Zero Tolerance Policy

1. Policy Statement

Please refer to the Policy Statement callout above, which forms an integral part of this Policy.

2. Objectives

The primary objectives of this Policy are to:

• establish absolute intolerance towards serious workplace misconduct and unethical behaviour;
• maintain a safe, healthy, respectful, harassment-free and discrimination-free workplace;
• protect employees against abuse, intimidation, threats, bullying, retaliation and unlawful treatment;
• safeguard confidential information, trade secrets, client information, customer data, proprietary technology, intellectual property and business records;
• ensure complete compliance with applicable laws, client contracts, industry standards, regulatory obligations and internal governance requirements;
• preserve client trust and confidence by preventing misuse of client information, customer interactions, operational processes and confidential business data;
• ensure integrity in customer interactions, call handling, chat support, digital communication, CRM management, collections, telemarketing, technical support and every operational process carried out by the Company;
• prevent fraud, dishonesty, financial misconduct, cyber fraud, identity theft, operational manipulation and abuse of Company resources;
• encourage employees to report misconduct without fear of retaliation;
• establish a transparent investigation mechanism based upon fairness, confidentiality and natural justice;
• protect the Company's assets, reputation, goodwill and commercial interests;
• promote ethical leadership and accountability at every organizational level; and
• create a workplace where professionalism, respect, integrity and compliance remain non-negotiable organizational values.

3. Scope and Applicability

This Policy shall apply uniformly to all individuals associated with AIRVINCIBLE, irrespective of designation, employment status, reporting structure or geographical location.

Without limitation, this Policy shall apply to:

• permanent employees;
• probationary employees;
• trainees and apprentices;
• interns;
• consultants;
• contractual employees;
• temporary staff;
• agency personnel;
• third-party manpower;
• vendors while operating within Company premises or systems;
• service providers;
• management personnel;
• directors;
• senior leadership;
• visitors to the extent applicable; and
• any other individual acting on behalf of the Company.

This Policy shall apply to conduct occurring:

• within Company premises;
• client locations;
• work-from-home environments;
• hybrid workplaces;
• official travel;
• transportation arranged by the Company;
• training programs;
• conferences;
• meetings;
• business events;
• virtual meetings;
• online platforms;
• telephone communications;
• emails;
• messaging applications;
• CRM systems;
• client portals;
• Company-issued devices;
• personal devices used for Company work;
• cloud platforms;
• social media where Company interests are affected; and
• every digital or physical environment connected with Company operations.

This Policy shall remain applicable during working hours as well as outside working hours where the conduct has the potential to adversely affect the Company's reputation, clients, employees, operations, legal compliance, contractual obligations, information security, or legitimate business interests.

4. Definitions

Unless the context otherwise requires:

• "Company" means AIRVINCIBLE together with its affiliates, branches, business units, management, representatives and authorized personnel.
• "Employee" means every individual engaged by the Company in any capacity, including permanent, temporary, contractual, probationary, trainee, consultant, intern or outsourced personnel.
• "Workplace" shall have the widest possible interpretation and includes every physical, virtual, digital or remote location connected with Company business.
• "Client Information" includes all information relating to clients, customers, vendors, business partners, prospects or service recipients including personal information, commercial information, operational information, financial information, technical information, strategic information and confidential communications.
• "Confidential Information" means any information, whether written, oral, electronic, visual or otherwise, that is not publicly available and relates to the Company's business, operations, customers, employees, technology, software, source codes, pricing, processes, databases, reports, strategies, financial information, business plans, intellectual property, trade secrets or any information designated as confidential.
• "Personal Data" shall have the meaning assigned under applicable data protection laws and shall include any information capable of identifying an individual directly or indirectly.
• "Misconduct" means any act or omission violating applicable laws, Company policies, contractual obligations, professional ethics or standards of acceptable workplace behaviour.
• "Gross Misconduct" means misconduct of such serious nature that it fundamentally destroys the relationship of trust between the Company and the individual concerned and may warrant immediate disciplinary action including termination.
• "Fraud" means any intentional deception, concealment, manipulation, falsification, unauthorized benefit, dishonest act or abuse of authority intended to secure unlawful gain or cause wrongful loss.
• "Cybersecurity Incident" means any unauthorized access, hacking attempt, malware attack, phishing, ransomware incident, credential compromise, social engineering attack, unauthorized system usage or any event affecting the confidentiality, integrity or availability of Company information systems.
• "Retaliation" means any direct or indirect adverse action taken against an individual because such individual reported misconduct, cooperated in an investigation, provided evidence or exercised any legal or policy-based right.

