Privacy Policy

Privacy at a Glance

1.About PIEDAP and Scope of this Policy

Pion Global Private Limited ("Pion Global", "we", "us" or "our") owns and operates PIEDAP. PIEDAP is Pion Global's AI-powered Enterprise Innovation Ecosystem. It brings together specialized enterprise platforms with shared AI, workflow, analytics, integration, API and governance capabilities so organizations can adopt individual platforms or combine them into connected enterprise solutions.

This Privacy Policy applies when Pion Global determines the purposes and means of processing personal data in connection with PIEDAP. It also explains how Pion Global handles personal data when it acts as a processor or service provider on behalf of enterprise customers.

2.Our Privacy Roles

The privacy role of Pion Global depends on the processing activity. The same organization can act as a Data Fiduciary or controller for some activities and as a Data Processor, processor or service provider for others.

3.Key Privacy Terms

4.Personal Data We May Process

5.Sources of Personal Data

• Directly from you when you visit PIEDAP, create or use an account, request a demo, contact support, register for an event or interact with us.
• From your employer, organization, administrator or another authorized customer user.
• From customer systems and third-party tools connected to PIEDAP through APIs, connectors, webhooks or integrations.
• From implementation partners, resellers, technology partners or service providers where permitted by contract and law.
• From public or professional sources where reasonably relevant to business-to-business engagement and permitted by law.
• Automatically from PIEDAP systems, logs, security tooling and enabled website technologies.

6.Why We Process Personal Data

7.Legal Grounds for Processing

The legal basis or lawful ground depends on the jurisdiction, our role and the processing activity. Where required, we identify the appropriate basis before processing.

8.AI, Automated Processing and Human Oversight

PIEDAP includes AI-assisted and agentic capabilities across planning, project and portfolio management, quality engineering, assessments, talent evaluation, consent operations, governance, risk and compliance. Depending on the feature, AI may analyze data, generate content, summarize information, identify patterns, prioritize risks, recommend actions, produce scores or support workflow decisions.

9.Talenaise and People-Related Evaluations

Talenaise may process employee, worker, candidate or professional evaluation information when configured by a customer. This may include self-evaluations, manager, peer, direct-report or other stakeholder feedback, competency information, performance-related observations and development plans.

The enterprise customer generally determines the purpose, participants, evaluation criteria, lawful basis, notices and employment or development use of the information. Pion Global processes that Customer Personal Data as instructed and does not independently make the customer's hiring, promotion, compensation, disciplinary or termination decisions. Customers are responsible for applying appropriate human oversight and complying with employment, labour, anti-discrimination, works council and privacy requirements applicable to their use.

10.DPConsent and Consent / Privacy Operations

DPConsent may be used by enterprise customers to capture, manage, synchronize, evidence and govern consent and privacy-related workflows. Where an enterprise customer determines the purposes for which consent records and Data Principal or data-subject information are processed, the customer generally acts as the Data Fiduciary or controller and Pion Global acts as a processor or service provider for that Customer Personal Data.

References to DPConsent as a Consent Management Platform do not mean that Pion Global is a registered "Consent Manager" under the Indian Digital Personal Data Protection framework unless Pion Global expressly states that it has obtained the applicable statutory registration.

11.Cross-Platform Workflows and Ecosystem Data Flows

PIEDAP is designed as a connected ecosystem. A customer may configure workflows, analytics, integrations or shared services that exchange authorized data between PIEDAP platforms. Such cross-platform processing occurs based on customer configuration, permissions, role-based access, applicable agreements and platform controls.

• PIEDAP does not automatically combine Customer Personal Data across unrelated customers.
• Cross-platform access is subject to tenant, role, permission, licenses and configuration controls appropriate to the deployment.
• Customers are responsible for determining whether a proposed cross-platform data flow is lawful and appropriate for their use case.
• Where shared identity, analytics, AI context or governance services process data across platforms, Pion Global applies the applicable customer instructions and contractual restrictions.

12.Developer Portal, APIs and Partner Ecosystem

PIEDAP may provide APIs, webhooks, sandbox environments, integration documentation, developer credentials and partner enablement services. We may process developer or partner contact information, access credentials or token metadata, integration configuration, usage logs, support records and technical diagnostics to provide and secure those services.

Developers, customers and partners are responsible for ensuring that applications, connectors and extensions they build or operate have a lawful basis for processing personal data and comply with applicable privacy, security and contractual requirements. Third-party partner solutions may have their own privacy notices.

