Privacy Policy

1. Definitions

• Data Fiduciary: means any person who alone or in conjunction with other persons determines the purpose and means of processing personal data;
• Data Principal: The individual to whom the personal data relates and where such individual is a child, includes the parents or lawful guardian of such a child; and where such individual is a person with disability, includes her lawful guardian, acting on her behalf.
• Data Processor: means any person who processes personal data on behalf of a Data Fiduciary.
• Personal data: means any data about an individual who is identifiable by or in relation to such data;

2. General Information about Data Processing

2.1 Scope and Purpose

We only collect and use your personal data as necessary to provide a functional website, our content, and services, as allowed under Sec. 3, 4 of the DPDP Act and Rule 3 of the DPDP Rules. At the time of collection, you are provided with a notice in clear and plain language i.e., in English and the 22 scheduled languages of India if requested., containing, at a minimum, an itemized description of your personal data, the specific purposes of processing, and the description of enabled services (Sec. 3, 5, 6; Rule 3).

2.2 Legal Basis for Processing

Your personal data is processed on the grounds of consent or any other legal bases as defined in Sec. 4 of DPDP Act (consent, contractual necessity, legal obligation, legitimate interest), and in accordance with requirements of the DPDP Rules (Rule 3

3. Consent, Withdrawal & Consent Management

Wherever we rely on your consent, we obtain explicit, verifiable consent as required under Sec. 6, 10 of the Act and Rules 10/11 for children/persons with disabilities. Consent can be withdrawn with ease comparable to how it was provided, via dataprivacy_india@schaeffler.com, or by contacting the Consent Manager or DPO, as described in Rule 3(c).

4. Notice & Mechanisms for Rights Exercise

Upon collecting any personal data, we provide a detailed notice (Sec. 5, 6 of the Act; Rules 3, 14). This notice includes:

• Data category overview and processing purposes
• Methods to withdraw consent
• Links/contact methods to exercise your rights, make complaints, or contact the Data Protection Board of India (Sec. 13, 14, 27 of the Act; Rules 3, 14)
• Ways to nominate a representative for your rights (Sec. 14 of the Act; Rule 14(4)).

5. Security Safeguards & Personal Data Breach Notification

We maintain reasonable security safeguards as mandated under Sec. 8(5) of the Act and Rule 6 of the DPDP Rules, including encryption, access controls, audit logs (retained for at least one year), restricted access, monitoring, and regular technical measures. If a data breach occurs, we will promptly inform you and the Data Protection Board as specified in Sec. 8(6) of the Act and Rule 7, indicating the description, timing, risk/impact, our response, and contact information for queries.

6. Data Retention & Erasure

All personal data shall be erased as soon as the specified purpose of its collection is no longer being served, or upon withdrawal of consent, unless its retention is necessary for compliance with any law for the time being in force (Sec. 8(7), DPDP Act)

Notwithstanding the above, we shall retain system or processing logs retained for at least one year after the date of processing (Rule 6, DPDP Rules).

For specific classes (such as e-commerce, gaming, or social media intermediaries), data may be retained for three years from last activity; users will be notified 48-hour advance notice before erasure and allows to assert or renew their rights or access (Rule 8, DPDP Rules).

7. Children, Guardians, and Verifiable Consent

We process data of children (below 18 years, Sec. 9) or persons with disabilities only after acquiring “verifiable consent” from parents/guardians, validated by appropriate ID and age checks (Sec. 9, 10; Rules 10, 11). For children’s data, no tracking, profiling, or targeted advertising is permitted except where allowed for health, education, or safety as specified under the Fourth Schedule [DPDP Rules 2025].

8. Data Principal Rights

You have the following rights under Sec. 12, 13, 14, and 27 of the DPDP Act and Rule 14 (DPDP Rules):

• Access, rectification, restriction, or erasure of your data

• Data portability

• Withdrawal of consent

• Right to object to processing

• Right to nominate another person to exercise your rights in the event of death/incapacity

• Right to lodge complaints with our Grievance Officer and/or the Data Protection Board of India Details on exercise mechanisms and required identifiers are published as per Rule 14 [DPDP Rules 2025].

9. International Transfers

Any transfers of your data outside India are carried out only in accordance with government orders under Sec. 16 of the Act and Rule 15 of the DPDP Rules, including any country whitelists or blacklists and further Central Government notifications.

10. Grievance Redressal

We publish contact details of the Data Protection Officer (DPO) and Grievance Officer (India-based) on our website – www.schaeffler.co.in and in every rights-exercise response, as required by Sec. 10, 13, and Rule 9. Complaints are acknowledged in 7 days and resolved within 30 days, with system effectiveness as per Rule 14’s 90-day time limit [DPDP Rules 2025].

11. If Significant Data Fiduciary

If notified as a Significant Data Fiduciary (Sec. 11), we undertake annual Data Protection Impact Assessments, audits, and enhanced due diligence in compliance with Rule 13 [DPDP Rules 2025].

12. Updates & Further Information

This Privacy Policy will be regularly updated to comply with the DPDP Act, 2023, DPDP Rules, 2025, and any government notifications issued thereunder (Sec. 40 of the Act; Rule 1). Contact:

• Data Protection Officer: Thomas Biedermann
  Schaeffler AG
  Industriestraße 1-3 91074
  Herzogenaurach
  Deutschland
  • +49 9132 82-1476
  • +49 9132 82-5901
  • dataprivacy@schaeffler.com

• Grievance Officer: India
  Schaeffler India Limited
  15th Floor, ASTP Baner
  Pune – 411045, MH, India.
  dataprivacy_india@schaeffler.com