5. Guiding Principles

The implementation of this Policy shall be governed by the following principles:

5.1 Zero Tolerance

The Company adopts an uncompromising approach towards serious misconduct. Any violation falling within the scope of this Policy may result in disciplinary, contractual, civil or criminal consequences depending upon the gravity of the offence.

5.2 Fairness

Every complaint shall be examined objectively, impartially and without bias. No conclusion shall be drawn solely on assumptions, personal opinions or unsupported allegations.

5.3 Confidentiality

The identity of complainants, witnesses, respondents, investigation records and related information shall remain confidential except where disclosure is required for investigation, legal compliance or judicial proceedings.

5.4 Natural Justice

Every individual against whom allegations are made shall be provided a reasonable opportunity to present their explanation, evidence and defence before any final decision is taken, except where immediate interim action is necessary to protect employees, clients, information assets or business operations.

5.5 Legal Compliance

All actions under this Policy shall be undertaken in accordance with applicable laws, statutory obligations, contractual commitments and regulatory requirements.

5.6 Protection of Victims

Individuals reporting genuine concerns in good faith shall be protected against retaliation, victimization, intimidation, discrimination or adverse employment consequences.

5.7 Accountability

Every employee is individually responsible for complying with this Policy irrespective of position, seniority, targets, performance expectations or reporting hierarchy.

5.8 Proportionality

The disciplinary action imposed shall be proportionate to the nature, gravity, impact, intent, recurrence and surrounding circumstances of the misconduct.

5.9 Prevention Before Punishment

The Company shall promote awareness, training, supervision, counselling, process improvements and risk mitigation measures to prevent misconduct before punitive action becomes necessary.

5.10 Continuous Compliance

Compliance with this Policy is a continuing obligation and shall remain applicable throughout the tenure of engagement and, where legally or contractually required, even after cessation of employment.

6. General Principles of Zero Tolerance

The following principles shall govern the interpretation and implementation of this Policy:

• No employee shall claim ignorance of this Policy as a defence.
• No individual shall be exempt from this Policy on the basis of designation, experience, seniority, business performance, revenue generation, client relationship or organizational position.
• Financial performance, operational achievements or client acquisition shall not justify misconduct.
• Every employee has an affirmative duty to report known or suspected violations.
• Failure to report serious misconduct may itself constitute misconduct under this Policy.
• Attempts to conceal, destroy, manipulate or fabricate evidence shall constitute independent violations.
• Multiple violations arising from the same incident may invite separate disciplinary actions.
• The Company reserves the right to initiate simultaneous internal disciplinary proceedings together with civil, criminal or regulatory action wherever appropriate.
• Any act causing financial loss, reputational damage, regulatory exposure, contractual breach or compromise of client confidence shall be viewed as an aggravating circumstance while determining disciplinary consequences.
• Nothing contained in this Policy limits the Company's right to recover losses, seek compensation, enforce contractual rights or pursue any legal remedy available under applicable law.

7. Zero Tolerance Areas

The Company adopts an absolute Zero Tolerance approach towards the acts, omissions, practices, behaviours, or activities described under this Part. Any employee, irrespective of designation, position, seniority, tenure, incentives, performance, or reporting hierarchy, who commits, attempts to commit, facilitates, conceals, assists, encourages, or negligently permits any of the following misconduct shall be liable for disciplinary, contractual, civil and/or criminal action depending upon the nature and gravity of the violation.

The categories mentioned herein are illustrative and not exhaustive. The Company reserves the right to classify any conduct having similar effect or intent as misconduct under this Policy.

8. Sexual Misconduct (Outside the Scope of POSH)

This Policy covers all inappropriate sexual conduct which may not necessarily fall within the jurisdiction of the Company's POSH Policy but is inconsistent with professional conduct, workplace dignity, ethics and organizational values.

