Privacy Policy

TNA Solutions Limited ("TNA", "the Company", "we", "us" or "our") respects your privacy. This Privacy Policy explains what personal data we collect through our website tnasolutions.co.in (the "Website"), why we collect it, how we use and protect it, and the rights available to you.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Personal data we collect

1.1 Information you give us

When you submit the enquiry form on our Contact page, we collect:

• your name;
• your email address;
• your telephone number;
• the subject of your enquiry; and
• any information you choose to include in the message field.

We also receive personal data when you contact us directly by email or telephone, when you raise an investor grievance through the details published on our Investor Grievances page, or when you correspond with us in the course of a business relationship.

Enquiries submitted through the form are delivered to us as an email message. They are not stored in any database on the Website and are not written to any customer relationship or marketing system.

Please do not send us sensitive personal data - such as financial account details, passwords or health information - through the enquiry form. We do not ask for it and we do not need it to respond to you.

1.2 Information collected automatically

Like most websites, our web server records standard technical information each time a page is requested. This may include your IP address, browser type and version, operating system, referring page, the pages you visit and the date and time of each request. We use these logs for security monitoring, diagnosing faults and understanding aggregate traffic patterns.

1.3 Information from third parties

Where you are an existing or prospective business customer, supplier or investor, we may receive your business contact details from your organisation, from our Registrar and Share Transfer Agent, from a depository, or from publicly available sources.

2. Why we use your data

We use personal data only for the purposes for which it was provided, namely to:

• respond to your enquiry and communicate with you about it;
• provide information about our products, capabilities and commercial terms where you have asked for it;
• establish, manage and service a business relationship, including order processing and export documentation;
• receive, record, investigate and resolve investor grievances, and maintain the records of such grievances that we are required to keep;
• comply with our obligations under the Companies Act, 2013, SEBI regulations, tax and export control law, and to respond to lawful requests from regulators, courts and other authorities;
• protect the security and integrity of the Website and prevent fraud or misuse; and
• establish, exercise or defend legal claims.

We do not sell your personal data. We do not use the details submitted through the enquiry form to send you marketing communications unrelated to your enquiry without your consent.

3. Consent and choice

Providing personal data through this Website is voluntary. By submitting the enquiry form, you consent to us processing the data you provide for the purposes described in this Policy.

You may withdraw your consent at any time by writing to our Grievance Officer at the address in section 11. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Where we are required by law to retain certain information - for example records of investor correspondence - we will continue to hold it for the period prescribed, even after consent is withdrawn. If you withdraw consent, we may no longer be able to respond to your enquiry or continue a service that depends on that data.

4. Who we share data with

We disclose personal data only as follows:

• Service providers. Our website hosting provider and email service provider process data on our behalf under contractual confidentiality and security obligations, and are not permitted to use it for their own purposes.
• Professional advisers. Auditors, legal counsel, company secretarial advisers and merchant bankers, where necessary and subject to professional confidentiality obligations.
• Registrar and Share Transfer Agent and depositories. For investor-related matters, where applicable.
• Regulators and authorities. SEBI, stock exchanges, the Registrar of Companies, tax and customs authorities, law enforcement agencies and courts, where we are required or permitted by law to disclose.
• Group and corporate transactions. In connection with a merger, acquisition, restructuring or similar transaction, subject to appropriate confidentiality protections.

5. Cookies and third-party services

The Website does not set its own tracking or advertising cookies. However, some pages embed content served by third parties, and those services may set cookies or receive your IP address when the content loads:

• Google Maps - an embedded map on the Contact page, used to show the location of our unit.
• Google Fonts - used to load the typeface used across the Website.
• jsDelivr - a content delivery network used to load a charting library on certain pages.
• Social media links - links to our Instagram and LinkedIn profiles. These are ordinary links; no content is embedded, and no data is shared until you click through.

These providers process data under their own privacy policies, which we encourage you to review. You can block or delete cookies through your browser settings; doing so may affect the display of the embedded map but will not affect the rest of the Website.

We do not use Google Analytics, advertising pixels, remarketing tags or any other tracking or profiling tool on the Website.

6. How long we keep data

We retain personal data only for as long as it is needed for the purpose it was collected for, and thereafter for any period required by law.

• General enquiries that do not lead to a business relationship: retained for 24 months from the last correspondence, then deleted.
• Business relationship records: retained for the duration of the relationship and thereafter for the period required under the Companies Act, 2013, tax legislation and export regulations.
• Investor grievance records: retained in accordance with our Policy on Preservation of Documents and Archival Policy, published in the Investor Relations section, and applicable SEBI regulations.
• Server logs: retained by our hosting provider for up to 90 days, after which they are overwritten or deleted.

7. How we protect data

We maintain reasonable security practices and procedures appropriate to the nature of the data we hold, including access controls limiting personal data to employees who need it for their role, encrypted transmission of the Website over HTTPS, secured email accounts, and confidentiality obligations on employees and service providers.

No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals as required under the Digital Personal Data Protection Act, 2023.

8. Your rights

Subject to applicable law, you have the right to:

• Access - obtain a summary of the personal data we hold about you and how it is being processed;
• Correction - have inaccurate or misleading data corrected, and incomplete data completed;
• Erasure - request deletion of your personal data where we are no longer required to retain it;
• Withdrawal of consent - as described in section 3;
• Grievance redressal - raise a complaint with our Grievance Officer, as set out in section 11; and
• Nomination - nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, write to our Grievance Officer using the details in section 11. We may need to verify your identity before acting on a request. We will respond within the timeframe prescribed by applicable law.

If you are not satisfied with our response, you may make a complaint to the Data Protection Board of India.

9. Children's data

The Website is intended for a business and investor audience and is not directed at children. We do not knowingly collect personal data of any individual below eighteen years of age without verifiable consent of a parent or lawful guardian. If you believe a child has provided us with personal data, please contact our Grievance Officer and we will delete it.

10. Transfers outside India

The Website is hosted on servers located in India. Certain other service providers we rely on, such as our email provider, may store or process data on servers outside India. We transfer personal data outside India only to the extent permitted under the Digital Personal Data Protection Act, 2023, and only where the recipient is subject to contractual obligations to protect it to a standard consistent with this Policy.

11. Grievance redressal

If you have any question, concern or complaint about this Policy or about how your personal data is handled, please contact our Grievance Officer. We aim to acknowledge every complaint promptly and to resolve it within the period prescribed under applicable law.

Investor grievances specifically relating to securities of the Company should be raised through the channels set out on our Investor Grievances page.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. The revised version will be posted on this page with a new "Last updated" date. Where a change materially affects how we handle your personal data, we will take reasonable steps to bring it to your attention. Please review this page periodically.

This Policy should be read together with our Terms of Use and Disclaimer.