Privacy & Data Protection Policy

Effective Date: 01/02/2025
Approved By: President, KPG99 Inc.

---

1. Purpose

The purpose of this policy is to ensure that all personal and sensitive data handled by KPG99 Inc. is collected, processed, stored, and disposed of in a secure and lawful manner. As a staffing and recruitment organization, KPG99 Inc. manages significant amounts of client, candidate, and employee data, including Personally Identifiable Information (PII) and other regulated information. Protecting this data is a core compliance and ethical responsibility.

---

2. Scope

This policy applies to all employees, contractors, subcontractors, and vendors who have access to personal or confidential data belonging to KPG99 Inc., its clients, or its candidates. It covers all systems, communication channels, and storage methods used by the company.

---

3. Policy Statement

KPG99 Inc. is committed to maintaining the privacy and security of personal and sensitive data in compliance with applicable laws and client requirements. All personnel must handle data responsibly, limit access to authorized individuals, and use information strictly for legitimate business purposes.

---

4. Categories of Protected Data

This policy applies to all forms of personal and sensitive data, including but not limited to:

• PII (Personally Identifiable Information): Name, address, email, contact details, date of birth, government IDs.
• Employment Data: Candidate resumes, salary details, references, and client feedback.
• Financial Data: Bank account details, invoices, and tax information.
• Sensitive Business Data: Client contacts, job orders, and proprietary information.
• PHI (Protected Health Information): If applicable for certain roles or background checks.

---

5. Data Protection Principles

KPG99 Inc. follows these core principles:

1. Lawful, Fair, and Transparent Processing: Data will be collected only for legitimate business or contractual purposes.
2. Purpose Limitation: Data will only be used for the purpose it was collected.
3. Data Minimization: Only relevant and necessary information will be stored.
4. Accuracy: Data will be maintained accurately and updated as required.
5. Storage Limitation: Data will not be retained longer than necessary.
6. Integrity and Confidentiality: Data will be protected through appropriate security controls.

---

6. Data Handling and Access Control

• Access to sensitive information is role-based and granted on a need-to-know basis.
• Data stored electronically is protected by passwords, encryption, and access logs.
• Paper records containing confidential information are stored in secure, restricted areas.
• Personal data may only be shared externally with authorized client representatives or legal entities under contractual obligation.

---

7. Data Breach Management

Any accidental or unauthorized access, disclosure, or loss of personal data must be reported immediately to the Compliance & Operations Team at compliance@kpgtech.com.

The Compliance Team will:

• Investigate the breach.
• Notify affected clients (if applicable).
• Implement corrective and preventive actions.
• Document the incident in the Data Breach Register.

---

8. Training and Awareness

All personnel receive privacy and data protection training at the time of onboarding and during periodic refresher sessions. The training covers:

• Proper data handling and sharing.
• Use of secure communication tools.
• Reporting procedures for suspected breaches.

---

9. Non-Compliance

Violation of this policy, intentional or accidental, may lead to disciplinary action, including warnings, suspension, or termination. In severe cases, legal action may also be pursued.

---

10. Review

This policy is reviewed annually to ensure ongoing compliance with evolving data protection laws, industry standards, and client requirements.

---

Approved and Authorized by:
Puneet Gulati
President, KPG99 Inc.
Date: 01/02/2025