Without limitation, the following shall constitute serious misconduct:

• repeated unwelcome compliments having sexual undertones;
• inappropriate flirting despite indication of disinterest;
• making sexually suggestive remarks, jokes, gestures or expressions;
• discussing another person's private or intimate life without consent;
• circulating vulgar conversations, memes, reels, GIFs or messages within official communication groups;
• forwarding obscene content using Company systems or while representing the Company;
• inappropriate comments regarding appearance, body language, clothing or physical attributes;
• repeated requests for personal meetings, dates or relationships after refusal;
• unnecessary physical proximity intended to cause discomfort;
• making offensive remarks relating to gender identity or sexual orientation;
• use of abusive, vulgar or sexually explicit language;
• recording, photographing or sharing another person's image without authorization;
• stalking, repeated messaging, unwanted communication or digital harassment;
• misuse of official authority to create personal relationships; and
• any conduct which creates an intimidating, humiliating, offensive or uncomfortable working environment.

Even where such conduct does not amount to sexual harassment under applicable law, the Company may independently initiate disciplinary proceedings under this Policy.

9. Workplace Bullying, Harassment and Intimidation

The Company is committed to providing a workplace that promotes dignity, mutual respect, professionalism, and psychological safety. Any form of workplace bullying, intimidation, humiliation, verbal abuse, psychological harassment, or any conduct that creates a hostile, offensive, or intimidating work environment is strictly prohibited and shall constitute misconduct. The following acts are illustrative and not exhaustive:

• repeated insults or humiliation;
• verbal abuse;
• public embarrassment of colleagues;
• shouting, threatening or using abusive language;
• deliberate isolation from meetings or work;
• spreading rumours or false allegations;
• social exclusion;
• repeated mocking or ridicule;
• assigning work solely to harass another employee;
• misuse of authority to mentally pressure subordinates;
• threatening termination without authority;
• intentional obstruction of another employee's work;
• continuous criticism without constructive purpose;
• creating a hostile work environment;
• harassment through emails, calls, chats or social media;
• cyber bullying; and
• encouraging others to harass or isolate an employee.

Both intentional and indirect acts of harassment, bullying, intimidation, or any conduct having the effect of creating an unsafe or hostile workplace shall constitute misconduct under this Policy.

10. Discrimination

The Company is committed to providing equal employment opportunities and maintaining a workplace that is fair, inclusive, respectful, and free from discrimination. Any direct or indirect discrimination, unequal treatment, harassment, or exclusion on the basis of any characteristic protected under the Constitution of India or applicable law is strictly prohibited. No employee shall discriminate against any individual on the basis of:

• Religion;
• Race;
• Caste;
• Colour;
• Sex;
• Gender;
• Gender Identity;
• Sexual Orientation;
• Place of Birth;
• Language;
• Ethnicity;
• Nationality;
• Descent;
• Disability;
• Marital Status;
• Pregnancy;
• Age;
• Medical Condition where protected by law;
• Social Status; or
• Any other characteristic protected under applicable law.

Discrimination includes, but is not limited to:

• biased hiring;
• unfair promotion decisions;
• unequal allocation of work;
• exclusion from opportunities;
• discriminatory remarks;
• offensive stereotypes;
• religious intolerance;
• caste-based remarks;
• regional discrimination;
• discriminatory performance evaluations;
• unequal training opportunities;
• discriminatory salary recommendations;
• denial of reasonable workplace accommodations; and
• creating a hostile work environment based upon any protected characteristic.

Any employee found engaging in discriminatory conduct shall be liable for disciplinary action in accordance with this Policy and applicable law.

11. Workplace Violence

The Company adopts a strict Zero Tolerance approach towards workplace violence and any conduct that threatens the safety, security, health, or well-being of any employee, client, customer, visitor, contractor, or other stakeholder. Violence includes both physical and non-physical acts and shall not be tolerated under any circumstances.

Workplace violence includes, but is not limited to:

• physical assault;
• pushing;
• hitting;
• slapping;
• kicking;
• throwing objects;
• damaging another person's belongings;
• threatening bodily harm;
• intimidation through aggressive behaviour;
• criminal intimidation;
• displaying weapons;
• threatening messages;
• violent gestures;
• physical confinement;
• provoking fights;
• encouraging workplace violence;
• attempting violence; or
• any behaviour reasonably capable of causing fear of imminent harm.

Depending upon the nature and seriousness of the incident, the Company may initiate immediate disciplinary action, remove the individual from the workplace, and lodge complaints with the appropriate law enforcement authorities wherever necessary.

12. Fraud, Dishonesty and Financial Misconduct

The Company considers fraud, dishonesty, financial irregularities, and acts involving deception or wrongful gain to be among the gravest forms of misconduct. Any act intended to obtain wrongful gain or cause wrongful loss to the Company, its clients, customers, employees, or any other person shall constitute fraud under this Policy.

