Employee Non-Disclosure, Confidentiality, Data Protection & Intellectual Property Agreement

2. Purpose of This Agreement

The purpose of this Agreement is to:

• (a) protect the Company's Confidential Information, Trade Secrets, Intellectual Property and proprietary business information;
• (b) safeguard confidential information belonging to clients, customers, vendors and business partners;
• (c) establish legally binding confidentiality obligations upon the Employee;
• (d) prevent unauthorized disclosure, copying, misuse or exploitation of confidential information;
• (e) protect the Company's technological infrastructure and information assets;
• (f) ensure compliance with applicable laws relating to confidentiality, information security and data protection; and
• (g) provide the Company with appropriate contractual remedies in the event of any breach of confidentiality

3. Applicability

This Agreement shall apply throughout the Employee's employment and, wherever expressly provided, shall continue even after resignation, retirement, termination or cessation of employment for any reason whatsoever.

This Agreement shall apply irrespective of whether the Employee performs duties:

• at Company premises;
• at client locations;
• remotely;
• under a Work From Home arrangement;
• while travelling for official purposes; or
• through any electronic communication platform or Company system.

4. Definitions

For the purposes of this Agreement, unless the context otherwise requires:

4.1 "Confidential Information"

"Confidential Information" means every form of information, whether oral, written, electronic, digital, visual or otherwise, relating directly or indirectly to the Company, its clients or business operations, including but not limited to:

• (a) customer information;
• (b) client databases;
• (c) CRM records;
• (d) call recordings;
• (e) customer interaction history;
• (f) business strategies;
• (g) pricing models;
• (h) financial information;
• (i) source code;
• (j) software applications;
• (k) internal manuals;
• (l) policies;
• (m) operational processes;
• (n) marketing strategies;
• (o) business plans;
• (p) vendor information;
• (q) employee information;
• (r) login credentials;
• (s) passwords;
• (t) trade secrets;
• (u) research and development information;
• (v) algorithms;
• (w) workflow documentation;
• (x) intellectual property;
• (y) technical documentation; and
• (z) every other information identified as confidential by the Company.

4.2 "Trade Secret"

Trade Secret means any confidential business, technical or commercial information that derives independent economic value from not being generally known and includes proprietary methods, customer acquisition strategies, pricing methodologies, software logic, internal business models, quality assurance mechanisms, process documentation, client-specific operational methods and every confidential commercial practice developed by the Company.

4.3 "Client Information"

Client Information includes every document, communication, record, database, agreement, report, customer list, operational process, pricing information, technology, software, confidential instruction, business strategy and any information belonging to or received from any client of the Company.

4.4 "Company Property"

Company Property includes every tangible and intangible asset belonging to the Company including laptops, desktops, mobile devices, headsets, servers, storage devices, access cards, documents, software, intellectual property, databases, confidential information, CRM systems, emails, source codes, passwords and all Company-issued materials.

4.5 "Intellectual Property"

Intellectual Property includes every invention, process, software, database, source code, design, document, training material, presentation, report, trademark, copyright, workflow, operational manual, client process, algorithm, template or any other work created, developed or improved during the course of employment.

5. Employee Confidentiality Obligations

The Employee acknowledges that Confidential Information constitutes valuable commercial assets of the Company and agrees that he/she shall maintain the strictest confidentiality at all times.

Accordingly, the Employee shall:

• (a) protect all Confidential Information from unauthorized access or disclosure;
• (b) use Confidential Information solely for legitimate Company purposes;
• (c) exercise reasonable care while handling Company information;
• (d) comply with all Company Information Security Policies;
• (e) promptly report any suspected confidentiality breach;
• (f) prevent unauthorized access by third parties;
• (g) protect customer privacy;
• (h) safeguard client information;
• (i) immediately notify the Company regarding any accidental disclosure; and
• (j) fully cooperate during any confidentiality investigation.

6. Non-Disclosure Obligations

Except with prior written authorization from the Company or where disclosure is expressly required by law, the Employee shall not, directly or indirectly:

• (a) disclose Confidential Information to any person;
• (b) copy Company databases;
• (c) reproduce confidential documents;
• (d) photograph confidential information;
• (e) download Company information onto personal devices;
• (f) transfer confidential information through email or messaging applications;
• (g) disclose customer information;
• (h) disclose client contracts;
• (i) disclose pricing information;
• (j) disclose internal policies or operational processes;
• (k) publish confidential information on social media;
• (l) communicate confidential information to competitors;
• (m) exploit confidential information for personal benefit; or
• (n) permit any unauthorized person to access Company systems or confidential records.

