TMPVL collects personal data for various purposes set out in this Privacy Notice. This Personal data shall include but not limited to the following categories:
 

(a) Contact information: Name, Age, Gender, Mailing Address, government issued identification (e.g., PAN, Aadhar etc), Mobile Number and E-Mail Address, Zip Code, etc.
 

(b) Technical information: Device event information such as caches, system activity, hardware settings, browser type, browser language, the date and time of your visit, time spent on those pages and other statistics and referral URL, IP Address, location data, information about your device, etc.
 

Similar information collected via automated means, such as cookies and similar technologies.
 

(c) Financial information: Payment information including credit/ debit card details, bank account number, bank account type, bank names, etc. may be collected by our associated payment gateways.
 

(d)Vehicle information: Vehicle details including model, year, colour, RTO registration number and selling details which includes invoice particulars, warranty details, dealer name, service history and year of purchase.
 

(e) Driver specific information: Driver name and telephone number of customers to provide connected vehicle features and coordination with the vehicle service teams during vehicle servicing.
 

(f) Emergency contact information: Name and mobile number for breakdown and roadside assistance.
 

(g) We do not collect any personal data relating to your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, we also do not collect information relating to criminal convictions or offences or information relating to your health, genetic or biometric data except in specific cases where biometric data may be collected as required for particular applications or purposes and in accordance with applicable law.
 

Personal data of employees is collected solely for legitimate purposes such as attendance management, access control, and related administrative activities. In limited and specific circumstances, certain health or biometric data may be collected where it is strictly necessary for purposes such as employment requirements, access management, or Mediclaim and insurance processing. Such collection is carried out in accordance with applicable laws and data protection principles, and only to the extent required for the intended purpose.
 

We endeavour to collect only such data/information that is reasonably necessary to perform services for you or to respond to your inquiries. You are responsible for ensuring that the data/information you provide is accurate, complete and up-to date.
 

(h) Connected Vehicle and Telematics Data: TMPVL collects connected vehicle and telematics data through its connected vehicle services and fleet management platforms. This includes, but is not limited to, real-time and historical vehicle location data, telematics data (such as speed, route history, fuel consumption, and engine diagnostics), and vehicle usage patterns.
 

(i) Beneficiary and partner-related information: In certain cases, TMPVL may receive personal data of individuals who are ultimate beneficiaries of benefits, incentives, or insurance arrangements extended through group insurance policies or similar tie-ups. This may include employees of dealers or other associated individuals, even where such individuals do not have a direct contractual relationship with TMPVL.
 

(j) CSR beneficiary information: As part of TMPVL’s corporate social responsibility funding and related activities, TMPVL may receive reports or records containing personal data of beneficiaries. Such beneficiaries may include children, medical patients, women, or other individuals covered under CSR programmes, where such information is necessary for reporting, monitoring, evaluation, governance, or compliance purposes.
 

(k) Foreign customer and portal access information: TMPVL may receive or access personal data of foreign nationals who are customers or users of TMPVL products, services, or country-specific portals outside India. Such data may flow back to TMPVL where TMPVL operates, supports, or administers access to such foreign-country portals or related systems.
 

We endeavour to collect only such data/information that is reasonably necessary to perform services for you or to respond to your inquiries. You are responsible for ensuring that the data/information you provide is accurate, complete and up-to date.

We collect Data in the following ways including but not limited to:
 

• Information You Give Us: We receive and store any information you enter on our website.
  
• Automatic Information We Collect: We use “cookies” to receive and store certain types of information whenever you interact with us.
  
• E-mail and telephonic Communications: We collect personal information when you voluntarily contact us by email, mobile, call centre channels or any other means for inquiries, service, sales or other communication purposes.
  
• Information from Tata Group Entities and Other Sources: We may obtain information from Tata Group Entities and other sources. An example of this is when you authorize any Tata Group Entity to process and share your data within Tata Group Entities then we might receive such data from these entities.
  
