1. Who we are and what this Policy covers

SBC LLP is a limited liability partnership registered in India under the Limited Liability Partnership Act, 2008, providing international tax, transfer pricing, UAE corporate tax, GCC compliance, valuation, virtual CFO and tax-technology services. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") SBC LLP is the Data Fiduciary, and for the purposes of the EU and UK General Data Protection Regulation ("GDPR") it is the Controller, of the personal data described in this Policy.

This Policy applies to personal data we collect when you:

• visit or interact with our website, microsites, landing pages and web forms;
• contact us by email, telephone, LinkedIn or through our offices;
• attend or register for our events, webinars, TEDx-style talks and training programmes;
• subscribe to our newsletters, research notes, video series or transfer pricing updates;
• are a client, prospective client, supplier, or a director, employee or representative of one; or
• apply for a role with us (a separate Candidate Privacy Notice is provided at the application stage).

This Policy does not cover personal data processed by SBC LLP purely on the documented instructions of a client (for example, payroll or employee data shared with us for a compliance engagement). In those cases the client is the Data Fiduciary / Controller and SBC acts as a Data Processor under a written engagement letter and data processing terms.

2. What personal data do we collect?

We collect only the personal data that is reasonably necessary for the purpose for which it is collected. The categories are set out below.

Sensitive personal data. We do not ask for, and ask you not to send us, sensitive personal data such as financial account passwords, biometric data, health information or information about religion, caste or political opinions, unless a specific engagement requires it and you have been informed in writing. Where "sensitive personal data or information" as defined in the SPDI Rules, 2011 (for example, PAN or bank account details required for a mandate) is collected, it is collected with your explicit consent and protected as described in Section 9.

3. Why do we use your personal data, and on what legal basis?

Under the DPDP Act we process personal data either with your consent (s.6) or for a legitimate use listed in s.7. Under the GDPR we rely on one of the lawful bases in Article 6. The table below sets out each purpose with its corresponding basis.

4. Cookies, analytics and tracking technologies

4.1 What are cookies and how do we use them?

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies (pixels, tags, local storage) to make the site work, to understand how it is used, and — only with your consent — to measure and personalise our advertising.

4.2 Categories of cookies we use

4.3 How can you control cookies?

• Use our cookie banner on your first visit, or the "Cookie settings" link in the footer, to accept or reject each category. "Reject all" is available with the same prominence as "Accept all".
• Change your browser settings to block or delete cookies (Chrome, Safari, Edge and Firefox each publish instructions).
• Opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on, and manage Google ad personalisation at myadcenter.google.com.
• Manage LinkedIn advertising at linkedin.com/psettings/advertising and Meta advertising in your Facebook/Instagram Ad Preferences.
• Where the "Global Privacy Control" (GPC) signal is enabled in your browser, we treat it as a request to reject advertising cookies.

Blocking strictly necessary cookies may affect how the site functions. A full list of cookies currently in use is maintained in our Cookie Policy [link], which is updated after every quarterly cookie scan.

5. Advertising and remarketing

We promote our services through paid advertising on Google Search and Display, YouTube, LinkedIn and Meta platforms. With your consent, these platforms place tags on our site so that we can (a) measure whether a visit or enquiry resulted from an advertisement and (b) show you relevant SBC content if you have previously visited our site ("remarketing"). We use Google Consent Mode v2, which means that where you decline advertising cookies, only aggregated, cookieless "pings" are sent to Google and no advertising identifiers are stored.

Google's use of data collected through our site is described at policies.google.com/technologies/partner-sites. We do not upload customer lists to advertising platforms for "customer match" audiences without a specific opt-in, and we never use special-category or professional-confidential information for advertising. Our ads comply with the Google Ads Personalised Advertising Policy, the LinkedIn Advertising Policies, the ASCI Code (India) and the ICAI Council Guidelines on advertisement by members in practice.

6. Who do we share personal data with?

We share personal data only where necessary and with appropriate safeguards. We never sell it.

7. International data transfers

SBC operates from India, the UAE and the United States, and our cloud providers may store data in other countries. Personal data collected in India may therefore be transferred outside India.

• From India: Section 16 of the DPDP Act permits transfer to any country other than those restricted by notification of the Central Government. We monitor the list of restricted countries under Rule 14 of the DPDP Rules, 2025 and will not transfer personal data to a restricted jurisdiction. Where a client engagement or sector regulation (e.g. RBI, SEBI or IRDAI localisation directions) requires data to stay in India, we comply.
• From the EEA/UK: India, the UAE and the United States (outside the EU-US Data Privacy Framework) are not the subject of an adequacy decision. We rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, supported by a transfer impact assessment and supplementary measures (encryption in transit and at rest, access controls). A copy of the relevant clauses is available on request.
• From the UAE: Transfers by SBC Tax Consulting LLC comply with Articles 22 and 23 of Federal Decree-Law No.45 of 2021 — to jurisdictions with adequate protection, or under contractual safeguards and, where required, your express consent.

8. How long do we keep personal data?

We keep personal data only for as long as needed for the purpose for which it was collected, and thereafter only where a law requires retention or a legitimate legal claim could arise. Under Rule 8 of the DPDP Rules, 2025 we will erase personal data when the purpose is served, and we will give you at least 48 hours' notice before erasure where the Rules require it.