Fraud includes, but is not limited to:

• manipulation of attendance;
• proxy attendance;
• fake productivity;
• manipulation of call records;
• false client reporting;
• fake quality scores;
• forged approvals;
• forged documents;
• submission of false reimbursement claims;
• unauthorized financial transactions;
• unauthorized incentive claims;
• payroll fraud;
• identity fraud;
• misuse of Company funds;
• bribery;
• kickbacks;
• corruption;
• falsification of Company records;
• destruction of financial records;
• concealment of fraud;
• assisting fraudulent activities; and
• conspiracy to commit fraud.

Where fraud results in financial loss or legal liability, the Company may, subject to applicable law:

• recover the actual loss from the responsible individual(s);
• adjust recoverable amounts from salary or other lawful dues where legally permissible;
• forfeit incentives, bonuses, or other benefits to the extent permitted by law or contract;
• initiate civil recovery proceedings;
• lodge criminal complaints with law enforcement authorities; and
• terminate employment where warranted by the gravity of the misconduct.

Nothing contained herein shall restrict the Company's right to pursue any other civil, criminal, contractual, or statutory remedies available under applicable law.

13. Data Privacy Breaches

As a Business Process Outsourcing (BPO) organization handling confidential client and customer information, the Company considers information security and data privacy to be fundamental obligations of every employee. Any unauthorized access, use, disclosure, copying, storage, transfer, or misuse of confidential information or personal data shall be treated as Gross Misconduct.

Data privacy violations include, but are not limited to:

• unauthorized access;
• downloading customer databases;
• copying client information;
• sharing passwords;
• disclosure of OTPs;
• unauthorized screenshots;
• recording confidential information;
• unauthorized printing;
• unauthorized storage;
• forwarding Company emails;
• sharing confidential files;
• use of personal cloud storage;
• data extraction;
• unauthorized USB usage;
• unauthorized mobile photography;
• unauthorized data transfer;
• deliberate data leakage;
• negligent handling of personal data; and
• any violation of Company information security requirements.

The Company shall investigate and deal with all such violations strictly in accordance with the Information Technology Act, 2000 (as amended), the Digital Personal Data Protection Act, 2023, contractual obligations, Company information security policies, and other applicable laws.

14. Client Confidentiality Violations

The Company places the highest importance on protecting the confidentiality of its clients and their information. Every employee is under a continuing obligation to maintain the confidentiality of all client-related information obtained during the course of employment. Any unauthorized disclosure, use, sharing, or communication of confidential client information shall constitute serious misconduct.

Client confidentiality violations include, but are not limited to:

• disclosure of client identity;
• disclosure of client business information;
• disclosure of customer information;
• discussing client projects publicly;
• sharing client SOPs;
• revealing pricing;
• sharing commercial terms;
• discussing client complaints outside authorized channels;
• unauthorized communication with client customers;
• disclosure of client recordings;
• sharing CRM screenshots;
• sharing confidential reports;
• discussing confidential matters on social media;
• forwarding client emails;
• discussing internal client meetings; or
• any unauthorized disclosure of confidential client information.

Any breach of client confidentiality may result in disciplinary action, termination of employment, recovery of losses where legally permissible, and initiation of civil or criminal proceedings, in addition to any remedies available under applicable law or contractual obligations.

15. BPO-Specific Operational Misconduct

Considering the nature of Company operations, the following acts shall constitute Gross Misconduct:

• intentional call avoidance;
• deliberate call disconnect;
• fake dispositions;
• false CRM updates;
• manipulation of AHT, ACW or productivity reports;
• intentional customer misinformation;
• failure to follow approved scripts;
• unauthorized promises to customers;
• negligence in complaint handling;
• ignoring customer escalation protocols;
• deliberate poor customer service;
• unauthorized transfer of customer calls;
• fake customer verification;
• unauthorized customer authentication;
• intentional delay in ticket resolution;
• unauthorized use of AI tools during client interactions where prohibited;
• manipulation of QA processes;
• coaching customers to influence surveys;
• misuse of client systems;
• non-adherence to client SOPs;
• falsification of operational reports; and
• any act affecting client KPIs or contractual service standards.