• Information from Dealerships & Sales, Service Network: We collect information from authorized dealerships when you submit information in connection with a purchase, inquiry, or expression of interest.

We may collect, use, store and otherwise process your personal data on two lawful bases: (i) consent; and (ii) legitimate use. The purposes for such processing are set out below, in connection with our products, services, websites, mobile applications, customer support, and business operations.

1. Customer Interaction, Inquiry & Support
 

• To connect you with our authorized dealers / distributors/ channel partners/ sales representatives to fulfil your sales enquiries.
• To respond to your request, complaint/query such as call back, product inquiry, test drive (with your consent), complaints and service requests.
• To manage your customer account and profile.
• To coordinate with authorized dealers, business partners and service providers.
• To process and manage your inquiry lifecycle and send updates related to your inquiry.

2. Vehicle Purchase and Sales Management
 

• To process your vehicle booking, purchase, and delivery.
• To fulfil our contractual obligations to you in connection with the sale of our vehicles and related products.
• To verify identity and eligibility to purchase our vehicles and related products.
• To facilitate products and services offered by our authorized dealers, affiliates, or other Tata Group entities.

3. Vehicle Registration
 

• To support registration of vehicles with the Regional Transport Office and other authorities concerned.
• To comply with applicable legal obligations arising from vehicle ownership and operation, including insurance, GST, and tax compliance
• To maintain vehicle ownership records for the purposes of continuity of post-sale services and warranty support.

4. Service and Maintenance
 

• To schedule and manage vehicle servicing appointments and workflows.
• To track vehicle's maintenance history for accurate and timely service delivery.
• To manage warranty claims, repairs, and related after-sales services.
• To obtain approval, through appropriate authorization mechanism to obtain approval or rejection of service estimates.
• To enroll customers in value added service offering and manage associated service obligations.

5. Finance and Insurance
 

• To process vehicle loan applications with our financial partners.
• To facilitate motor vehicle insurance policy issuance and claims management.
• To assess creditworthiness and risk as part of financing arrangements.
• To facilitate usage-based insurance and related vehicle services, including Pay-As-You-Drive and Pay-How-You-Drive programmes, including through the sharing of relevant vehicle usage and driving behaviour data with authorised partners.

6. Website, Digital Platform & Service Improvement
 

• To verify identity and provide secure access to our platforms.
• To operate, support, administer, and provide secure access to country-specific or foreign customer portals and related systems.
• To make our website, digital platforms, applications and its content available to user and to further optimize & develop it.
• To handle inquiries and complaints, provide technical support, and collect feedback for service improvement.
• To collect feedback to improve interaction quality across website and sales channels while managing business processes and operational efficiency.

7. Marketing, Promotions & Communications
 

• To provide information about vehicle, pricing, features or offers
• To send promotional offers, campaigns, events and new product launches
• With your consent, to send marketing communications, offers, promotions, and information relating to other products and services offered by TMPVL.
• To send essential service communications such as service reminders and manage communication preference
• To allow our appointed research partners to contact users for surveys, product feedback, and market research on our behalf.

8. Personalisation & Customer Experience
 

• To provide personalised market communications, recommendations and offerings based on profile and preference.
• To conduct market research and measure the effectiveness of our services and campaigns.
• To measure and understand the effectiveness of advertising and outreach.
• With your consent to share your contact details with authorized research vendors for customer surveys, feedback sessions, and product research related to our vehicles and services.

9. Roadside Assistance
 

• To register and provide emergency roadside support when you request it.
• To track vehicle location, with consent or in an emergency, to dispatch assistance.
• Creating and managing RSA service requests and follow-ups.
• To manage assistance requests and follow up on services rendered.
• To assign technicians, manage assistance requests, and document proof of service including technician arrival confirmation.

