Privacy Notice

Effective Date: 23rd September, 2026  ·  Last Updated: 23rd September, 2026  ·  Version: 2

1. Introduction

This Privacy Notice ("Notice") describes how MD Intelligence Private Limited, together with its subsidiaries and affiliates ("MD Intelligence", "we", "our", or "us"), collects, stores, uses, discloses, and otherwise processes personal information about you, and the rights available to you, when MD Intelligence acts as the data controller or data fiduciary for such personal information.

MD Intelligence is the licensed owner and operator of the platform Dutient (www.dutient.ai), providing AI-native consulting and staffing services for governance, risk, privacy, and security (the "Services"), provided to enterprise clients and their authorised users (collectively, "Customers"). This Notice applies to you ("You", "Yours", or "User") when you visit our website at dutient.ai and when you use our Services. This Notice does not apply where MD Intelligence processes personal information as a processor (also referred to as a data fiduciary's processor or service provider) during the provision of the Services to Customers.

In that case, any personal information uploaded or input into the Services by the Customer ("Customer Content") is processed in accordance with the Customer's documented instructions and the applicable agreement, including any relevant order forms and Data Processing Agreement ("Agreement"). For personal information processed as a data processor, MD Intelligence does not use or share the personal information for any purpose other than providing the contracted Services.

By accessing or using the Services, you confirm that you have read and understood this Notice. If you are accessing the Services on behalf of an organisation, you represent that you are authorised to bind that organisation to this Notice.

This Privacy Notice is provided in accordance with the Digital Personal Data Protection Act, 2023 (India), the General Data Protection Regulation (EU/UK), the California Consumer Privacy Act (as amended by the CPRA), and other applicable global data protection and privacy laws.

---

2. Personal Information We Collect, Why, for How Long, and Legal Basis of Processing

MD Intelligence collects personal information that has been provided by you directly through your interactions with us, including when you fill in an enquiry form, request our services, download materials, register for or attend an event or webinar, as well as personal information gathered when you visit our Website, through your use of the Services, and from trusted third parties.

The table below summarises the personal information we collect when we act as a controller/data fiduciary. We collect personal information only to the extent necessary for the purposes described in this Notice.

Category	What it includes	Why we use it	Retention
Contact Information	Phone number, email address, first name, your message	To respond to your enquiry about our products/services and for Dutient representatives to reach out to you	365 days, or as required to service the enquiry
Cookie Information	Depending on your tracking preferences, the information we collect may include your device’s Internet Protocol (‘IP’) address, referring website, pages visited, and a time stamp.	To improve user experience and for compliance with legal obligations and consent storage (managed via our cookie consent platform).	365 days

We do not knowingly collect sensitive personal information (such as health, biometric, financial account, or special category data under Article 9 of the GDPR) through our Website or Services, unless a Customer submits it as Customer Content, in which case it is governed by the applicable Data Processing Agreement.

When you visit our Website, we collect information through cookies and similar technologies, which may include IP address, referring website, pages visited, and timestamps. See our Cookie Policy (linked at the bottom of any webpage on dutient.ai) for more detail.

2.4 Jurisdiction-specific lawful bases

A. European Union and United Kingdom (GDPR / UK GDPR)

We rely on the following Article 6 lawful bases:

Legal Basis	When We Rely on It
Consent	When you submit an enquiry through our website, or for marketing communications and non-essential cookies. Withdrawable at any time via the consent preference centre or by emailing us.
Contractual necessity	Providing customer support or delivering a service you have requested; processing account and billing data.
Legitimate interests	Detecting and preventing fraud, enabling website experience, ensuring website security, business communications, where not overridden by your rights and freedoms.
Legal obligation	Complying with tax, financial record-keeping, and data protection obligations.

B. India (DPDPA, 2023)

For data principals in India, we rely on:

• Consent: freely given, specific, informed, and unambiguous consent obtained through a clear notice at the time of collection; withdrawable at any time.
• Legitimate uses: including compliance with legal obligations and other legitimate uses notified by the Central Government.

C. United States (CCPA/CPRA and other state laws)

For consumers in applicable US states, we rely on:

• Contractual necessity for providing the Services.
• Legitimate business operations and compliance, consistent with the CCPA/CPRA and other applicable state laws.