16. Cybersecurity Violations

Every employee shall comply with the Company's Information Security requirements. Serious violations include:

• phishing;
• malware installation;
• unauthorized software;
• password sharing;
• credential theft;
• hacking attempts;
• social engineering;
• unauthorized VPN usage;
• bypassing security controls;
• use of pirated software;
• connecting unauthorized devices;
• disabling antivirus;
• sharing authentication credentials;
• unauthorized website access causing security risks;
• cyber fraud;
• cryptocurrency mining using Company resources;
• unauthorized remote access;
• unauthorized use of Company email;
• unauthorized use of social media representing the Company;
• digital impersonation; and
• any activity compromising confidentiality, integrity or availability of Company systems.

17. Theft, Misappropriation and Unauthorized Possession

The Company prohibits theft of any kind. This includes theft or misappropriation of:

• Company property;
• client property;
• customer property;
• confidential information;
• personal data;
• software;
• intellectual property;
• passwords;
• digital assets;
• office equipment;
• stationery;
• laptops;
• mobile devices;
• storage devices;
• access cards;
• documents;
• financial assets; or
• any tangible or intangible property.

Possession of stolen property, assisting theft, facilitating theft, concealing theft or attempting theft shall also constitute Gross Misconduct.

18. Substance Abuse

Employees shall not report to work while impaired by alcohol, narcotic drugs, psychotropic substances or any intoxicating substance affecting judgment, safety, productivity or professional conduct.

The following shall constitute misconduct:

• reporting to work under the influence;
• consuming prohibited substances within Company premises;
• possession of illegal narcotics;
• distribution of prohibited substances;
• encouraging substance abuse;
• impairment affecting customer interactions;
• operating Company equipment while intoxicated; or
• refusal to cooperate with lawful investigations where reasonable suspicion exists, subject to applicable law.

Where rehabilitation is appropriate and legally permissible, the Company may consider suitable support measures; however, this shall not prevent disciplinary action for misconduct.

19. Retaliation, Victimization and Whistleblower Protection

The Company strictly prohibits retaliation against any person who, in good faith:

• reports misconduct;
• files a complaint;
• participates in an investigation;
• provides evidence;
• acts as a witness;
• assists management; or
• exercises any right under Company policies or applicable law.

Retaliation includes:

• threats;
• intimidation;
• demotion;
• reduction of responsibilities;
• denial of promotion;
• discriminatory treatment;
• hostile behaviour;
• exclusion from work;
• malicious performance reviews;
• forced resignation;
• spreading false allegations; or
• any adverse action connected with protected reporting.

Limited Exceptional Circumstances (Approximate 5% Exception): Protective measures under this clause shall not extend to individuals who knowingly make false, fabricated, malicious or bad-faith complaints, intentionally suppress material facts, submit forged evidence, misuse the complaint process for personal vendetta, or otherwise abuse the reporting mechanism. Such conduct shall itself constitute misconduct and may attract disciplinary or legal action.

20. Duty to Report Misconduct

Every employee has a legal, contractual and ethical obligation to promptly report any actual, suspected or attempted violation of this Policy.

Failure to report a serious violation despite having reasonable knowledge, credible information or direct evidence may itself constitute misconduct and may attract disciplinary action.

Employees shall immediately report, without limitation:

• fraud or suspected fraud;
• data privacy incidents;
• cybersecurity incidents;
• workplace violence;
• theft;
• harassment;
• discrimination;
• confidentiality breaches;
• unethical conduct;
• client-related misconduct;
• financial irregularities;
• operational manipulation;
• substance abuse affecting workplace safety;
• retaliation; and
• any activity likely to expose the Company, its employees, clients or stakeholders to legal, financial, operational or reputational risk.

Employees shall report such matters honestly, promptly and in good faith through the designated reporting channels.

21. Reporting Channels

Complaints or reports under this Policy may be submitted through any of the following authorized channels:

• Immediate Reporting Manager;
• Human Resources Department;
• Compliance Officer;
• Information Security Team;
• Internal Ethics Committee;
• Department Head;
• Senior Management;
• Internal Whistleblower Mechanism;
• Authorized Email Address notified by the Company;
• Official Incident Reporting Portal; or
• Any other reporting mechanism notified by the Company from time to time.

Where the complaint concerns the Reporting Manager or any member of Management, the complainant may directly approach Human Resources, the Compliance Officer, Senior Management or any other competent authority designated by the Company.

