This Privacy Notice (‘Notice’) explains what personal data HCLTech & its subsidiaries (‘We’) collect about you, how We’’ use that data, who We will share it with, the circumstances when We will share it and what steps We will take to make sure it stays secure.

This Notice (‘California Privacy Notice’) supplements the information contained in the HCLTech Visitor Global Privacy Notice and applies solely to California resident(s) (‘you’).

For Residents of Other US States

If you are a resident of a US state with an applicable privacy law (including TX, VA, CT, or UT), you may have additional rights regarding your personal data, including rights of access, correction, deletion and opt-out of certain processing. See "How to Exercise Your Rights," below.

Categories of Personal Data Collected:

We collect data that relates to, is capable of being associated with, or could reasonably be linked to you or one of your devices (Data). In particular, we have collected the following categories of personal data and/or sensitive personal information (SPI) within the last twelve (12) months

• Identifiers, such as online identifier, name, and postal address;
• Customer Records, such as address, and contact details;
• Government-issued ID documents and photographs collected at our premises constitute Sensitive Personal Information (SPI) under the CPRA;
• Internet or other electronic network activity data, such as your interaction with the App;
• Professional or employment related data;
• Audio, electronic, visual and similar data, such as CCTV recordings.

Categories of Sources of Personal Data

We collect this personal data directly from you or third-party sources on the HCLTech Visitor Management System or any associated applications (in case of pre-registration or a large group) as a part of entry/exit process at HCLTech premises.

Use of Personal Data

We use your personal data to verify your identity, identify repeat visitors, maintain visitor log, and to manage your access to our premises in accordance with our policies and security settings.

Disclosure of Personal Data

We may disclose your personal data to other HCLTech companies and our service providers such as our external auditors, external security service providers, legal service providers etc., for operational business purposes.

When we disclose personal data for a business purpose, we enter into a contract that describes the purpose and requires the recipient of personal data to both keep that personal data confidential and not use it for any purpose except performing the contract.

Sharing and Sale of Personal Data

For the purposes of CCPA, We do not “sell” or “share” your personal data and have not “sold” or “shared” your personal data in the last 12 months.

Your Rights and Choices

CCPA provides you with specific rights regarding your personal data. This section explains those rights.

Access to Specific Data and Data Portability Rights: You have the right to request that we disclose certain data to you about our collection, use, disclosure, and/or sale of your personal data (if applicable) over the past 12 months. You also have the right to request that we limit your use and disclosure of your SPI to what is necessary to verify your identity and manage site access. See "How to Exercise Your Rights," below. Once we receive and confirm your verifiable request, we will disclose to you:

• The categories of personal data we have collected about you.
• The categories of sources for the personal data we collected about you.
• Our business or commercial purpose for collecting, selling or sharing (if applicable) your personal data.
• The categories of third parties to whom we disclose your personal data.
• The categories of personal data that the business disclosed about you for a business purpose; and
• The specific pieces of personal data we collected about you (also known as right to ‘data portability’).

Correction or Deletion: You can request rectification (correction, updating or modification) or deletion of the personal data that we have collected from your use of our services. We will comply with your request as required by law, but this right does not apply where we need to retain the personal data in order to provide goods or services to you, detect or resolve security issues or functionality-related issues, comply with the law, and carry out internal business requirements.

Should you choose to exercise any of your rights, HCLTech will not discriminate against you in any way.

How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable request to us through our Data Subject Request Portal or alternatively, email us at privacy@HCLTech.com.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request. The verifiable request must:

• Provide sufficient data that allows us to reasonably verify you are the person about whom we collected personal data (or an authorized representative).
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request if we cannot verify your identity and confirm the personal data relates to you. We will only use personal data provided in a verifiable request to verify the requestor's identity and/or authority to make the request.

We endeavor to respond to a verifiable request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing, by mail or electronically, at your option. We will deliver our written response by mail or electronically.

You can designate an authorized agent to make a request under the CCPA on your behalf provided that (1) it is a natural person or a business entity registered with the Secretary of State of California; and (2) you have authorized the authorized agent to act on your behalf.

Authorized agents may use the Data Subject Request Portal for further instructions. To protect your data, please note that we may take steps to verify your identity, and we will also ask for a signed permission from you authorizing the authorized agent to submit a request on your behalf. If your authorized agent holds the power of attorney executed under CA Probate Code, no additional signed permission will be required.

How long do we retain your Personal Data?

We retain your personal data only for as long as is necessary to fulfil the purpose for which it was collected. Specifically:

• Visitor Logs: Retained for a maximum of 18 months from your date of visit
• CCTV footage: Retained for a maximum of 90 days, unless a shorter period is required by local law.
• Any other personal data collected during your visit: Retained for no longer than necessary as determined by the applicable business or legal requirement.

Once the purpose is achieved, we delete the personal data. We will ensure that there are appropriate measures in place to secure the data and protect it from further use.