The obligations contained in this clause shall survive the termination of employment.

7. Permitted Disclosure

Disclosure of Confidential Information shall be permitted only where:

• (a) prior written authorization has been granted by the Company;
• (b) disclosure is required by a competent court or statutory authority;
• (c) disclosure is legally mandatory under applicable law;
• (d) disclosure is required during official investigations by competent authorities; or
• (e) disclosure is specifically authorized under a written agreement executed by the Company.

Where legally permissible, the Employee shall promptly notify the Company before making any disclosure pursuant to this clause.

8. Return of Company Property

Upon demand by the Company or immediately upon cessation of employment, whichever occurs earlier, the Employee shall promptly return all Company Property, including but not limited to:

• laptops;
• desktops;
• mobile devices;
• access cards;
• identity cards;
• headsets;
• storage devices;
• confidential documents;
• client records;
• passwords;
• digital credentials;
• manuals;
• training material;
• files;
• software;
• source codes; and
• every other Company asset in the Employee's possession, custody or control.

The Employee shall permanently delete all Company information from personal devices, cloud storage, email accounts or any other storage medium and shall certify such deletion if required by the Company.

9. Intellectual Property

Every invention, improvement, software, report, database, document, presentation, workflow, customer solution, process improvement, research material or other work created, conceived, authored or developed by the Employee during the course of employment and relating to the Company's business shall exclusively vest in the Company.

The Employee irrevocably assigns to the Company all present and future rights, title and interest in such Intellectual Property to the fullest extent permissible under applicable law.

The Employee shall execute all documents reasonably required by the Company for securing, registering, enforcing or protecting such Intellectual Property rights.

10. Continuing Obligations

The Employee acknowledges that confidentiality obligations are of a continuing nature.

Accordingly, even after resignation, retirement, termination or cessation of employment, the Employee shall continue to:

• (a) maintain confidentiality of Company information;
• (b) protect client information;
• (c) refrain from unauthorized disclosure;
• (d) avoid misuse of proprietary information;
• (e) protect trade secrets;
• (f) preserve intellectual property rights; and
• (g) comply with every surviving obligation contained in this Agreement.

These obligations shall remain enforceable for so long as the relevant information retains its confidential or proprietary character, unless a shorter period is expressly prescribed by applicable law.

11. Customer Data Protection

The Employee acknowledges that, during the course of employment, he/she may access Personal Data, Sensitive Personal Data (where applicable), customer records, client databases, financial information, communication records and other confidential information belonging to customers and clients.

Accordingly, the Employee shall:

• (a) access customer information strictly on a need-to-know basis;
• (b) use customer information solely for authorized business purposes;
• (c) comply with the Company's Data Protection Policy, Information Security Policy and applicable laws;
• (d) immediately report any suspected data breach, unauthorized disclosure or security incident;
• (e) ensure that customer information is protected from unauthorized access, alteration, destruction or misuse;
• (f) refrain from retaining customer information after completion of assigned work;
• (g) cooperate with internal investigations relating to data protection; and
• (h) comply with all client-specific privacy and confidentiality obligations.

The Employee shall not process, copy, retain, disclose or transfer customer information beyond the scope of authorized duties.

12. Client Databases, CRM and Business Information

The Company's Customer Relationship Management (CRM) systems, databases, dashboards, client portals and operational platforms contain highly confidential business information.

The Employee shall not, directly or indirectly:

• (a) download client databases;
• (b) export customer records;
• (c) copy CRM information;
• (d) print confidential customer reports without authorization;
• (e) transfer client information through external storage devices;
• (f) share CRM screenshots;
• (g) disclose client processes;
• (h) reproduce client workflows;
• (i) duplicate customer lists;
• (j) retain CRM information after completion of employment; or
• (k) permit unauthorized access to Company systems.

Every activity performed within Company systems may be logged and monitored.