We do not sell personal information for monetary consideration. Where applicable law (including the CCPA/CPRA) treats certain cookie- or advertising-related disclosures as a "sale" or "sharing", we honour your opt-out rights through our consent preference centre and recognised opt-out preference signals (such as the Global Privacy Control).

D. Other jurisdictions

For users in other countries, we process personal information under the applicable national laws and equivalent legal bases such as consent, contract, legal obligation, or legitimate interests.

---

3. How We Collect Your Personal Information

We collect personal information through:

1. Directly from you: when you fill in the "Contact Us" form or another enquiry form on the Website, request our services, attend an event, or communicate with our team.
2. From your organisation: when your employer or client organisation engages us and provides your details as an authorised contact.
3. Automated collection: through cookies, log files, device data, and analytics tools when you interact with the Website.
4. From trusted third parties: as described above.
5. Through social media and direct communication: when you communicate with us through social networking websites, third-party applications, or direct emails.

4. How We Share and Disclose Your Personal Information

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioural advertising except where you have opted in via our consent preference centre. We disclose personal information only in the following limited circumstances and on a need-to-know basis. Some advertising-related cookie activities may constitute "sharing" under the CCPA/CPRA; you may opt out via our consent preference centre or through a recognised opt-out preference signal (such as the Global Privacy Control). We do not knowingly sell or share the personal information of consumers under 16 years of age.

We engage third-party service providers and partners, including hosting, analytics, consent management, and email service providers, to perform services on our behalf. All such providers are:

• Bound by data processing agreements that limit their use of personal information to the specific purposes engaged.
• Required to maintain appropriate technical and organisational security measures.
• Required to delete or return personal information upon termination of the engagement.
• Permitted to access only the data necessary to perform their contracted services.

We may disclose personal information where required to: (i) comply with legal processes such as court orders, subpoenas, or investigations; (ii) prevent or detect crime; (iii) protect the safety of individuals; or (iv) establish, exercise, or defend legal claims. Where legally permissible, we will notify affected individuals before such a disclosure and take commercially reasonable steps to limit its scope.

In the event of a merger, acquisition, restructuring, sale of assets, or bankruptcy, personal information may be transferred to the successor entity or relevant affiliates. Where reasonably practicable, we will provide advance notice and, where required, obtain consent.

We may share personal information within MD Intelligence group entities for purposes consistent with this Notice, based on legitimate interests or contractual necessity.

5. Cross-Border Data Transfers

MD Intelligence operates globally. Your personal information may be transferred to, stored in, and processed in countries other than where it was originally collected, including outside India. We ensure all international transfers are subject to appropriate legal safeguards.

Where personal information of individuals in the EEA or UK is transferred to a country not subject to an adequacy decision, we rely on:

1. Adequacy decisions of the European Commission or the UK Secretary of State, where available.
2. Standard Contractual Clauses (SCCs) adopted by the European Commission, and the UK International Data Transfer Addendum (IDTA) issued by the ICO, supplemented by additional measures such as encryption in transit and at rest, pseudonymisation, and access controls in the destination country.
3. Transfer impact assessments (TIAs) to assess the legal frameworks of destination countries and implement supplementary measures where required.

Under the DPDPA, MD Intelligence will comply with any restrictions or conditions on cross-border transfers, as and when notified by the Central Government under Section 16. Until such restrictions are formally notified, MD Intelligence ensures any transfer of personal information outside India is:

1. Governed by contractual provisions imposing data protection obligations equivalent to those under the DPDPA.
2. Subject to appropriate technical and organisational security measures in the destination country.
3. Limited to countries and recipients assessed by MD Intelligence as providing an adequate level of protection in practice.

You may contact privacy@dutient.ai for information about countries to which your personal information may be transferred, or to request copies of our SCCs or transfer impact assessments.

6. Security Measures

We implement appropriate technical, administrative, and organisational measures to protect personal information from loss, misuse, and unauthorised access, disclosure, alteration, or destruction. Our security practices include:

1. Encryption of personal information in transit using Transport Layer Security (TLS) and at rest using AES.
2. Tokenisation of sensitive identifiers where appropriate.
3. Role-based access controls limiting access to authorised personnel.
4. Regular security assessments and reviews.
5. Physical security measures for our premises.
6. Staff training on data protection and information security.
7. Retention policies designed to prevent unauthorised access or unnecessary storage.

No system can be guaranteed to be completely secure. In the event of a personal information breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities including, where applicable, the Data Protection Board of India and affected individuals within the timeframes required by applicable law. If you wish to report a suspected data breach, please contact privacy@dutient.ai.

