Global Privacy Policy

1. Introduction & Purpose

Fusion CX Limited, together with its global affiliates and subsidiaries (“Fusion CX,” “we,” “us,” or “our”), respects the privacy of every individual whose personal data we process, including customers and their end users, business partners, employees (current and former), trainees, applicants, contractors, vendors, prospects, and members of the Board of Directors (collectively, “Data Subjects” or, under Indian law, “Data Principals”).

This Global Privacy Policy (“Policy”) explains what personal data we collect, why and how we process it, the legal grounds we rely on, how long we keep it, who we share it with, how we use cookies and similar technologies, and the rights available to you under applicable data protection law — including the EU/UK General Data Protection Regulation (“GDPR”), India’s Digital Personal Data Protection Act, 2023 (“DPDPA”), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).

This Policy applies wherever Fusion CX operates — across our 36+ delivery centers in 15 countries — and to all Fusion CX websites, client engagement platforms, and applications that link to it. Where a specific law grants rights or imposes obligations beyond those described generally in this Policy, that law’s specific provisions govern, and are set out in Section 12 (“Your Rights by Region”).

2. Scope & Third-Party Links

This Policy covers Fusion CX’s information practices on Fusion CX-branded websites, portals, and applications (“Fusion CX Digital Properties”) that link to it, and describes how we handle personal data processed in connection with our BPO/ITES service delivery, recruitment, vendor management, and corporate governance activities.

Fusion CX Digital Properties may link to third-party websites for convenience. Once you leave a Fusion CX Digital Property, this Policy no longer applies; the personal data you provide to a third party is governed by that party’s own privacy notice. We encourage you to review any third-party site’s privacy practices before submitting personal data.

Where Fusion CX processes personal data on behalf of a client as a processor / Data Processor / Significant Data Fiduciary’s contracted processor, that processing is governed primarily by the applicable Data Processing Agreement (“DPA”) with the client, and this Policy applies to Fusion CX’s own processing as a controller/Data Fiduciary (for example, in respect of our website visitors, job applicants, and vendors).

3. Key Definitions

• Personal Data / Personal Information: any information relating to an identified or identifiable natural person, including online identifiers, location data, and factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.
• Sensitive Personal Data: special categories of data under GDPR (e.g., health, biometric, genetic, racial/ethnic origin, religious belief, sexual orientation, trade union membership) and “Sensitive Personal Data or Information (SPDI)” under Indian law (e.g., financial information, health records, biometric data, passwords), which we process only with explicit consent or another lawful basis specifically recognized for such data.
• Data Fiduciary / Controller: the entity that determines the purpose and means of processing personal data — in most contexts described in this Policy, Fusion CX.
• Data Processor: an entity that processes personal data on behalf of a Data Fiduciary/Controller, under its instructions (for example, Fusion CX acting for a client, or a Fusion CX sub-processor).
• Data Principal / Data Subject: the individual to whom the personal data relates.
• Consent Manager: a person registered with India’s Data Protection Board that enables a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform, where such a mechanism is made available.

4. Personal Information We Collect

4.1 Information You Provide Directly

We collect information such as your first and last name, e-mail address, job title, organization name, country, city, phone number, and industry type when you:

• Fill out a form on a Fusion CX Digital Property (e.g., a contact-us, RFP, or newsletter sign-up form);
• Raise a query or request information about our products or services;
• Apply for employment, an internship, or a contractor engagement with us;
• Communicate with us by e-mail, phone, chat, or in person.

4.2 Information Collected Automatically

When you visit a Fusion CX Digital Property, we and our service providers may use cookies, web server logs, pixels, and similar technologies (see Section 8) to collect:

• IP address, device identifiers, browser type, and operating system;
• Cookie identifiers and similar online identifiers;
• Pages viewed, referring/exit pages, click patterns, and time spent on the site, used to improve site effectiveness and, where you have consented, for marketing.

4.3 Information from Third Parties & Social Media

• If you interact with our social media pages or use a social login, we may receive limited profile information, depending on your privacy settings with that platform;
• If you access our sites on a mobile device, we may, with your permission, collect device identifiers, advertising IDs, and precise or approximate location data;
• We may receive personal data from publicly available sources, business partners, and background-verification providers (for recruitment and vendor onboarding, subject to consent and applicable law).

4.4 Employee, Applicant & Contractor Data

Where Fusion CX processes personal data of employees, trainees, applicants, or contractors (including, where applicable, government identifiers, background-check results, and payroll or benefits data), that processing is additionally governed by our internal HR / Recruitment Privacy Notice, which is provided separately and takes precedence for HR-specific processing purposes.

5. Purposes of Processing & Legal Bases

We only process personal data where we have a valid legal basis to do so. The table below sets out our principal purposes and the corresponding legal bases under GDPR Art. 6, the DPDPA, and analogous frameworks.

Where we rely on consent — for example for non-essential cookies, direct marketing, or processing of sensitive personal data — we obtain that consent through a clear, specific, informed, freely given, and unambiguous affirmative action (see Section 6) before processing begins, and you may withdraw it at any time with the same ease with which it was given, without affecting the lawfulness of processing carried out before withdrawal.