22. Initial Assessment

Upon receipt of a complaint or incident report, the Company shall conduct a preliminary assessment to determine:

• whether the complaint falls within the scope of this Policy;
• whether immediate intervention is necessary;
• the seriousness of the allegations;
• potential legal or regulatory implications;
• possible risk to employees, clients or Company assets;
• whether digital evidence requires immediate preservation;
• whether law enforcement agencies should be informed; and
• whether interim protective measures are required.

The preliminary assessment shall not be treated as a final finding regarding guilt or innocence.

23. Interim Protective Measures

Pending completion of an investigation, the Company may, wherever considered necessary and proportionate, adopt one or more interim measures, including:

• temporary suspension from duties;
• temporary transfer or reassignment;
• change in reporting structure;
• restriction of workplace access;
• restriction of system access;
• suspension of user credentials;
• confiscation of Company devices for forensic examination;
• preservation of digital evidence;
• restriction on communication with witnesses;
• administrative leave;
• enhanced supervision;
• temporary client disengagement; or
• any other reasonable protective measure necessary to safeguard employees, clients, evidence, systems or business operations.

Such interim measures shall not be construed as disciplinary action or proof of misconduct.

24. Investigation Procedure

Every complaint shall be investigated in a fair, impartial, confidential and time-bound manner.

The Company may constitute an Internal Investigation Committee comprising representatives from Human Resources, Compliance, Information Security, Operations, Legal or any other department considered appropriate.

During the investigation, the Company may:

• interview complainants;
• interview respondents;
• record witness statements;
• obtain written explanations;
• examine electronic devices;
• review CCTV footage;
• review call recordings;
• examine CRM records;
• inspect emails;
• inspect messaging applications used for official work;
• review attendance records;
• inspect system logs;
• conduct digital forensic examination;
• examine financial records;
• obtain client inputs;
• preserve digital evidence;
• seek expert opinions;
• obtain technical reports; and
• undertake any other lawful investigative activity.

Every employee shall cooperate fully with the investigation.

Refusal to cooperate, destruction of evidence, influencing witnesses, intimidation, fabrication of evidence or obstruction of investigation shall constitute independent misconduct.

25. Rights of the Respondent

Subject to applicable law and the seriousness of the allegations, every respondent shall ordinarily be afforded:

• information regarding the allegations;
• reasonable opportunity to submit an explanation;
• opportunity to present supporting evidence;
• opportunity to identify relevant witnesses, where appropriate;
• fair and unbiased consideration of the available material; and
• a decision based on facts, evidence and applicable policy.

Nothing contained herein shall prevent the Company from taking immediate interim action where necessary to protect safety, confidentiality, evidence, client interests or legal compliance.

26. Confidentiality of Proceedings

Every complaint, investigation, witness statement, report, finding and related record shall be treated as strictly confidential.

Employees shall not disclose any information relating to ongoing investigations except:

• where required by law;
• where authorized by the Company;
• before competent judicial or regulatory authorities; or
• where disclosure is necessary for lawful investigation.

Unauthorized disclosure of confidential investigation information shall itself constitute misconduct.

27. Findings and Decision

Upon completion of the investigation, the competent authority shall evaluate:

• documentary evidence;
• oral evidence;
• electronic evidence;
• forensic findings;
• witness credibility;
• seriousness of misconduct;
• intention;
• negligence;
• previous disciplinary history;
• business impact;
• client impact;
• legal implications; and
• any mitigating or aggravating circumstances.

The competent authority may conclude that:

• no misconduct is established;
• minor misconduct is established;
• serious misconduct is established;
• gross misconduct is established; or
• criminal or regulatory action is additionally warranted.

The decision of the Company shall be communicated in accordance with its internal procedures.

28. Disciplinary Actions

Depending upon the nature, gravity, recurrence and impact of the misconduct, the Company may impose one or more of the following disciplinary measures:

• verbal counselling;
• written warning;
• final written warning;
• mandatory training;
• coaching or corrective counselling;
• performance improvement plan;
• withdrawal of privileges;
• suspension;
• transfer;
• change of duties;
• withholding of incentives, bonuses or variable pay, where legally permissible;
• recovery of financial loss, subject to applicable law;
• forfeiture of Company property wrongfully retained;
• demotion, where contractually permissible;
• termination of employment;
• blacklisting from future engagement with the Company, where legally permissible;
• initiation of civil proceedings;
• filing of criminal complaints;
• regulatory reporting;
• client notification where contractually required; and
• any other lawful action deemed appropriate by the Company.

The Company may impose multiple disciplinary measures arising from the same incident where justified by the circumstances.

