Privacy Policy

This Privacy Policy explains how Roshwin Private Limited (CIN U69100DL2026PTC466238), a company incorporated in India with its registered office at Plot No. 94, 3rd Floor, Pocket-10, Sector-13, Dwarka, New Delhi - 110078, India ("Roshwin", "we", "us" or "our"), collects, uses, shares and protects personal data when you visit roshwin.ai and any related websites, pages, forms, portals, newsletters, social media pages, messaging channels and digital properties we operate (together, the "Website"), or otherwise communicate or do business with us.

Roshwin provides legal-operations, legal-technology and related support services, including litigation support, contract management, compliance and legal digital transformation, delivered with the help of technology and artificial intelligence. Our team and clients are located in several countries.

Two roles. (a) For personal data of website visitors, enquirers, subscribers, job applicants, business contacts and similar individuals, Roshwin decides why and how the data is used and acts as the "data fiduciary", "controller" or equivalent under applicable law. (b) For documents and data that clients give us to perform services ("Client Materials"), we generally act on the client's instructions as a "data processor", "service provider" or equivalent. Client Materials are governed by the applicable engagement letter, master services agreement, statement of work, confidentiality agreement or data processing agreement (together, "Client Agreement"). If this Policy conflicts with a Client Agreement, the Client Agreement prevails for that engagement.

Scope. This Policy applies to the websites, domains and services of Roshwin and any subsidiaries or affiliates that operate them, and to personal data of website visitors, prospective and existing clients, business partners, vendors, event attendees, job applicants and other individuals who deal with us, whether the data is collected online or offline. Some features may have supplementary privacy notices that add to, or take precedence over, this Policy for that feature. Personal data of our own staff is handled under separate staff notices.

By using the Website or contacting us, you acknowledge this Policy. Where the law requires your consent, we will ask for it separately and clearly.

The data we collect depends on how you interact with us. It may include:

• Contact and enquiry data: name, email address, phone or WhatsApp number, organization, job title, country, and the contents of your message or enquiry.
• Business relationship data: details of proposals, meetings, engagements, invoices, payments and correspondence, and billing and tax details of client organizations.
• Marketing and subscription data: newsletter or mailing-list subscriptions, preferences, consent records, events attended, and your interaction with our emails and content.
• Careers and recruitment data: CV or resume, employment and education history, contact details, work authorization and references, and any other information you submit when applying for a role or internship.
• Technical and usage data: IP address, browser and device type, operating system, language, pages viewed, time spent, referring and exit pages, approximate location, and cookie and similar-technology identifiers.
• Communications data: records of emails, calls, video meetings, chats and messages (including WhatsApp and similar messaging services) between you and us.
• Publicly available and third-party data: business contact information from professional networks, company websites, public registries, event lists and business-information providers, used for business outreach in line with applicable law.
• Client Materials: documents, contracts, case files, regulatory records and other information shared by clients, which may include personal data of the client's employees, customers, counterparties, litigants or other individuals.

We do not intentionally collect sensitive personal data through the Website. Please do not submit sensitive information (such as health, financial account, biometric or government identification numbers) through the Website or by unsecured channels. If a client needs us to handle such data, it will be handled under the Client Agreement and agreed safeguards.

We use personal data to:

• respond to enquiries, prepare proposals and enter into and perform contracts;
• deliver, manage, support and improve our services, including through the use of technology and AI-assisted tools;
• communicate about engagements, invoices, updates, security and administrative matters;
• send newsletters, insights, invitations, product and service announcements and other marketing communications, and conduct business outreach, as permitted by law and your choices;
• operate, secure, analyze and improve the Website, content and user experience;
• personalize your experience, for example by tailoring content and improving navigation, and seek feedback through customer-satisfaction surveys or market research;
• evaluate job applications and manage recruitment, including sharing applications with recruitment agencies or staffing partners we engage, where appropriate;
• monitor and, where permitted, record calls, video meetings, chats and similar interactions (including with the help of AI note-taking and transcription tools) for training, quality assurance, accurate records and evidence of transactions. We will tell you at the start where a call or meeting is being recorded and obtain consent where the law requires it;
• detect, prevent and investigate fraud, abuse, security incidents and misuse;
• comply with legal, tax, regulatory, audit, professional and contractual obligations, and establish, exercise or defend legal claims; and
• carry out any other purpose that we describe at the time of collection or that is compatible with those purposes.

Depending on where you are and the law that applies, we process personal data on one or more of these grounds: your consent; performance of a contract or steps taken at your request before entering into one; our legitimate interests (for example, operating, securing and growing our business, provided these are not overridden by your rights); compliance with a legal obligation; and, under Indian law, the "legitimate uses" recognized by the Digital Personal Data Protection Act, 2023 and its Rules ("DPDP Act"), including where you voluntarily provide data for a specified purpose and do not indicate that you object to its use.