6. Consent Management

Where consent is our legal basis, Fusion CX follows a “notice-and-choice” model that meets GDPR, DPDPA, and CCPA/CPRA standards:

• Granular & itemized: consent is requested separately for each distinct purpose (e.g., analytics cookies vs. marketing cookies vs. newsletter sign-up) rather than bundled into a single blanket acceptance.
• No pre-ticked boxes: optional consents are off by default; you must take an affirmative action (ticking a box, clicking “Accept”) to opt in.
• Plain language: consent requests are presented in clear and plain language, with an itemized notice describing the personal data to be collected and the purpose of processing, as required under the DPDPA, alongside an English translation where a request is presented in another language.
• Easy withdrawal: you may withdraw consent at any time via the same channel used to give it (e.g., the Cookie Settings panel, an unsubscribe link, or by contacting data.privacy@fusioncx.com), and withdrawal is at least as easy as giving consent.
• Consent Manager option: where a registered Consent Manager platform is available in your jurisdiction, you may use it to give, manage, review, and withdraw your consent across Fusion CX processing activities in one place.
• Children & persons with disability: where processing relates to a child (an individual below 18 years) or a person with a disability who has a lawful guardian, we obtain verifiable consent from the parent or lawful guardian before processing, and we do not carry out tracking, behavioral monitoring, or targeted advertising directed at children.

7. How We Use Cookies & Tracking Technologies

We use cookies and similar technologies (pixels, web beacons, SDKs, local storage) to operate our sites, remember your preferences, measure performance, and — only with your consent — personalize content and marketing. Our Cookie Settings panel, available via the link in the site footer, lets you view and change your preferences by category at any time.

You can also manage cookies through your browser settings (Chrome, Firefox, Safari, Edge all provide cookie controls) and through opt-out tools such as the Google Analytics Opt-out Browser Add-on, the Digital Advertising Alliance’s WebChoices tool, and the Network Advertising Initiative’s opt-out page. Browser-level “Global Privacy Control” or “Do Not Track” signals, where enabled, are honored as a valid opt-out request for sale/sharing and targeted advertising, consistent with CCPA/CPRA.

8. Sharing of Personal Information

Fusion CX does not sell personal data in the ordinary commercial sense, and does not share personal data with non-affiliated companies except as follows:

• Affiliates: shared with Fusion CX subsidiaries and branches worldwide for legitimate business coordination, subject to the same standard of protection described in this Policy.
• Service providers / processors: shared with vetted vendors, contractors, and partners who process data on our behalf (e.g., IT hosting, campaign management) under written agreements requiring confidentiality, purpose limitation, and security measures equivalent to our own; these parties may not use the data for their own purposes.
• Legal & regulatory disclosures: disclosed to statutory authorities, government institutions, courts, or law enforcement where required by law, subpoena, court order, or a lawful request from the Data Protection Board of India, a supervisory authority, or an equivalent regulator.
• Safety, fraud & security: disclosed where necessary to investigate or prevent illegal activity, fraud, or a threat to the physical safety of any person, or to protect our rights and property.
• Corporate transactions: shared as part of a merger, acquisition, divestiture, restructuring, financing, or sale of assets, provided the receiving entity commits to protecting the data to a standard equivalent to, or higher than, this Policy, and affected individuals are notified where required by law.

Where required by CCPA/CPRA, we identify the categories of third parties to whom personal information is disclosed for a business purpose upon request, and we do not “sell” or “share” (as those terms are defined under CPRA) the personal information of individuals we know to be under 16 years of age without opt-in consent.

9. Cross-Border Data Transfers

As a global organization, Fusion CX may transfer personal data to Fusion CX entities or service providers located in countries other than the one in which it was originally collected. We take the following measures depending on the origin of the data:

• EEA / UK / Switzerland: transfers outside these regions take place only to countries recognized as offering an “adequate” level of protection by the European Commission or UK authorities, or are protected through Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, together with a transfer risk assessment where required.
• India (DPDPA): cross-border transfers of personal data are permitted by default, except to any country or territory that the Central Government of India specifically restricts by notification; we monitor such notifications and adjust our transfer practices accordingly, and any sectoral restriction (e.g., under RBI or other regulatory data-localization requirements applicable to specific data types) is separately complied with.
• California / United States: where personal information is transferred internationally for processing (e.g., to our global delivery centers), we impose contractual obligations on the receiving entity consistent with CCPA/CPRA service-provider requirements.

A current list of the countries in which Fusion CX processes personal data, and the safeguards applied, is available on request from data.privacy@fusioncx.com.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, and in any event no longer than permitted by applicable law. Retention periods are determined by reference to:

• The duration of our contractual or service relationship with you or your organization, plus a reasonable post-relationship period to address any residual claims or service obligations;
• Statutory and regulatory retention obligations (e.g., tax, labor, accounting, and sector-specific rules such as PCI DSS, HIPAA, or CERT-In record-keeping requirements);
• Applicable statutes of limitation for actual or potential legal claims;
• Where processing is based solely on consent, and that consent is withdrawn or the specified purpose is no longer being served, in accordance with DPDPA we erase the personal data (and direct our processors to do the same) unless retention is required by law, except that we may retain data for the periods above where a legal obligation independently requires it.