29. Recovery of Losses

Where an employee's misconduct causes financial loss, reputational damage, contractual liability, regulatory penalty or operational disruption, the Company reserves the right, subject to applicable law, to:

• recover actual losses;
• recover costs of investigation;
• recover costs of digital forensic examination;
• recover client compensation paid due to employee misconduct where legally recoverable;
• adjust recoverable amounts from lawful dues to the extent permitted by law;
• institute civil recovery proceedings; and
• pursue any additional legal remedy available under law.

Such recovery shall be without prejudice to disciplinary or criminal proceedings.

30. False, Malicious or Frivolous Complaints

The Company encourages reporting in good faith. However, any individual who knowingly:

• files a false complaint;
• fabricates allegations;
• suppresses material facts;
• forges evidence;
• manipulates witnesses;
• intentionally misleads investigators; or
• abuses the complaint process for personal vendetta,

shall be liable for disciplinary action under this Policy.

A complaint shall not be considered false merely because it could not ultimately be substantiated, provided it was made honestly and in good faith.

31. Protection Against Retaliation

No employee shall suffer retaliation for:

• reporting misconduct;
• assisting investigations;
• acting as a witness;
• refusing to participate in unlawful conduct; or
• exercising any legal or policy-based right.

Any retaliatory conduct shall itself constitute Gross Misconduct and may result in severe disciplinary action.

32. Records, Documentation and Retention

The Company shall maintain appropriate records relating to:

• complaints;
• investigation reports;
• evidence;
• disciplinary proceedings;
• corrective actions;
• witness statements;
• digital forensic reports;
• management decisions; and
• closure reports.

Such records shall be retained for the period prescribed by applicable law, contractual obligations, client requirements or the Company's Record Retention Policy.

33. Legal and Regulatory Reporting

Nothing contained in this Policy shall restrict the Company from reporting any incident to:

• Police Authorities;
• Cyber Crime Authorities;
• Courts;
• Regulatory Authorities;
• Government Departments;
• Data Protection Authorities;
• Client Organizations;
• Insurance Providers;
• Auditors; or
• any other competent authority,

where such reporting is required under applicable law, contractual obligations or legitimate business interests.

34. Limited Exceptional Circumstances

The Company follows an absolute Zero Tolerance approach. However, in exceptional circumstances constituting a very limited class of cases, the Company may consider mitigating factors solely for determining the nature or extent of disciplinary action, without condoning the misconduct itself.

Such mitigating factors may include, where supported by credible evidence:

• genuine and inadvertent human error without wilful intent;
• voluntary self-reporting before detection;
• immediate corrective action taken by the individual;
• cooperation during the investigation;
• absence of prior disciplinary history;
• demonstrable lack of wrongful gain;
• isolated first-time occurrence of minor misconduct; or
• any other exceptional circumstance considered appropriate by the competent authority.

No exception shall ordinarily be granted in cases involving fraud, corruption, violence, theft, data theft, client confidentiality breaches, deliberate cyber offences, serious harassment, criminal conduct, or any act causing significant harm to the Company, its employees, clients or stakeholders.

35. Responsibilities

Every employee shall:

• comply with this Policy;
• maintain ethical conduct;
• report violations in good faith;
• cooperate in investigations;
• protect Company and client assets;
• safeguard confidential information; and
• promote a respectful, safe and compliant workplace.

Managers and supervisors shall additionally:

• lead by example;
• ensure policy awareness;
• promptly address reported concerns;
• preserve evidence where required;
• refrain from retaliation; and
• support fair implementation of this Policy.

36. Policy Review and Amendment

This Policy may be reviewed, modified, amended, replaced or withdrawn by the Company at any time to reflect changes in applicable laws, regulatory requirements, business operations, client obligations or organizational needs.

Any amendment shall become effective from the date notified by the Company unless otherwise specified.

37. Saving Clause

Nothing contained in this Policy shall:

• restrict the Company's rights under any employment contract, service rules or applicable law;
• prevent the Company from initiating civil, criminal, contractual or regulatory proceedings;
• limit any statutory rights or obligations of employees or the Company;
• prejudice any action available under applicable legislation; or
• prevent the Company from adopting stricter measures where warranted by the facts and circumstances of a particular case.

In the event of any inconsistency between this Policy and any applicable law, the provisions of the applicable law shall prevail to the extent of such inconsistency, and the remaining provisions of this Policy shall continue to remain valid and enforceable.