Where processing is based on consent, you may withdraw consent at any time by writing to privacy@roshwin.ai or using an unsubscribe or opt-out link. Withdrawal does not affect processing done before withdrawal, and we may need to continue to process data where the law permits or requires it.

We may contact you by email, telephone, SMS, WhatsApp or other messaging apps, social media or other channels with newsletters, insights, event invitations, service information and business outreach. We follow the marketing and anti-spam laws that apply to the recipient, which may include, depending on the location of the recipient, India's telecom and commercial communication rules, Canada's Anti-Spam Legislation (CASL), the US CAN-SPAM Act and Telephone Consumer Protection Act, the UK Privacy and Electronic Communications Regulations, EU and UK GDPR, and the laws of the UAE and other countries.

Where the law requires prior consent (express or implied), we seek or rely on it and keep a record. Every marketing email will identify us and include a working unsubscribe mechanism; for messaging apps you can reply "STOP" or tell us you do not wish to be contacted. We will act on opt-out requests promptly and within the time required by law. Transactional and service messages about an existing engagement are not marketing messages and may continue after you opt out of marketing.

We may use third-party platforms to send and manage communications, and we comply with those platforms' terms and policies, including WhatsApp's business messaging policies.

Separate opt-in. Sending us an enquiry, partnership inquiry or talent network profile does not sign you up to a newsletter. If we offer a newsletter, you will be asked to opt in with a separate, unticked box, and we will record when and how you agreed.

This notice explains how we handle personal data when you join our talent network on the Careers page, apply for a role or internship, or send us your CV by email (for example to careers@roshwin.ai). It adds to the rest of this Policy.

What we collect. Through the talent network form: your name, email address, country, experience level, area of interest and, if you choose, a professional profile link and a short note. We do not ask for a CV, identity documents or sensitive personal information on the website. If you later apply for a specific role, we may ask for your CV, employment and education history, references and work authorization, and interview notes will be kept.

Why we use it. To assess your suitability for current and future roles, contact you about opportunities, arrange interviews, and meet our legal obligations. The legal basis is our legitimate interest in recruiting, steps you ask us to take before entering into a contract with you, and your consent where the law requires it.

Who sees it. Only the people who need it for recruitment: the Roshwin recruitment team, and the hiring managers and interviewers involved in the relevant role. Our trusted service providers (such as email and hosting) process it on our behalf under confidentiality obligations. If we work with a recruitment agency for a particular role, we will tell you before sharing your details with that agency. We never sell applicant data or use it for marketing.

How long we keep it. Talent network profiles are kept for 24 months from your last contact with us, and we may ask whether you would like to stay in the network. If you apply for a role and are not hired, we keep your application for 12 months after the recruitment process ends, so we can respond to questions and consider you for similar roles, and then delete it. If you are hired, your data moves into your staff record and is handled under our staff privacy notice. You can ask us to delete your data sooner at any time.

No automated decisions. Recruitment decisions are made by people. We do not make hiring decisions based solely on automated processing, including AI tools.

Where it is stored. Applicant data may be stored and accessed in India, Canada, the United States and other countries where we or our service providers operate, with the safeguards described in the International transfers section.

Your choices. You can ask to see, correct or delete your applicant data, or leave the talent network, by writing to careers@roshwin.ai or privacy@roshwin.ai. Your other rights are described in the Your rights section.

Recruitment fraud. We only contact candidates from an @roshwin.ai email address and never ask for payment at any stage of recruitment.

We use cookies, local storage and similar technologies to make the Website work, keep it secure, remember your choices and, only if you agree, understand how the Website is used so we can improve it. We do not use advertising or marketing cookies on the Website, and we do not use cookies to build advertising profiles.

The Website uses these categories:

• Strictly necessary (always on). Technologies needed for the Website to function and stay secure, including our hosting provider's security and delivery features and a small record in your browser's local storage (named roshwin-consent) that remembers your cookie choice for up to 12 months. These do not require consent and cannot be switched off in our cookie banner.
• Analytics (off unless you agree). Google Analytics 4, provided by Google LLC and Google Ireland Limited ("Google"). If you click Accept or switch on analytics in Cookie Settings, Google Analytics sets the first-party cookies _ga (distinguishes visitors, expires after 2 years) and _ga_VDT0574D5J (keeps session state, expires after 2 years). It collects information such as pages viewed, time on page, referring website, approximate location (city or country, derived from your IP address), device and browser type, screen size and language. Google Analytics 4 does not log or store full IP addresses. We have switched off Google Signals and advertising personalization, and we do not send names, email addresses or form contents to Google Analytics.

