Privacy Policy

1. About this policy

1.1 This Privacy Policy explains how BrightSense Private Limited, a company incorporated in India (CIN U62013KA2026PTC228550), with its registered office at Building No 46, 1st Floor, 12th Main Rd, Sector 6, HSR Layout, Bangalore South, Bangalore 560102, Karnataka (the "Company", "we", "us" or "our"), collects, uses, shares and protects personal data received through brightsense.tech (the "Website").

1.2 This policy applies to the Website only. When you use Branly, the Company's product, the Branly Privacy Policy applies instead.

1.3 This policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It has also been prepared with regard to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as their provisions come into force.

2. Personal data we collect

Category	Data	Purpose	Retention
Contact form	Name, work email address, company name (optional), the topic selected and the message.	To respond to your enquiry and route it to the appropriate team.	12 months from your last communication.
Email correspondence	Your name, email address and the content of any email sent to an address published on the Website.	To respond to your enquiry.	12 months from your last communication.
Job applications	Your CV, contact details and any other information you include in an application sent to [email protected].	To assess your application for the role applied for and, with your agreement, for similar roles.	12 months from the date of application, unless you request earlier deletion. If you join the Company, your data is transferred to your employment records.
Technical data	IP address, browser type, device information and pages visited.	To operate the Website, maintain its security and resolve technical issues.	12 months.

2.1 Please do not submit sensitive personal data or information, such as financial, health, biometric or identity document details, through the Website or by email. The Company does not require it for any of the purposes above.

2.2 You are responsible for ensuring that the personal data you provide is accurate and complete.

3. How we use personal data

3.1 The Company uses personal data only for the purposes listed in section 2.

3.2 The Company does not use personal data received through the Website for marketing, advertising, profiling or automated decision-making, and does not add you to any mailing list unless you separately ask to be added.

4. Consent

4.1 By submitting the contact form, writing to the Company or sending a job application, you consent to the Company processing your personal data for the purposes set out in section 2.

4.2 You may withdraw your consent at any time by writing to [email protected]. On withdrawal, the Company will stop processing your personal data and delete it, unless it is required to retain it by law. Withdrawal does not affect processing carried out before it.

5. Disclosure of personal data

5.1 The Company shares personal data only with service providers that support the operation of the Website and its communications, and only to the extent each requires. These providers act on the Company's instructions and are contractually bound to protect the data:

• Amazon Web Services (AWS): hosting of the Website and storage of contact form submissions.
• Google Workspace: the Company's email service, which processes emails sent to the Company and job applications.
• Slack: the Company's internal messaging service, which receives a notification of each contact form submission, including the details entered in the form, so that it reaches the appropriate team.

5.2 Within the Company, access to messages and job applications is limited to the personnel who need it for the purposes above.

5.3 The Company may also disclose personal data where required by law, in response to a lawful request from a court or government authority, or where necessary to protect the rights, property or safety of the Company, its users or the public.

5.4 The Company does not sell, rent or trade personal data.

6. Transfers outside India

Some of the Company's service providers may process personal data outside India. Where this occurs, the Company ensures that the transfer is permitted under Indian law and that the data remains protected by appropriate safeguards. The Company will comply with any restrictions notified by the Government of India on transfers to specific countries or territories.

7. Security

7.1 The Company maintains reasonable security practices and procedures to protect personal data against unauthorised access, alteration, disclosure or destruction. Data is encrypted in transit between your device and the Website, and access is restricted to authorised personnel.

7.2 No method of transmission over the internet, including email, is completely secure. While the Company takes reasonable steps to protect your data, it cannot guarantee the security of information transmitted to it.

7.3 In the event of a personal data breach affecting you, the Company will notify you without undue delay, setting out the nature of the breach, its likely consequences and the measures being taken, and will report it to the relevant authorities as required by law.

8. Retention

The Company retains personal data only for the periods set out in section 2, or for longer where required by law or where necessary to establish, exercise or defend a legal claim. Data is then securely deleted.

9. Your rights

9.1 Subject to applicable law, you may request the Company to:

• (a) provide a summary of the personal data it holds about you and the purposes for which it is processed;
• (b) correct, complete or update your personal data;
• (c) erase your personal data, unless its retention is required by law;
• (d) stop processing your personal data, by withdrawing your consent;
• (e) recognise a person nominated by you to exercise these rights on your behalf in the event of your death or incapacity.

9.2 Requests may be sent to [email protected]. The Company will respond within 30 days of receipt.

10. Cookies

The Website does not use cookies. As with any website, the hosting provider receives your IP address when you visit.

11. Children

The Website is intended for adults. The Company does not knowingly collect personal data from any person under the age of 18. If you believe such data has been provided to the Company, please write to [email protected] and it will be deleted.

12. Changes to this policy

The Company may revise this policy at any time by updating this page. The revised policy takes effect from the date shown at the top.

13. Grievance redressal

13.1 Any grievance, complaint or request concerning the processing of your personal data may be addressed to the Company's Grievance Officer at:

13.2 The Company will acknowledge your grievance and aim to resolve it within 30 days of receipt.

13.3 Once the relevant provisions of the Digital Personal Data Protection Act, 2023 are in force, you may also approach the Data Protection Board of India if you are not satisfied with the Company's response.