10. Telematics & Connected Vehicle Services
 

• To collect and process On-Board Diagnostics (OBD) and telemetry data continuously generated by vehicle's systems and sensors for remote diagnostics, vehicle health monitoring, and predictive maintenance alerts.
• To monitor and analyze vehicle usage and telemetry data, for safety evaluation, performance improvement, and product development purposes.
• To share vehicle usage data with third-party commercial partners for research, product development, and related commercial purposes.
• To provide connected vehicle services through vehicle's systems and associated digital platforms where you have activated such services.
• To deliver Over-the-Air (OTA) software and firmware updates and remote vehicle configuration.
• To generate inferred and derived data, such as driving behaviour scores, vehicle health and predictive maintenance indicators, and vehicle usage metrics, from telematics and OBD data for vehicle safety, remote diagnostics, maintenance and related vehicle services.

11. Legal, Regulatory & Compliance
 

• To comply with applicable laws and regulations.
• To respond to court orders, statute, legal requests and statutory authorities.
• To enforce legal rights and fulfil contractual obligations.
• To maintain documentation and records for internal reporting, auditing and governance.
• To retain data for periods required or permitted under applicable laws.
• To provide services in accordance with applicable AIS standards and to fulfil statutory reporting and compliance requirement.

12. Vehicle Safety Operations & Monitoring
 

• To monitor vehicle usage data, to identify and address safety issues.
• To ensure compliance with safety regulations and standards
• To report incidents and accidents to relevant statutory authorities as required by law.

13. Security, Fraud Prevention & Data Protection
 

• To protect our systems and platform from fraud, misuse and unauthorized access.
• To manage user authentication, logs and access controls.
• To ensure data security and integrity of data.

14. Dealer, Vendor and Distributor Management
 

• To onboard and manage dealers, vendors, distributors, suppliers, channel partners, and their authorized representatives for business, operational, and contractual purposes.
• To process applications, registrations, agreements, due diligence, KYC, verification, empanelment, renewal, and related documentation.
• To manage purchase orders, invoices, payments, claims, reimbursements, incentives, commissions, and other commercial or financial transactions.
• To monitor performance, service quality, sales operations, audit requirements, policy compliance, and contractual obligations.

15. Career Portal and Recruitment
 

• To enable candidates to create and manage their profile on TMPVL’s career portal and submit applications for open positions, internships, or other employment opportunities.
• To assess candidate suitability, eligibility, qualifications, skills, experience, and other relevant information for recruitment, shortlisting, interview scheduling, selection, and onboarding-related processes.
• To communicate with candidates regarding application status, interview updates, assessments, offer-related information, and other recruitment communications.
• To conduct background verification, reference checks, document verification, and other pre-employment checks, where required and permitted under applicable law.
• To maintain recruitment records, talent pool information, audit trails, and compliance documentation for legitimate business purposes and as required under applicable laws.

16. CSR Beneficiary Information
 

• To process CSR beneficiary information, including personal data of children, medical patients, women, or other individuals covered under CSR programmes, where necessary for reporting, monitoring, evaluation, governance, audit, and compliance purposes.
• To maintain CSR funding activity records, beneficiary reports, and programme-related documentation in accordance with applicable law and internal governance requirements.

We provide multiple mechanisms to enable user to manage their communication preferences and exercise control over their personal data, including but not limited to email preference centres, unsubscribe options, account settings, consent management tools, and other opt-out mechanisms.

User may withdraw or modify their consent for marketing and non-essential communications at any time through these channels. Notwithstanding the above, we may continue to send essential service-related communications as necessary for fulfilling our obligations or for legitimate uses under applicable law.

a) TMPVL may share or disclose personal data when necessary to provide services or conduct our business operations. If TMPVL intends to transfer your personal data with external parties, TMPVL shall take steps to ensure that your privacy rights continue to be protected and shall ensure that adequate safeguards are in place.

b) TMPVL may with your consent, disclose or share information about you to unaffiliated third-party customers of TMPVL including but not limited to the entities mentioned below for the purpose of providing you products, services and offers of TMPVL, its affiliates or Tata Group companies.
 