Consent first. Google Analytics is not loaded until you give consent. If you decline, close the banner or do nothing, analytics stays off. We use Google Consent Mode so that, before or without consent, analytics storage and all advertising features remain denied. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and do not show you the banner, although you may still switch analytics on yourself in Cookie Settings. There is no universally accepted standard for browser "Do Not Track" signals, so unless the law requires otherwise, the Website relies on your banner choice and Global Privacy Control instead.

Changing your mind. You can change or withdraw your choice at any time by clicking Cookie Settings at the bottom of any page. When you withdraw consent, we stop Google Analytics and delete its cookies from your browser. You can also block or delete cookies in your browser settings, or install Google's Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). Withdrawing consent does not affect analytics collected before withdrawal.

Google's role and retention. Google processes analytics data on our behalf as our processor or service provider under Google's data processing terms, and the data may be processed in the United States and other countries where Google operates (see the International data transfers section). We use Google Analytics data only in aggregated reports to understand how the Website is used. Event-level analytics data is retained in Google Analytics for no more than 14 months and is then automatically deleted. You can learn more about how Google uses data at policies.google.com/technologies/partner-sites.

If we add any other non-essential tools in the future (for example, advertising, marketing-automation, chat or scheduling tools), we will update this Policy and our cookie banner and, where the law requires, ask for your consent first. Content embedded from third-party sites (for example videos, maps or social-media plugins), and sharing content to social networks at your request, may set additional cookies that we do not control, so please review those providers' policies.

We do not allow third-party advertising on the Website. We may, however, use third-party platforms (such as search engines and professional or social networks) to promote our services on their sites. These platforms may use cookies, pixels and similar technologies to show relevant ads, to measure campaign performance or, in future, to reach people who have visited our Website. We will describe any such tools in our cookie information, ask for consent where the law requires it, and give you the opt-out choices that apply to you through your browser and the platform's own ad settings.

We may offer social-media features, comment areas, forums, communities or similar collaboration tools. Content you post in them may be visible to others, inside and outside Roshwin, and is subject to the Terms of Service and the policies of the platform used. Social-media features may collect or share information about you depending on the feature, so please review the privacy settings and policies of the social networks you use.

We use AI and other automated tools, supplied by us or by trusted third-party providers, to support document review, research, drafting, analysis, translation, summarization, communications, security and internal operations. Our approach is as follows:

• Outputs generated with AI are reviewed by people before they are relied on in client deliverables, as appropriate to the engagement.
• We do not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects, unless the law allows it and appropriate safeguards are in place.
• How AI tools may process Client Materials, including any restrictions on model training, retention and hosting, is set out in the applicable Client Agreement. We choose providers and configure tools with confidentiality and security in mind, and we require providers who handle personal data to be bound by appropriate confidentiality and data-protection obligations.
• Information you submit on the Website (such as enquiry forms) may be processed by AI-assisted tools for routing, summarization and responding to your request.

We serve clients around the world. Our delivery operations are based in India, and our team members may work from other countries. Clients in different regions, including North America, the United Kingdom, the European Economic Area, the Middle East and elsewhere, may have specific requirements for data protection, confidentiality, localization or hosting.

Those requirements are agreed with each client in the Client Agreement before we begin work, including the laws that govern the relationship, where data will be hosted, who may access it, how long it is kept, how incidents are notified, and any data processing or transfer terms (for example, standard contractual clauses). We will comply with the data-protection laws that apply to us and to each engagement as set out in the Client Agreement. Clients are responsible for telling us in advance about any hosting, localization or regulatory requirement that applies to their data, and for having a lawful basis to share Client Materials with us.

We do not sell, rent or lease personal data. We do not currently share personal data for cross-context behavioral advertising as those terms are defined in US state privacy laws; if that changes, we will update this Policy and provide any opt-out the law requires. We may share personal data with:

• service providers and vendors acting on our behalf, such as hosting and infrastructure providers (including our website host), analytics providers (Google Analytics, only where you have consented), security providers, email, messaging and communication tools, productivity and collaboration suites (including Google Workspace), document-review and legal-technology platforms, AI and cloud providers, payment and accounting providers, recruitment tools and recruitment or staffing agencies;
• clients and their authorized recipients, such as counsel, auditors, counterparties, regulators and data-room administrators, as the client directs;
• affiliates, team members, contractors and professional advisers, including lawyers, accountants, auditors and insurers, who need the data for the purposes above and are bound by confidentiality;
• authorities and other parties where required by law, court order or legal process, or where needed to protect rights, property, safety or security, or to investigate suspected unlawful activity; and
• successors, in connection with a merger, acquisition, financing, restructuring or sale of assets, subject to appropriate safeguards.