9. How do we protect personal data?

We apply "reasonable security safeguards" as required by s.8(5) DPDP Act, Rule 6 of the DPDP Rules, 2025 and Rule 8 of the SPDI Rules, 2011, benchmarked to ISO/IEC 27001. These include:

• encryption of data in transit (TLS 1.2+) and at rest; multi-factor authentication on all firm systems;
• role-based access on a need-to-know basis, with logging and periodic access reviews;
• confidentiality undertakings and data-protection training for all partners and staff;
• vendor due diligence and written processing terms with every service provider;
• secure disposal procedures; regular backups and tested business-continuity plans; and
• a documented incident-response plan. If a personal data breach occurs, we will notify affected individuals without delay and the Data Protection Board of India within 72 hours as required by Rule 7, report to CERT-In within six hours where the CERT-In Directions apply, and notify EEA/UK supervisory authorities within 72 hours where GDPR Article 33 applies.

10. What are your rights, and how do you exercise them?

Depending on where you are located, you have the following rights. We honour them for all individuals regardless of location, to the extent practicable.

10.1 How to make a request

Email [privacy@ email] or write to the Grievance Officer at the address in Section 15, stating the right you wish to exercise. We may ask for information to verify your identity. There is no fee. We acknowledge within 48 hours and respond within 30 days; the outer statutory limit is 90 days under Rule 13 of the DPDP Rules, 2025 and one month (extendable by two) under GDPR Art.12(3).

10.2 Escalation

• India: if you are not satisfied with our response, you may complain to the Data Protection Board of India (dpb.gov.in [confirm URL]) under s.13(3) DPDP Act.
• EEA/UK: you may lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement (Art.77 GDPR); in the UK, the Information Commissioner's Office (ico.org.uk).
• UAE: you may contact the UAE Data Office under Federal Decree-Law No.45 of 2021.

Your duties. Section 15 of the DPDP Act asks Data Principals to provide only verifiably authentic information, not to impersonate another person and not to register false or frivolous grievances.

11. Client engagement data and professional confidentiality

Information you share with us in the course of a professional engagement is protected not only by data-protection law but by the duty of confidentiality in Section 114 of the ICAI Code of Ethics and by the confidentiality terms of our engagement letter. We do not disclose engagement information to third parties except with your authority, where required by law or professional standards, or to the limited extent necessary to obtain professional advice or insurance. Where a client instructs us to process personal data of its employees, customers or counterparties, we act as a Data Processor under written terms and the client's own privacy notice governs.

Where we use AI-assisted research or drafting tools in delivering services, they are enterprise instances configured so that client data is not used to train third-party models, and outputs are reviewed by qualified professionals before use.

12. Children

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from children under 18 years of age (s.9 DPDP Act) or, in the EEA/UK, below the applicable digital consent age (13–16). If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Third-party websites and social media

Our site contains links to third-party sites, including LinkedIn, YouTube and regulatory portals. We are not responsible for their privacy practices. Where we operate pages on social media platforms (for example our LinkedIn company page), the platform is a joint or independent controller for platform-generated insights; please read the platform's privacy notice as well as ours.

14. Changes to this Policy

We review this Policy at least annually and whenever the law or our processing changes — including on the commencement of Phase 2 (13 November 2026) and Phase 3 (13 May 2027) of the DPDP Rules, 2025. Material changes will be highlighted on this page with a new "Last updated" date and, for subscribers and clients, notified by email. Previous versions are available on request.

15. Contact and Grievance Officer

16. Frequently asked questions

Does SBC sell my personal data?

No. SBC LLP does not sell, rent or trade personal data, and does not share it for cross-context behavioural advertising.

Which law governs SBC's handling of my data?

For data collected in India, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, together with the IT Act 2000 and SPDI Rules 2011 until they are superseded. For visitors in the EEA or UK, the GDPR / UK GDPR also applies. For UAE enquiries, Federal Decree-Law No.45 of 2021 applies.

Who is SBC's Grievance Officer and how do I reach them?

The [Grievance Officer title] at SBC LLP, reachable at [privacy@ email] or [Telephone]. Requests are acknowledged within 48 hours and answered within 30 days.

Does SBC use Google Analytics and advertising cookies?

Yes, but only after you consent through the cookie banner. SBC uses Google Analytics 4 for analytics and Google Ads, LinkedIn Insight Tag and Meta Pixel for advertising measurement and remarketing, with Google Consent Mode v2 enabled. You can reject these at any time via "Cookie settings".

Is my data transferred outside India?

It may be — to SBC group entities in the UAE and the USA and to cloud providers. Transfers comply with Section 16 of the DPDP Act and, for EEA/UK data, with the EU Standard Contractual Clauses and UK Addendum.

How long does SBC keep my data?

Website enquiries: up to 24 months. Client engagement files: 8 years after the engagement ends. KYC records: 5 years after the relationship ends. Marketing data: until you unsubscribe. Full details are in Section 8.

How do I delete my data or unsubscribe?

Click "unsubscribe" in any email, or email [privacy@ email] asking for erasure. Data required by law to be retained (for example accounting records) will be kept only for the statutory period.

Can I complain to a regulator?

Yes. In India, to the Data Protection Board of India after first raising the grievance with SBC. In the EEA/UK, to your local supervisory authority or the ICO. In the UAE, to the UAE Data Office.