13. Call Recordings, Communications and Customer Interactions

The Employee acknowledges that telephone conversations, chats, emails, voice recordings, video communications, customer interactions and operational communications may be recorded, monitored, reviewed or audited for quality assurance, compliance, training, fraud prevention, legal compliance, dispute resolution and business continuity.

The Employee shall not:

• (a) copy call recordings;
• (b) record customer conversations using personal devices;
• (c) distribute recordings;
• (d) upload recordings to cloud services;
• (e) retain customer conversations after employment;
• (f) alter communication records;
• (g) delete official records without authorization; or
• (h) disclose recorded communications to unauthorized persons.

14. Passwords, Login Credentials and Access Control

The Employee shall maintain the confidentiality of all login credentials issued by the Company.

The Employee shall:

• (a) create secure passwords in accordance with Company requirements;
• (b) periodically update passwords whenever required;
• (c) immediately report compromised credentials;
• (d) use Multi-Factor Authentication (MFA), where implemented;
• (e) securely log out after completion of work; and
• (f) prevent unauthorized persons from accessing Company systems.

The Employee shall not:

• share passwords;
• disclose One-Time Passwords (OTPs);
• permit another person to use assigned credentials;
• use another employee's credentials;
• circumvent security controls;
• disable security software; or
• create unauthorized user accounts.

The Employee shall remain responsible for activities performed using credentials assigned to him/her unless promptly reported as compromised.

15. Company Devices and Personal Device Restrictions (BYOD)

The Employee shall use Company-issued devices solely for authorized business purposes.

Unless specifically approved in writing by the Company, Employees shall not:

• (a) store Company information on personal laptops;
• (b) use personal mobile phones for customer data processing;
• (c) connect unauthorized USB devices;
• (d) synchronize Company information with personal cloud storage;
• (e) install unauthorized applications;
• (f) jailbreak or root Company devices;
• (g) disable security software;
• (h) remove Company-installed monitoring software; or
• (i) bypass endpoint security controls.

Where Bring Your Own Device (BYOD) is expressly permitted, the Employee shall comply with all security measures prescribed by the Company, including device encryption, remote wipe capability and mobile device management (MDM) requirements.

16. Restrictions on Artificial Intelligence (AI) Tools

The Employee acknowledges that unauthorized use of Artificial Intelligence platforms may expose confidential information and create significant legal and commercial risks.

Accordingly, without prior written approval from the Company, the Employee shall not upload, input, disclose or process any Company, client or customer information through any publicly available Artificial Intelligence platform, including but not limited to:

• ChatGPT;
• Google Gemini;
• Microsoft Copilot;
• Claude;
• Perplexity AI;
• DeepSeek;
• Grok;
• Meta AI;
• GitHub Copilot; or
• any other generative AI platform or large language model.

The Employee shall not:

• (a) upload customer data;
• (b) upload client contracts;
• (c) upload source code;
• (d) upload confidential reports;
• (e) upload financial information;
• (f) upload personal data;
• (g) upload internal policies;
• (h) upload trade secrets; or
• (i) permit any AI platform to retain confidential Company information.

Use of Company-approved AI systems shall remain subject to separate Company policies.

17. Email, Internet and Electronic Communication

The Company's electronic communication systems shall be used primarily for official business purposes.

Employees shall not:

• (a) send confidential information to personal email accounts;
• (b) forward client communications without authorization;
• (c) access illegal or prohibited websites;
• (d) transmit malicious software;
• (e) use Company email for unlawful purposes;
• (f) send defamatory, abusive, threatening or discriminatory communications;
• (g) impersonate another individual;
• (h) misuse Company communication platforms; or
• (i) interfere with electronic communication systems.

The Company reserves the right to monitor official communications in accordance with applicable law and Company policy.

18. Social Media, Public Statements and Media Communication

Employees shall maintain professionalism while using social media and public communication platforms.

Without prior written authorization, Employees shall not:

• (a) disclose confidential Company information;
• (b) disclose client identities;
• (c) publish internal documents;
• (d) upload workplace photographs containing confidential material;
• (e) make public statements on behalf of the Company;
• (f) disclose customer information;
• (g) circulate misleading information relating to the Company;
• (h) publish defamatory content affecting the Company, its employees, clients or customers; or
• (i) represent personal opinions as official Company positions.

Nothing contained in this clause shall prevent an Employee from exercising any lawful rights protected under applicable law.