13.External Integrations and Customer-Authorized Systems

PIEDAP may connect with engineering, DevOps, cloud, ITSM, CRM, HR, ERP, analytics, collaboration and other enterprise systems selected by the customer. When a customer enables an integration, PIEDAP may receive, transmit, synchronize or reference data from that system as necessary to perform the configured workflow.

• The customer is responsible for authorizing the integration and configuring appropriate scopes and permissions.
• Data received from a connected service may be subject to both this Policy and the privacy practices of the connected provider.
• Pion Global does not control independent processing carried out by third-party services outside PIEDAP.
• Integration logs and metadata may be processed for security, troubleshooting, reliability and auditability.

14.Cookies and Similar Technologies

PIEDAP websites and interfaces may use cookies, local storage, pixels, tags or similar technologies for strictly necessary functions, security, authentication, preferences, performance and, where enabled, analytics or marketing measurement. The specific technologies used may vary by site, environment or deployment.

Where consent is required for non-essential technologies, Pion Global will provide an appropriate notice and preference mechanism. A separate Cookie Policy or cookie-preference interface may provide current details about categories, providers and retention periods.

15.How We Share Personal Data

Pion Global may disclose Personal Data only where reasonably necessary and permitted by law and contract. Recipients may include:

• Authorized Pion Global personnel and affiliated teams that need the information to perform their responsibilities.
• Cloud, infrastructure, communications, support, security, analytics, AI, payment or other service providers acting under appropriate contractual controls.
• Approved subprocessors used to deliver Customer Personal Data processing under applicable customer agreements.
• Implementation, integration or ecosystem partners where the customer has authorized their involvement or the disclosure is otherwise permitted.
• Professional advisers, auditors, insurers, financial institutions and other business advisers subject to appropriate confidentiality obligations.
• Regulators, law-enforcement bodies, courts or public authorities when required by applicable law or a valid legal process.
• Potential or actual acquirers, investors or transaction advisers in connection with a merger, acquisition, restructuring, financing or sale, subject to appropriate safeguards.

Pion Global does not sell Customer Personal Data. If Pion Global engages in an activity that is legally treated as a "sale" or "sharing" under an applicable privacy law, we will provide the notices and opt-out mechanisms required by that law.

16.Subprocessors and Service Providers

Pion Global may engage subprocessors and service providers to support hosting, infrastructure, communications, security, support, AI-enabled functionality, analytics and other operational needs. The specific providers may change over time.

Where required by contract or law, Pion Global maintains contractual terms addressing confidentiality, security, data protection and permitted processing. Customer-specific notification, objection or approval rights for subprocessors are governed by the applicable Data Processing Agreement or customer contract. Current subprocessor information should be published or made available through PIEDAP's Trust or legal resources.

17.International Data Transfers

PIEDAP may process Personal Data in countries other than the country in which it was originally collected, depending on customer deployment, support arrangements, subprocessors, integrations and service configuration.

Where required, Pion Global uses legally recognized transfer mechanisms and safeguards, which may include adequacy decisions, contractual protections such as Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or other mechanisms permitted by applicable law. Customer-specific data-location and transfer commitments are governed by the applicable agreement.

18.Enterprise Deployment, Data Residency and Segregation

PIEDAP may be offered through shared SaaS, dedicated SaaS or other customer-specific deployment models. The applicable agreement defines customer-specific hosting, residency, environment segregation, security, backup, support and operational commitments.

• Shared SaaS environments use logical tenant separation and access controls appropriate to the service design.
• Dedicated SaaS may provide additional customer-specific isolation, configuration or integration options.
• Customer-selected integrations may cause data to move to systems or locations controlled by the customer or third parties.
• Data residency does not necessarily mean all support, telemetry, security or subprocessor activity occurs in the same location unless expressly agreed.

19.Data Retention

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Policy, to meet contractual commitments, maintain security and auditability, resolve disputes, enforce agreements and comply with applicable law. Retention can vary by data category, deployment and customer instruction.

Deletion from active systems may not immediately remove information from backups or disaster-recovery copies. Such copies are protected and expire or are overwritten according to applicable backup cycles unless legal preservation is required.

20.Security of Personal Data

Pion Global applies technical and organizational measures designed to protect Personal Data against unauthorized access, use, disclosure, alteration, loss or destruction. Measures vary by service, deployment and risk and may include access controls, authentication, encryption, logging, monitoring, vulnerability management, secure development practices, backup and recovery controls, segregation and incident response processes.

No method of transmission, storage or processing is completely secure. Specific security commitments, technical controls, certifications, data-location obligations or customer requirements are governed by the applicable agreement and current security documentation rather than by unverified statements in this public Policy.