At the end of the applicable retention period, personal data is securely deleted, destroyed, or irreversibly anonymized.

11. Data Security & Breach Notification

Fusion CX maintains a layered information security program aligned to ISO 27001:2022, PCI DSS v4.0, HITRUST CSF, SOC 2 Type II, and HIPAA, including administrative, technical, and physical safeguards such as encryption in transit and at rest, role-based access controls, network segmentation, continuous monitoring, employee security training, and periodic independent audits and red-team testing.

11.1 Breach Notification

• GDPR: in the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and we notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• DPDPA: in the event of a personal data breach, we notify the Data Protection Board of India and each affected Data Principal in the manner and within the timeline prescribed under the Act and its Rules.
• CCPA/CPRA and other frameworks: we notify affected individuals and relevant regulators in accordance with applicable state and federal breach notification laws.

12. Your Rights by Region

Subject to applicable law and to verification of your identity, you may exercise the following rights by e-mailing data.privacy@fusioncx.com. We will respond within the statutory timeframe applicable to your jurisdiction and, if we are unable to fulfil a request, we will explain why and identify any applicable exception.

12.1 If you are in the EEA, UK, or Switzerland (GDPR)

• Right of access to your personal data and a copy of it;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure (“right to be forgotten”), subject to legal retention requirements;
• Right to restrict processing in certain circumstances;
• Right to object to processing based on legitimate interest or for direct marketing;
• Right to data portability, to receive your data in a structured, commonly used, machine-readable format;
• Right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except where permitted by law and subject to appropriate safeguards;
• Right to withdraw consent at any time, without affecting prior lawful processing;
• Right to lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner’s Office, or your national Data Protection Authority).

12.2 If you are in India (DPDPA 2023)

• Right to obtain a summary of your personal data being processed and the processing activities undertaken (Right to Access / Information);
• Right to correction, completion, updating, and erasure of your personal data;
• Right to grievance redressal, by first approaching Fusion CX’s Grievance Officer (Section 14) before escalating to the Data Protection Board of India;
• Right to nominate another individual to exercise your rights on your behalf in the event of death or incapacity;
• Right to withdraw consent at any time, with withdrawal being as easy as giving consent;
• Right to have readily available means to register a complaint.

12.3 If you are a California resident (CCPA/CPRA)

• Right to know / access the specific pieces and categories of personal information we have collected about you, the categories of sources, the purposes of collection, and the categories of third parties with whom it is shared;
• Right to delete personal information we have collected from you, subject to statutory exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the “sale” or “sharing” of your personal information (including for cross-context behavioral advertising) — exercisable via our Cookie Settings panel or a “Do Not Sell or Share My Personal Information” link, or by an authorized agent;
• Right to limit the use and disclosure of sensitive personal information to that necessary to perform the services requested;
• Right to non-discrimination for exercising any of these rights, including with respect to price or service level (any financial incentive we offer, if applicable, will be disclosed with its material terms separately);
• Right to designate an authorized agent to submit requests on your behalf.

12.4 All other jurisdictions

Where you are located in a jurisdiction not specifically listed above, we extend to you, as a matter of policy, the core rights of access, correction, deletion, restriction, objection, and complaint described in this Section, to the extent consistent with local law, and we will honor any additional rights specifically granted under your local data protection law.

13. Protection of Minors

Fusion CX Digital Properties are not directed at children, and we do not knowingly collect personal data from individuals under 16 years of age (or the equivalent age of consent/majority in your jurisdiction, e.g., 13 under COPPA in the United States, or 18 under the DPDPA in India) without verified parental or guardian consent. We do not knowingly sell or share the personal information of, or serve targeted advertising to, individuals we know to be minors. If you believe we have inadvertently collected a minor’s personal data without appropriate consent, please contact us immediately at data.privacy@fusioncx.com so we can investigate and, where appropriate, delete it.

14. Grievance Redressal & Contact Information

Any grievance or complaint regarding the processing of your personal data should be submitted in writing to our Grievance Officer. We aim to acknowledge grievances promptly and to redress them as expeditiously as possible, and in any event within the timeframe prescribed by applicable law.

Chief Grievance Officer, Chief Privacy Officer & Head of Information Security

Name: Raja Chatterjee

E-mail: data.privacy@fusioncx.com / grievance.officer@fusioncx.com

If you are not satisfied with our response, EEA/UK/Swiss individuals may escalate to their local supervisory authority, and Indian Data Principals may escalate to the Data Protection Board of India, in each case as provided under applicable law.

Registered Office

Fusion CX Limited, Y9, EP Block, Sector V, Salt Lake City, Bidhan Nagar, Kolkata – 700 091, India

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The “Effective Date” at the top of this document indicates when it was last revised. Material changes will be notified through a prominent notice on our Digital Properties or by direct communication, as appropriate, and, where required by law, we will seek fresh consent before applying a materially different purpose to previously collected data.