19. Remote Working Security

Employees authorized to work remotely shall ensure that Company information remains protected at all times.

Employees shall:

• (a) secure workstations from unauthorized access;
• (b) prevent family members or third parties from accessing Company systems;
• (c) use encrypted internet connections wherever required;
• (d) immediately report device theft or loss;
• (e) securely store Company documents;
• (f) avoid working from insecure public networks unless protected by Company-approved security measures; and
• (g) comply with all remote access protocols prescribed by the Company.

20. Cybersecurity Compliance

Employees shall actively cooperate in protecting the Company's digital infrastructure.

Employees shall immediately report:

• (a) phishing emails;
• (b) malware attacks;
• (c) ransomware incidents;
• (d) unauthorized system access;
• (e) suspected hacking attempts;
• (f) suspicious login activity;
• (g) compromised credentials;
• (h) accidental disclosure of confidential information; and
• (i) every cybersecurity incident affecting Company systems.

Failure to promptly report a known cybersecurity incident may itself constitute misconduct.

21. Company Monitoring Rights

To protect its legitimate business interests, information assets, customers and clients, the Company may, to the extent permitted by applicable law, monitor, record, review, inspect or audit:

• (a) Company-issued devices;
• (b) official emails;
• (c) internet usage;
• (d) system login records;
• (e) access logs;
• (f) customer interactions;
• (g) call recordings;
• (h) CCTV footage at Company premises;
• (i) file transfer activities;
• (j) printing activities;
• (k) storage devices connected to Company systems;
• (l) network traffic;
• (m) application usage; and
• (n) any other activity conducted using Company resources.

Such monitoring may be undertaken for information security, regulatory compliance, quality assurance, fraud prevention, investigation of misconduct, business continuity and protection of Company assets.

22. Inspection, Audit and Compliance

The Employee shall fully cooperate with any internal or external audit, inspection, compliance review, forensic examination or investigation conducted by or on behalf of the Company.

Where reasonably required, the Employee shall:

• (a) provide access to Company devices;
• (b) produce Company documents;
• (c) answer official inquiries truthfully;
• (d) preserve electronic evidence;
• (e) cooperate during digital forensic investigations;
• (f) refrain from destroying evidence; and
• (g) comply with lawful instructions issued during investigations.

Any attempt to conceal, destroy, alter or manipulate evidence relating to Company business may constitute serious misconduct.

23. Employee Certification

The Employee hereby certifies that he/she:

• (a) understands the confidentiality obligations contained in this Agreement;
• (b) shall comply with all Company Information Security Policies;
• (c) shall immediately report any suspected confidentiality or cybersecurity incident;
• (d) shall not knowingly permit unauthorized disclosure of Confidential Information;
• (e) shall comply with all future amendments issued by the Company relating to confidentiality, cybersecurity and data protection; and
• (f) acknowledges that violation of this Agreement may result in disciplinary, civil and criminal consequences in accordance with applicable law and the terms of this Agreement.

24. Breach of This Agreement

The Employee acknowledges that any unauthorized disclosure, misuse, copying, retention, transmission, destruction or exploitation of Confidential Information, Trade Secrets, Client Information, Personal Data, Intellectual Property or Company Property shall constitute a material and fundamental breach of this Agreement.

Without prejudice to any other rights available under law, the following acts shall be deemed to constitute a breach of this Agreement:

• (a) unauthorized disclosure of confidential information;
• (b) theft or attempted theft of Company or client data;
• (c) unauthorized copying or downloading of Company information;
• (d) forwarding confidential information to personal email accounts or third parties;
• (e) unauthorized use of confidential information for personal benefit or for the benefit of any competitor;
• (f) unauthorized retention of Company information after cessation of employment;
• (g) unauthorized access to Company systems or databases;
• (h) tampering with electronic records;
• (i) destruction, concealment or alteration of evidence;
• (j) disclosure of customer information;
• (k) misuse of Company intellectual property;
• (l) unauthorized use of Company branding, documents or software;
• (m) assisting any third party in obtaining Confidential Information; or
• (n) any other act causing or likely to cause financial, reputational or operational harm to the Company or its clients.