21.Personal Data Breaches and Security Incidents

Pion Global maintains processes to identify, investigate, contain and remediate suspected security incidents. Where Pion Global acts as controller, we make notifications to regulators or affected individuals where required by applicable law. Where Pion Global acts as processor for Customer Personal Data, we notify and assist the relevant customer in accordance with the applicable Data Processing Agreement and law.

22.Your Privacy Rights

Your rights depend on your jurisdiction, our role in the relevant processing and applicable exemptions. Rights are not absolute and may be limited where Pion Global or a customer must retain information to comply with law, establish or defend claims, protect security or satisfy other lawful obligations.

23.How to Exercise Rights or Raise a Privacy Grievance

• Contact Pion Global using the details in Section 30 or use a Privacy Request channel published on PIEDAP.
• Provide enough information for us to understand the request and identify the relevant relationship, account, platform or processing activity.
• We may take reasonable steps to verify identity or authority before acting on a request and will request only information reasonably necessary for that purpose.
• Where permitted by law, an authorized representative may submit a request on your behalf, subject to appropriate verification.
• We will respond within the period required by applicable law. Response periods may vary by jurisdiction, request type and permitted extension.
• If the request concerns Customer Personal Data controlled by a PIEDAP customer, we may refer the request to that customer or support the customer in responding.

If you are dissatisfied with our response, you may have the right to escalate the matter through an applicable grievance mechanism or lodge a complaint with the relevant privacy or data-protection authority, subject to applicable law.

24.Direct Marketing and Communications

You can ask us at any time to stop using your Personal Data to send marketing communications. Once you opt out, we will stop using your Personal Data for direct marketing, subject to reasonable processing time and legally required suppression records. We may still send service-related, contractual, security, billing or legally required communications.

25.Children and Minors

PIEDAP is designed for enterprise and professional use and is not directed to children. Pion Global does not knowingly invite children to create direct PIEDAP accounts or submit Personal Data through public PIEDAP websites.

If a customer configures a PIEDAP platform to process Personal Data relating to minors, the customer is responsible for ensuring that the processing is lawful, appropriately authorized and covered by required notices or consent. Where Indian DPDP provisions apply, the statutory definition of a child and related obligations will be applied as required by law. If you believe a child has provided Personal Data directly to Pion Global without appropriate authorization, contact us using Section 30.

26.Third-Party Websites and Services

PIEDAP may contain links to third-party websites or enable third-party services. This Privacy Policy does not govern independent third-party processing. You should review the privacy notice of the relevant third party before providing information directly to it.

27.Aggregated and De-Identified Information

Pion Global may create aggregated or de-identified information from Personal Data where permitted by law and contract. We may use such information for analytics, benchmarking, service improvement, security and business insights where it cannot reasonably identify an individual. We do not attempt to re-identify de-identified information except where permitted for validation, security or legal purposes.

28.Corporate Transactions and Legal Requests

If Pion Global is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, Personal Data may be disclosed to relevant advisers, counterparties or successors subject to appropriate confidentiality, legal and data-protection safeguards.

We may also preserve or disclose Personal Data where we reasonably believe it is necessary to comply with a binding legal obligation, valid legal process, court order, regulatory request, or to protect rights, safety, security, fraud prevention or legal claims. Where permitted, we assess requests for legal validity and scope.

29.Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in PIEDAP, platform architecture, AI functionality, integrations, deployment models, legal requirements or privacy practices. The updated version will be published with a revised "Last Updated" date. Where required by law or appropriate for a material change, we will provide additional notice.

30.Contact, Privacy Requests and Grievances

For privacy questions, rights requests or grievances relating to processing for which Pion Global acts as Data Fiduciary or controller, contact:

For Customer Personal Data, enterprise customers should use the privacy and support channels specified in their applicable customer agreement or Data Processing Agreement. Pion Global may introduce a dedicated privacy mailbox or Privacy Request portal; if so, the current contact method will be published on PIEDAP.

31.Related PIEDAP Legal and Trust Documents

This Privacy Policy should be read together with the PIEDAP Terms of Use, Acceptable Use Policy, Cookie Policy where applicable, Responsible AI / AI Transparency Notice, Responsible Vulnerability Disclosure Policy, Data Processing Agreement, Subprocessor List, security documentation and applicable customer contracts.

This Policy is intended to provide transparent information about PIEDAP privacy practices. Customer-specific processing commitments are governed by the applicable signed agreement and Data Processing Agreement.