Roshwin works with clients, team members and service providers across countries. Personal data may therefore be transferred to, stored in, or accessed from India, Canada, the United States, the European Economic Area, the United Kingdom, the United Arab Emirates and other countries, which may have data-protection laws different from those of your country. Where the law requires safeguards for cross-border transfers, we use appropriate mechanisms, such as contractual clauses, consent, or other transfer tools recognized by the applicable law. For Google Analytics, transfers of data from the EEA, UK and Switzerland to the United States rely on the certification of Google LLC under the EU-US Data Privacy Framework (and its UK and Swiss extensions) and on the standard contractual clauses in the Google data processing terms.

We keep personal data only for as long as needed for the purposes described in this Policy, including to meet legal, tax, accounting, regulatory, contractual and professional requirements, resolve disputes and enforce agreements. Retention periods depend on the type of data and the engagement. Client Materials are kept, returned or deleted as the Client Agreement provides. Marketing data is kept until you opt out or the data becomes inactive. Talent network profiles are kept for 24 months from your last contact with us, and unsuccessful job applications for 12 months after the recruitment process ends, unless you ask us to delete them sooner or the law requires otherwise (see the Job Applicant Privacy Notice). Your cookie choice is remembered for up to 12 months, after which we ask again. Google Analytics data is kept as described in the Cookies section. When data is no longer needed, we delete or anonymize it.

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the data, such as access controls, encryption in transit where available, confidentiality obligations for personnel, and vendor diligence. No system or method of transmission is completely secure, and we cannot guarantee absolute security. Please share confidential or sensitive material only through channels agreed with us.

If we become aware of a personal data breach affecting data we handle, we will assess it and notify affected individuals, clients and regulators where and when the law or the Client Agreement requires.

Depending on your location and the law that applies, you may have some or all of these rights:

• to know what personal data we hold about you and how it is used, and to get a summary or copy of it;
• to correct, complete or update inaccurate or incomplete data;
• to request erasure of data that is no longer needed or where you withdraw consent, subject to legal exceptions;
• to restrict or object to certain processing, including direct marketing, and to withdraw consent;
• to data portability, where applicable;
• not to be subject to solely automated decisions with significant effects, where applicable;
• to nominate another person to exercise your rights in the event of death or incapacity (under the DPDP Act);
• to access grievance redressal, and to complain to a data-protection authority, such as the Data Protection Board of India, a supervisory authority in the EU, UK or Switzerland, the Office of the Privacy Commissioner of Canada or a provincial regulator, or a US state attorney general; and
• not to be discriminated against for exercising privacy rights (where US state laws apply).

To exercise a right, write to privacy@roshwin.ai. We may need to verify your identity, and in some cases you may authorize an agent to act for you. We will respond within the time required by applicable law. If your data is part of Client Materials, we may refer your request to the client, who decides how that data is used.

Where the GDPR, UK GDPR or the Swiss Federal Act on Data Protection applies, you may exercise the rights above, and our legal bases are as described in section 4. Where Canadian law applies, you may access and challenge the accuracy of your personal information and withdraw consent, subject to legal restrictions. Where US state laws apply (including the California Consumer Privacy Act as amended by the CPRA), we do not sell personal data or share it for cross-context behavioral advertising or targeted advertising, we honor Global Privacy Control signals as an opt-out, and we do not use sensitive personal information in ways that would give rise to a right to limit. Where Indian law applies, you may raise a grievance with our contact below and, if you are not satisfied with the response, approach the Data Protection Board of India. These country-specific notes apply only where those laws apply to our processing.

The Website is intended for business users and is not directed to anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact privacy@roshwin.ai and we will take appropriate steps, including deleting the data, and obtaining verifiable parental consent where the law requires it.

The Website may link to or embed third-party websites, social media, tools and content. We do not control them and are not responsible for their privacy practices. Please read their policies before you share personal data with them.

We may update this Policy from time to time to reflect changes in our practices, technology, services or the law. The "Last updated" date above shows the current version. Where the law requires, we will give notice of material changes or ask for fresh consent. If we intend to use your personal data for a materially different purpose from the one for which it was collected, we will tell you and, where required, give you the option to consent or decline before we do so.

For questions, requests or complaints about this Policy or our handling of personal data, contact:

Privacy and grievance contact: Privacy Desk, Roshwin Private Limited, privacy@roshwin.ai

Address: Plot No. 94, 3rd Floor, Pocket-10, Sector-13, Dwarka, New Delhi - 110078, India

General enquiries: hello@roshwin.ai | Website: www.roshwin.ai

We will acknowledge and respond to complaints within the time required by applicable law. If you are not satisfied, you may contact the data-protection authority that applies to you.