For Example:
 

i. Within TMPVL: Our businesses around the world are supported by a variety of TMPVL teams and functions, and personal data/information will be made available to them if necessary for lawful purposes such as the provision of services, account administration, sales and marketing, customer and technical support, and business and product development. All of our employees and contractors are required to follow our data protection and security policies when handling personal data.

ii. Affiliates: Entities within our corporate structure including parent company, subsidiaries, joint ventures, and other affiliated organizations, which may process personal data for the purposes set out in this Privacy Notice.

iii. Dealers and Channel partners: Our Authorized Dealers, TASC, and other channel partners which are independently owned and operated. They may use this information for their everyday business purposes, including marketing, customer service, fulfilment and related purposes.

iv. Distributors: Our authorized distributors which are independently owned and operated. They may use this information for their everyday business purposes, including marketing, customer service, fulfilment and related purposes.

v. Our business partners: We occasionally collaborate with other organizations to deliver co-branded services, provide content, or to host events, conferences, and seminars. As part of these arrangements, you may be a customer of both TMPVL and our partners, and our partners and we may collect and share information about you.

vi. Other third-party service providers: TMPVL may engage third-party service providers around the world to support its operations and services. Personal data is shared with such service providers only necessary to fulfil lawful and legitimate processing basis and solely for the purpose of enabling them to perform services on behalf of TMPVL, such as IT and platform support, cloud hosting, marketing, payment processing, analytics, customer support, and order fulfilment.

Our third-party service providers are not permitted to share or use personal data we make available to them for any other purpose than to provide services to us. Further, in case that we entrust the processing of your personal details to the third-party service providers, we select the third-party service providers who can maintain the appropriate or suitable technical

and physical safeguards, and control and supervise such third-party service providers. We do not sell or rent your personal details to third parties for marketing purposes.

We maintain records of disclosures of personal data to, and receipts of personal data from, third parties. Where we receive personal data from third parties, we ensure that such data has been lawfully obtained and shared with us.

vii. Third parties: We will share personal data when it is required, such as:
 

• To comply with legal obligations and respond to requests from government agencies, including law enforcement and other public authorities, which may include such authorities outside your country of residence, where disclosure of such data may be made without obtaining consent where required or permitted by under applicable law.
• In the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings)
• To protect our rights, users, systems and to prevent fraud or misuse, or for providing services lawfully requested by you.

viii. Within Tata Group Companies: We may also share your personal data/information within Tata Group companies to make their products, services and /or applications available to you through various platforms (including Tata Consumer Platform). We ensure that these affiliates and Tata Group companies who handle your information comply with the applicable laws and their own privacy policies., only where you have provided explicit consent for such marketing communications, which you may withdraw at any time.

We may also disclose or share your personal information to unaffiliated third parties to provide you services and products.

Currently, all personal data we collect is processed and stored within India. However, in the future, if there is a requirement to transfer personal data/information to other countries in which applicable laws do not offer the same level of data privacy protection as in your home country, we take measures to provide an appropriate level of data privacy protection. For example, we use approved contractual clauses, multiparty data transfer agreements, intragroup agreements, and other measures designed to ensure that the recipients of your personal data/information protect it and process such personal data only for lawful purposes and with appropriate technical and organisational safeguards.

Such transfers will be carried out in accordance with the applicable laws of Section 16 of DPDPA, and any notifications or guidelines issued by the Government of India from time to time. We will ensure that appropriate safeguards are in place to protect your personal data during such transfers. It also applies to all personal data received by TMPVL from the European Economic Area (“EEA”) in any format, including electronic or paper and such personal data shall be processed by TMPVL in compliance with applicable Indian data protection laws and this Privacy Notice.

• Our website may provide links to third-party websites for your convenience and information. If you access those links, you will leave our website.
• We do not control those third-party websites or their privacy practices, which may differ from ours. We do not endorse or make any representations about third-party websites.
• This Privacy Notice does not cover the Personal Data you choose to give to such third-party websites, and we require you to review their privacy policies before submitting your Personal Data to them.

