertilisers India Private Limited who download and use the SafetyConnect mobile application on their personal devices.

2. Categories of Personal Data Collected

The following categories of personal data are collected through the SafetyConnect application:

1. Name
2. Phone Number (used for login authentication and access management)
3. Official Email ID
4. GPS/Location Data (real-time location, travel route information via Google Maps)
5. Driving Behaviour Metrics (harsh acceleration, harsh braking, harsh cornering, over-speeding, phone usage while in transit)
6. Travel Distance and Duration
7. Trip Start and End Time
8. Vehicle Number and Vehicle Type
9. Safety Score (derived metric calculated by proprietary AI-based algorithm)
10. Zone (within India)
11. Reporting Manager Details
12. Device Identifiers (associated with the mobile application installation)

Note: No special category data (biometric, health, or criminal offence data) is collected through the application.

3. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), personal data may be processed based on the following legal bases:

• Consent of the Data Principal (Employee): Employees provide consent when downloading and activating the SafetyConnect application and agreeing to the privacy terms.
• Legitimate Interests: Yara has conducted a Legitimate Interest Assessment (LIA) confirming that the processing serves legitimate safety interests — specifically identifying unsafe driving habits (speeding, rash driving, night driving) and promoting safe driving through coaching and training by the HESQ team. The LIA confirms the processing is proportionate, necessary, and does not override the rights and freedoms of employees.
• Employment-Related Processing: The processing is necessary for the performance of the employment contract and for compliance with Yara's internal safe driving policies.

The processing is limited to business hours and working days. Employees may activate "personal trip" mode to prevent tracking during personal use.

4. Data Fiduciary and Data Processor

4.1 Data Fiduciary

Yara Fertilisers India Private Limited
Registered Office: Flat No. 1007, Tenth Floor, Antriksh Bhawan, Plot No. 22, Kasturba Gandhi Marg, New Delhi – 110001
Corporate Office: 502, Global Business Square, Plot No. 32, Institutional Area, Sector 44, Gurugram, Haryana — 122003

4.2 Data Processor

IoTRL Connect Private Limited
Registered Office: First Floor of 18, Krishna Nagar Colony, Picket, Secunderabad, Hyderabad, Telangana — 500009

Yara, as Data Fiduciary, determines the purposes and means of processing personal data. IoTRL Connect (SafetyConnect), as Data Processor, processes personal data strictly on behalf of Yara and in accordance with Yara's instructions, the Services Agreement, and the Data Processing Agreement between the parties.

• The Data Processor is contractually required to implement appropriate technical and organisational security measures, maintain confidentiality, and comply with applicable data protection laws.
• The Data Processor shall not transfer personal data outside India without Yara's prior written consent.
• Any sub-processors engaged by the Data Processor must be pre-approved by Yara in writing.

5. Data Retention

Personal data collected through the SafetyConnect application shall not be retained for more than six (6) months from the date of collection, in line with the contractual data retention obligations.

Upon an employee leaving the services of Yara, the HESQ team shall delete the employee's account and all associated personal data from the SafetyConnect platform.

Upon termination or expiry of the Services Agreement, the Data Processor shall return or irretrievably delete all personal data in accordance with Yara's instructions and provide a written certificate confirming proper deletion.

Yara may instruct the Data Processor to retain certain data for a longer period if required for pending or anticipated litigation, investigation, or audit purposes.

6. Employee Rights

Under the Digital Personal Data Protection Act, 2023, employees/users as Data Principals have the following rights:

• 6.1 Right to Access: Employees may request access to the personal data held about them.
• 6.2 Right to Correction: Employees may request correction of inaccurate or incomplete personal data.
• 6.3 Right to Erasure: Employees may request erasure of their personal data, subject to applicable legal and regulatory requirements.
• 6.4 Right to Grievance Redressal: Employees may raise grievances regarding the processing of their personal data (see Section 9).
• 6.5 Right to Nominate: Employees may nominate another individual to exercise their rights in the event of death or incapacity.
• 6.6 Right to Object: Employees may object to the processing of their personal data where processing is based on legitimate interests.

To exercise any of these rights, employees should contact the Grievance Officer (see Section 9).

7. Data Security Measures

Yara and its Data Processor have implemented the following technical and organisational measures to protect personal data:

1. Hardware firewalls and security settings
2. Regular deployment of security and maintenance patches
3. Disaster recovery planning and periodic testing
4. Encryption of all data transmissions and storage, including on mobile devices
5. Antivirus protection meeting commercial standards
6. Physical security and access controls for data centres and facilities
7. User authentication through user IDs and strong passwords, with auditing and logging
8. Segregated computing equipment for processing personal data
9. Quarterly vulnerability assessments
10. Annual independent security audit (SSAE 16, ISO 27001, or equivalent)
11. Virus protection, spam filters, and next-generation firewalls
12. Incident management and security breach handling processes
13. Proper change management processes
14. Staff training on information and personal data security
15. Certified data sanitisation processes (DoD 5220.22-M or better) for secure deletion

Access to employee personal data within the SafetyConnect dashboard is restricted to authorised HESQ staff (limited to 2 persons in India) on a need-to-know basis. Access by other persons (e.g., HR, Finance, line managers) is governed by Yara's internal access policy.

8. Cross-Border Data Transfers

All personal data collected through the SafetyConnect application is stored and processed in India.

In the event that a cross-border transfer becomes necessary, Yara shall ensure that adequate safeguards are in place to provide the same level of data protection as required under applicable Indian data protection law.

9. Grievance Officer

In accordance with the DPDP Act, 2023, Yara has designated a Grievance Officer to address any concerns, complaints, or queries regarding the processing of personal data.

Name: Mr. K.P. Shekhar
Designation: GM, Legal
Email: kumar.purnendu.shekhar@yara.com
Address: 502, Global Business Square, Plot No. 32, Institutional Area, Sector 44, Gurugram, Haryana — 122003

The Grievance Officer shall acknowledge receipt of any complaint or grievance within 48 hours and endeavour to resolve it within 30 days of receipt.

If the employee is not satisfied with the resolution, they may escalate the matter to the Data Protection Board of India, as established under the DPDP Act, 2023.

10. Policy Updates and Communication

Yara reserves the right to update or amend this policy from time to time to reflect changes in applicable laws, regulations, technology, or business practices.

Any material changes to this policy will be communicated to employees through the application or official email, internal communication channels, or notice on the company intranet.

Employees are encouraged to review this policy periodically. The updated version of this policy will indicate the date of the last revision in the version control table.

Continued use of the SafetyConnect application after notification of changes shall constitute acceptance of the updated policy.