7. Your Privacy Rights

Depending on your location and the applicable data protection laws, you may have certain rights in relation to your personal information. We will honour verified requests in accordance with the laws applicable to you.

A. Rights for individuals in the European Economic Area and the United Kingdom (GDPR / UK GDPR)

Right	Description
Right of access	Obtain confirmation of whether we process your personal information and a copy of that data.
Right to rectification	Have inaccurate or incomplete personal information corrected.
Right to erasure ("right to be forgotten")	Have your personal information deleted in defined circumstances, subject to legal exceptions.
Right to restriction of processing	Restrict processing while a concern is investigated or where legally permitted.
Right to data portability	Receive your data in a structured, machine-readable format, or have it transmitted to another controller, where feasible.
Right to object	Object to processing based on legitimate interests or direct marketing.
Right not to be subject to automated decision-making	Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, subject to exceptions.
Right to withdraw consent	Withdraw consent at any time, without affecting prior lawful processing.
Right to lodge a complaint	Complain to your supervisory authority (see Section 14).

Response timeline: Generally within one month of a verified request, extendable by up to two further months for complex requests, with prior notification.

B. Rights for data principals in India (DPDPA, 2023)

Right	Description
Right to access information	Obtain a summary of personal information processed, processing activities, and identities of other data fiduciaries with whom data has been shared.
Right to correction and erasure	Have inaccurate, misleading, or incomplete personal information corrected, completed, or updated, and erased where no longer needed and not required by law.
Right to grievance redressal	Raise a grievance about how your personal information has been handled, with a response within a reasonable time.
Right to nominate	Nominate a parent, guardian, or trusted individual to exercise your rights in case of incapacity or death. Email privacy@dutient.ai with supporting documentation such as a government-issued ID or relevant legal instrument.
Right to withdraw consent	Withdraw consent at any time. Withdrawal does not affect prior lawful processing and may limit access to certain Services.

Response timeline: We aim to respond within 90 (days) as set out under the DPDPA and accompanying rules.

C. Rights for California residents (CCPA/CPRA)

Right	Description
Right to know	Know the categories and specific pieces of personal information collected, sources, purposes, and categories of third parties to whom it is disclosed, over the preceding 12 months.
Right to delete	Request deletion of personal information we collected from you, subject to statutory exceptions.
Right to correct	Request correction of inaccurate personal information.
Right to opt out of sale or sharing	Direct us not to sell or share your personal information for cross-context behavioural advertising. We honour Global Privacy Control (GPC) signals.
Right to data portability	Receive your personal information in a portable, readily usable format.
Right to non-discrimination	Not be discriminated against for exercising your privacy rights.
Right to designate an authorised agent	Designate an authorised agent to submit a request on your behalf. We require written, signed permission and may verify your identity directly.
Right to appeal	Where applicable, appeal our response to a privacy rights request.

Response timeline: Generally within 45 days of a verified request, extendable by a further 45 days with notice.

To exercise any of the rights above, please contact us at privacy@dutient.ai or fill our request form. Your request should include your full name, the country or jurisdiction in which you are located, a clear description of the right you wish to exercise, and, where possible, details helping us locate your records (e.g., the email address you used to contact us).

We will acknowledge receipt promptly and respond within the timeframe required by the law applicable to you, notifying you of any extension and the reasons before the initial period expires.

Verification: Before acting on your request, we may need to verify your identity by asking for reasonable information such as your email address and, where necessary, a government-issued identification document. We will treat identity verification materials with strict confidentiality and retain them only as long as needed for verification.

Authorised agents: If you are a California resident or otherwise entitled under applicable law, you may designate an authorised agent to submit a request on your behalf. We will require written proof of authorisation and may verify your identity directly.

Personal information submitted by Customers of MD Intelligence: If your personal information was submitted to us by a Customer in our role as a processor, please direct your request to that Customer. If you submit your request to us directly, please provide the name of the relevant Customer so we can refer to your request and provide support as needed.

Marketing and consent preferences: You may opt out of promotional emails using the unsubscribe link in our emails or by contacting privacy@dutient.ai. You may manage cookie/consent preferences through our consent preference centre, accessible via the cookie banner or persistent icon on the Website. We honour recognised opt-out preference signals, including the Global Privacy Control, in accordance with applicable law.