TMPVL may use appropriate technologies and procedures to protect your personal data on servers. These technical and organisational measures include following but not limited to:
 

• Encryption, obfuscation, masking or use of virtual tokens as per DPDPA
• Logical and physical access control
• Logs, monitoring and review of access to personal data as per DPDPA
• Data-backup and disaster-recovery measures
• Contractual safeguards with all third parties with whom we share your personal data
• Other technical and organisational measures to ensure effective implementation of security protections.

TMPVL does not provide services directly to children or proactively collect their personal information. Parents or guardians may authorize children to use our digital platforms provided they assume all responsibility and legal liability for the conduct of such child including, without limitation, monitoring the child’s access and use of the TMPVL site.

In limited cases, TMPVL may receive personal data relating to children through CSR funding activities, beneficiary reports, or programme-related documentation, and such data shall be processed only for lawful CSR reporting, monitoring, evaluation, governance, or compliance purposes, in accordance with applicable law.

Where TMPVL processes personal data of a child, TMPVL shall obtain verifiable consent from the parent or lawful guardian prior to such processing, through appropriate verification steps, which may include confirming the identity and authority of the parent or lawful guardian, maintaining records of such consent, and enabling withdrawal of consent in accordance with applicable law.

If TMPVL learns that personal data of a child has been collected without verifiable parental consent, then TMPVL may take the appropriate steps to delete such information. However, if you discover your child has submitted his/ her data to TMPVL, you may request to have such data deleted from TMPVL’s database by sending an e-mail request. Upon receiving the request, TMPVL shall ensure to delete such information from its database.

When we process data about you, we do so with your consent and/or as necessary to operate our business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfil other legitimate uses of TMPVL as permitted under the Digital Personal Data Protection Act, 2023 as described in this Privacy Notice.

We respect your right to access and control your information, and we will respond to requests for information and, where applicable, will correct, amend, or delete your personal data/information.

In such cases, we will need you to respond with proof of your identity before you can exercise these rights.
 

1. Right to Access Information: You have the right to obtain a summary of your personal data being processed and the identities of entities with whom your data has been shared.
2. Right to Correction and Erasure: You may request correction of inaccurate or misleading data, completion of incomplete data, and erasure of data that is no longer necessary or required to be retained.
3. Right to Grievance Redressal: You can raise grievances related to the processing of your personal data with our designated grievance redressal mechanism.
4. Right to Nominate: You have the right to nominate another individual to exercise your rights under this Act in the event of your death or incapacity.
5. Right to Withdraw Consent: Where data processing is based on consent, you have the right to withdraw such consent at any time.

It is important and duty of Data principal to share accurate and current data with us. Please keep us informed if your personal information changes during the period for which we hold it.

You may submit a request as described in the “Grievance Redressal” section below. We will not charge you for any request. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will inform you of the reasons for such refusal.

To protect your personal data, we may require you to complete an identity-verification step before processing your request. If the information or documents provided for verification do not match our records or are insufficient to reasonably establish your identity, we may be unable to act on your request and may refuse it, in which case we will notify you of the reason for non-processing. In the unfortunate event of a personal data breach, we are committed to taking immediate steps to reduce harm and ensure transparency.

In accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, TMPVL shall without undue delay inform the Data Protection Board of India of any breach of personal data. Notification will include the nature of the breach, categories of personal data affected, potential risks, and the remedial actions taken or proposed.

We have established an internal incident-response process to:
 

• Promptly identify and assess any personal data breach;
• Notify the data protection board immediately and submit report on the same within 72 hours as required under the DPDP act and rules; and
• Notify the affected data principals immediately where the breach is likely to cause harm, as mandated under rule-based obligations.
   

TMPVL is also committed to providing you timely notification of a data breach, in accordance with the procedures prescribed under the DPDP Rules. Such notice will outline the nature of the breach, its possible impact, measures implemented and steps you may take to protect yourself.

We aim to issue such notifications without undue delay, following the timelines and modalities set out in the DPDP Rules.