25. Immediate Administrative Action

Where the Company reasonably believes that the Employee has committed or is likely to commit a breach of this Agreement, the Company may, without prejudice to its other legal rights and subject to applicable law, immediately:

• (a) suspend the Employee pending investigation;
• (b) disable email accounts and official communication channels;
• (c) deactivate system credentials;
• (d) revoke VPN and remote access;
• (e) restrict access to Company premises;
• (f) seize or secure Company-issued devices;
• (g) preserve digital evidence;
• (h) initiate an internal investigation;
• (i) notify affected clients, where contractually or legally required; and
• (j) take such additional protective measures as may be necessary to safeguard Company interests.

Such interim measures shall not constitute a determination of guilt.

26. Disciplinary Consequences

Violation of this Agreement shall constitute serious misconduct and may result in one or more of the following actions, depending upon the gravity of the breach:

• (a) written warning;
• (b) final warning;
• (c) suspension pending inquiry;
• (d) withholding of incentives or benefits, where legally permissible;
• (e) demotion or reassignment;
• (f) termination of employment;
• (g) cancellation of access privileges;
• (h) blacklisting from future employment within the Company or its affiliates, where legally permissible; and
• (i) initiation of civil and/or criminal proceedings.

The disciplinary action shall be determined by the Company after considering the nature of the misconduct, surrounding circumstances and applicable law.

27. Indemnity

The Employee agrees to indemnify, defend and hold harmless the Company, its Directors, Officers, Shareholders, Employees, Affiliates, Successors, Assigns and Clients against all losses, liabilities, damages, claims, costs and expenses arising directly from any wilful or negligent breach of this Agreement by the Employee, to the extent permissible under applicable law.

Such losses may include, without limitation:

• (a) actual financial losses;
• (b) contractual liabilities imposed upon the Company by its clients due to the Employee's breach;
• (c) investigation expenses;
• (d) digital forensic expenses;
• (e) data recovery expenses;
• (f) legal costs and litigation expenses, where awarded or recoverable under law;
• (g) regulatory penalties imposed on the Company due to the Employee's unlawful conduct, where legally recoverable; and
• (h) any other reasonably foreseeable losses directly attributable to the Employee's breach.

28. Recovery of Losses

The Employee acknowledges that unauthorized disclosure of Confidential Information may expose the Company to substantial commercial loss.

Accordingly, where a breach is established, the Company shall be entitled, subject to applicable law, to seek recovery of:

• (a) actual losses suffered by the Company;
• (b) compensation payable to affected clients due to the Employee's misconduct, where legally recoverable;
• (c) costs of internal investigation;
• (d) expenses incurred in mitigating the effects of the breach;
• (e) costs associated with data restoration and cybersecurity response;
• (f) legal expenses recoverable under applicable law or by order of a competent court or tribunal; and
• (g) any other monetary relief granted by a court of competent jurisdiction.

The Employee agrees that recovery under this clause shall be in addition to, and not in substitution of, any other legal remedy available to the Company.

29. Injunctive and Equitable Relief

The Employee expressly acknowledges that unauthorized disclosure of Confidential Information may cause irreparable harm to the Company that cannot always be adequately compensated by monetary damages alone.

Accordingly, the Company shall be entitled to seek, before any competent court or tribunal:

• (a) temporary injunctions;
• (b) interim injunctions;
• (c) permanent injunctions;
• (d) restraining orders;
• (e) orders for preservation of evidence;
• (f) orders restraining further disclosure or misuse of confidential information;
• (g) delivery-up or destruction of unlawfully retained confidential materials; and
• (h) any other equitable relief available under applicable law.

The availability of injunctive relief shall not prejudice the Company's right to claim damages or pursue any other legal remedy.

30. Civil and Criminal Proceedings

Where the Employee's conduct constitutes a violation of applicable law, the Company reserves the right to initiate appropriate legal proceedings before the competent authorities.

Depending upon the facts and circumstances, the Company may initiate:

• (a) civil suits for damages, injunctions, recovery or specific relief;
• (b) proceedings under the applicable provisions of the Indian Contract Act, 1872;
• (c) proceedings under the Information Technology Act, 2000, as amended;
• (d) proceedings under the Digital Personal Data Protection Act, 2023, where applicable;
• (e) proceedings under the Copyright Act, 1957;
• (f) proceedings under the Trade Marks Act, 1999, where applicable;
• (g) criminal complaints under the Bharatiya Nyaya Sanhita, 2023 or any other applicable penal law, where the facts disclose the commission of an offence; and
• (h) any additional proceedings available under applicable law.