8. "Do Not Track" Signals

Some US state laws (such as California and Delaware) require us to indicate whether we honour browser "Do Not Track" settings. MD Intelligence adheres to the standards set out in this Notice and does not currently respond to Do Not Track browser requests. We do honour recognised opt-out preference signals such as the Global Privacy Control, as described above.

9. Children's Privacy

Our Website and Services are designed exclusively for professional and organisational use. They are not directed at, and should not be used by, individuals below the age of consent in their country, including under 13 in the United States, under 16 in the European Union and the United Kingdom (subject to member state variation), and under 18 in India.

We do not knowingly collect personal information from minors. We do not knowingly sell or share the personal information of consumers under 16 years of age. Under the DPDPA, we will not undertake tracking, behavioural monitoring, or targeted advertising directed at children, and will obtain verifiable parental or guardian consent where required. If you believe we have inadvertently collected personal information from a child without appropriate consent, please contact privacy@dutient.ai and we will delete it promptly.

10. Accessibility and Persons with Disabilities

We are committed to ensuring that all users, including persons with disabilities, can access this Notice and use our platform with dignity, equality, and independence. If you need help understanding or managing your account, consents, or personal information, or exercising your privacy rights, you may nominate a parent, guardian, or trusted representative to act on your behalf (we may request supporting documents such as a government-issued ID, court order, or nomination proof, treated with strict confidentiality). If you require this Notice in an accessible format, please contact us at privacy@dutient.ai.

11. Links to Third-Party Websites, Services, and Social Media Platforms

Our platform may contain links to third-party websites or integrate with third-party tools. This Notice does not apply to those services, which are governed by their own privacy policies. We are not responsible for the privacy practices, security, or content of any third-party service. We recommend reviewing the privacy notice of any third-party service you use.

12. Cookies and Other Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to understand how our platform is used and to improve your experience. These technologies help us to track the services, pages, and content you view on our platform, analyse which features are most useful or engaging, and measure the effectiveness of promotions and advertising campaigns.

For more information about the cookies we use and how to manage them, please see our Cookie Policy.

13. Personal Information Breaches

MD Intelligence maintains procedures for identifying, assessing, responding to, and managing personal information breaches.

Where a personal information breach occurs, MD Intelligence will take measures required under applicable law, including notification to the Data Protection Board of India, affected Data Principals, or other relevant authorities, as applicable. If you need to report a suspected data breach, please contact privacy@dutient.ai.

14. Grievance Redressal and Regulatory Complaints

If you have a concern about how your personal information has been handled, please contact us first. We aim to respond within 10 working days and will proactively inform you of any delay.

Channel	Contact Details
Privacy Contact (DPO and Grievance Officer)	privacy@dutient.ai
Postal address	MD Intelligence Private Limited, 3rd Floor, M D Tower, G-15, Nursery Circle, Vaishali Nagar, Jaipur, Rajasthan, India, 302021

If you are not satisfied with our response, or if you believe your data protection rights have been breached, you may lodge a complaint with the relevant supervisory authority:

1. European Union: the supervisory authority in your EU member state of residence or place of work.
2. United Kingdom: the Information Commissioner's Office (ICO) at www.ico.org.uk.
3. India: the Data Protection Board of India, once operational under the DPDPA. In the interim, affected individuals may contact the Ministry of Electronics and Information Technology (MeitY).
4. United States (Federal): the Federal Trade Commission (FTC) at www.ftc.gov.
5. United States (State): the relevant state attorney general or state privacy authority under applicable state law.

15. Changes to This Notice

We may update this Notice from time to time to reflect changes in our practices, applicable law, or platform functionality. The date of the most recent update appears at the top of this document ("Last Updated"). For material changes, we will notify users via email or through a prominent notice on our website at least fourteen (14) days before the changes take effect, or as otherwise required by applicable law. For non-material changes, we may update the Notice without advance notice, and continued use of our Services will constitute acceptance. We encourage you to review this Notice periodically.

16. Interpretation and Governing Language

This Notice is written in English (India), and the English version governs in the event of any conflict with a translated version. Where terms used in this Notice have defined meanings under applicable law (such as "data controller", "data fiduciary", "data processor", "processing", or "personal information"), those definitions apply.

On request, we will make this Notice available in any language listed in the Eighth Schedule to the Constitution of India. Contact privacy@dutient.ai to request another language.

---