The initiation of one legal remedy shall not prevent the Company from pursuing any other lawful remedy simultaneously or subsequently.

31. Survival of Obligations

The Employee agrees that the obligations relating to confidentiality, intellectual property, trade secrets, client information, data protection, non-disclosure, indemnity and dispute resolution shall survive the termination, resignation, retirement or cessation of employment.

The obligation to protect trade secrets and proprietary information shall continue for so long as such information retains its confidential nature or until lawfully released into the public domain through no fault of the Employee.

32. Non-Solicitation

During employment and for a period of twelve (12) months following cessation of employment, to the extent enforceable under applicable law, the Employee shall not, without the prior written consent of the Company:

• (a) knowingly solicit or induce any existing client of the Company to terminate or materially reduce its business relationship with the Company;
• (b) knowingly induce any employee holding a managerial, supervisory or key operational position to leave the Company's employment through improper means; or
• (c) misuse Confidential Information for the purpose of diverting business opportunities belonging to the Company.

Nothing in this clause shall prevent lawful competition or restrict any right that cannot legally be restricted under applicable law.

33. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Republic of India.

The Parties shall comply with all applicable statutory provisions relating to employment, information security, confidentiality, intellectual property and data protection.

34. Dispute Resolution

The Parties shall endeavour to resolve any dispute arising out of or in connection with this Agreement through good-faith discussions.

If the dispute remains unresolved, it shall be referred to arbitration in accordance with the provisions of the Arbitration and Conciliation Act, 1996, as amended.

Unless otherwise agreed in writing:

• (a) the arbitration shall be conducted by a Sole Arbitrator appointed by the Company, subject to the provisions of applicable law;
• (b) the seat and venue of arbitration shall be Indore, Madhya Pradesh;
• (c) the arbitration proceedings shall be conducted in the English language; and
• (d) the arbitral award shall be final and binding upon the Parties.

Nothing contained herein shall prevent the Company from approaching a competent court for urgent interim or injunctive relief.

35. Jurisdiction

Subject to the arbitration provisions contained herein, the courts having territorial jurisdiction over Indore, Madhya Pradesh, shall have exclusive jurisdiction in respect of all proceedings relating to interim relief, enforcement of arbitral awards or any matter not capable of settlement through arbitration.

36. Severability

If any provision of this Agreement is declared invalid, illegal or unenforceable by a competent court or tribunal, such provision shall be severed only to the extent of such invalidity, and the remaining provisions shall continue in full force and effect

37. Waiver

Failure or delay by the Company in exercising any right or remedy under this Agreement shall not constitute a waiver of such right, nor shall any single or partial exercise prevent any further exercise of that or any other right.

38. Entire Agreement

This Agreement constitutes the entire understanding between the Parties concerning confidentiality, data protection, intellectual property and non-disclosure obligations and supersedes all previous oral or written understandings relating to the same subject matter.

This Agreement shall be read harmoniously with the Employee's Appointment Letter, Employment Agreement, Human Resources Policy, Information Security Policy, Code of Conduct, Zero Tolerance Policy, Employee Handbook and all other Company policies.

39. Amendment

The Company may amend this Agreement to reflect changes in applicable laws, regulatory requirements, client obligations or operational requirements.

Any amendment shall become effective upon written communication to the Employee or publication through the Company's official communication channels, unless execution of a revised agreement is required by law.

40. Employee Declaration

I, Mr./Ms. ______________________________, hereby declare that:

• (a) I have carefully read and understood every provision of this Agreement;
• (b) I voluntarily agree to comply with all confidentiality, data protection and intellectual property obligations contained herein;
• (c) I acknowledge that breach of this Agreement may result in disciplinary action, termination of employment, civil proceedings, criminal proceedings and recovery of losses, as permitted under applicable law;
• (d) I agree to immediately report any actual or suspected confidentiality or cybersecurity incident;
• (e) I shall return all Company Property upon demand or upon cessation of employment;
• (f) I understand that my confidentiality obligations shall continue even after the termination of my employment to the extent provided in this Agreement; and
• (g) I execute this Agreement voluntarily, without coercion, and with full understanding of its legal consequences.