Data Protection and Confidentiality Statement

1. Our Commitment

Orbis Corporate Solutions Private Limited (“Orbis”, “we”, “us” or “our”) recognises the importance of protecting personal information and confidential business records entrusted to us.

In providing accounting, bookkeeping, taxation, payroll, entity management, financial and other corporate and business advisory services, we may handle sensitive financial, commercial and personal information. We are committed to handling that information responsibly, for authorised purposes and in accordance with applicable requirements and agreed engagement terms.

This Statement describes our approach to data protection and confidentiality. It should be read alongside our Privacy Statement and the terms of the relevant engagement.

2. Scope

This Statement applies to information received or accessed in connection with enquiries, proposals, client engagements and other business relationships.

Depending on the engagement, protected information may include:

• Accounting records, invoices, receipts and financial statements.
• Bank transaction information and other financial records.
• Tax returns, supporting documents and tax correspondence.
• Payroll records and employee information.
• Corporate records and information about directors, shareholders and beneficial owners.
• Customer, supplier and business-partner information.
• Contracts, business plans, transaction documents and commercial arrangements.
• Access credentials and information relating to client systems.
• Other information identified as confidential or reasonably understood to be confidential.

Information does not need to contain personal data to be commercially confidential.

3. Use of Client Information

We use client information for the purposes of assessing, administering and delivering agreed services, following authorised client instructions and meeting applicable legal or professional obligations.

We do not treat access to client information as permission to use it for unrelated purposes.

Where we process personal information on behalf of a client, our responsibilities are governed by the relevant engagement terms, data-processing arrangements, client instructions and applicable law. The client’s and Orbis’s respective roles depend on the particular activity.

Clients should ensure that they have an appropriate basis or authority to provide information to us, including information about employees, customers, suppliers and other individuals.

4. Confidentiality

We treat non-public client information as confidential and restrict its use and disclosure to authorised purposes.

Access is limited to personnel, service providers or professional advisers who require the information for their responsibilities, subject to appropriate confidentiality obligations and applicable engagement arrangements.

Confidential information may be disclosed where:

• The client has authorised or instructed the disclosure.
• Disclosure is necessary to deliver agreed services through an appropriately authorised recipient.
• Disclosure is required by applicable law, a competent authority or a binding legal process.
• Disclosure is permitted under the engagement terms and necessary to establish, exercise or defend legal rights.

Where legally permitted and appropriate, we will inform the client of a legally compelled disclosure and seek to limit the disclosure to what is required.

Confidentiality obligations continue after an engagement ends, subject to applicable law and the relevant contractual terms.

5. Access Controls and Information Handling

We use reasonable technical and organisational measures appropriate to the nature of the information, the engagement and the risks involved.

Our approach includes:

• Restricting access according to assigned responsibilities and business needs.
• Using authorised systems and agreed methods for handling client records.
• Protecting access credentials and avoiding unauthorised credential sharing.
• Following client instructions when accessing client-controlled platforms.
• Reviewing or removing access when it is no longer required.
• Limiting unnecessary duplication and disclosure of client information.

The specific controls applicable to an engagement should be agreed where necessary, particularly when a client has additional security or regulatory requirements.

6. Client Systems and Secure Exchange

Where services are delivered through client-controlled accounting, payroll, document-management or other platforms, we follow the agreed access permissions and processing instructions.

Client records should remain within client-approved systems unless another arrangement is expressly agreed. Full client-record copies should not be downloaded to personal or unapproved devices.

Clients should not send passwords, complete bank credentials, identification documents or sensitive financial records through general website enquiry forms. Where sensitive information is required, an appropriate submission or access method should be agreed with the engagement team.

7. Service Providers and Professional Partners

Some engagements may require technology providers, professional advisers or delivery partners to access relevant information.

Where such access is necessary, we seek to:

• Limit access to information needed for the relevant purpose.
• Establish appropriate confidentiality and data-protection arrangements.
• Follow any applicable client approval or authorisation requirements.
• Clarify responsibilities for handling, retaining and returning information.

Where Orbis acts as a data processor, the use of additional processors is subject to the applicable contractual arrangements and legal requirements.

8. Cross-Border Processing

Orbis is incorporated in India and serves clients across the USA, UK, UAE and India. Certain services may involve information being accessed or processed from India or another country relevant to an agreed engagement or technology service.

International access and processing should be addressed through the relevant engagement terms, client instructions and safeguards required by applicable law.

Keeping records in a client’s cloud platform does not necessarily mean that cross-border processing does not occur. Remote access from another country may also require consideration of international-transfer requirements.

A reference to an overseas market does not, by itself, mean that Orbis is incorporated, licensed or regulated in that jurisdiction.

9. Retention, Return and Deletion

We retain client information for the period necessary to deliver agreed services and meet applicable contractual, legal, regulatory and record-keeping requirements.

At the end of an engagement, the return, continued retention or deletion of information is governed by the relevant engagement terms and applicable requirements.

Where information must be retained, it remains subject to appropriate confidentiality and access restrictions. Where deletion is required, the agreed arrangements should address any relevant backup, archival or legally required records.

10. Security Incidents

If we become aware of a security incident affecting information within our responsibility, we will assess the circumstances and take appropriate steps to contain the incident, reduce further risk and support remediation.

We will notify affected clients and other relevant parties where required by applicable law or the relevant engagement terms, within the applicable time requirements.

Where we process information on behalf of a client, we will cooperate with the client as appropriate so that they can assess the impact and fulfil their own obligations.

Suspected unauthorised access, accidental disclosure or other security concerns should be reported promptly to reachus@orbiscorpsol.com or +91 9023816799. Please do not include passwords or unnecessary sensitive records in the initial report.

11. Client Responsibilities

Effective protection of information also depends on the client’s systems and authorised users.

Clients should:

• Provide information through agreed channels.
• Grant only the access required for the engagement.
• Maintain appropriate security controls within their own systems.
• Inform Orbis of relevant confidentiality, security and data-location requirements.
• Promptly communicate changes to authorised personnel or access permissions.
• Notify Orbis of suspected incidents that may affect the engagement.

These responsibilities do not replace Orbis’s own obligations under applicable law or the engagement terms.

12. Relationship with Engagement Terms

This Statement provides a general description of our approach. It does not replace an engagement letter, confidentiality agreement, data-processing agreement or other contractual arrangement.

Specific requirements—including processing instructions, approved systems, access locations, service providers, retention periods and incident-notification procedures—should be documented in the relevant engagement arrangements.

Nothing in this Statement excludes or limits obligations that cannot lawfully be excluded or limited.

13. Changes to This Statement

We may update this Statement to reflect changes in our practices, services or applicable requirements.

The current version will be published on our website with an updated date. Changes to this website Statement do not, by themselves, amend existing contractual commitments.

14. Contact Us

For questions about data protection, confidentiality or the handling of information entrusted to Orbis, please contact:

• Orbis Corporate Solutions Private Limited
• 308, International Finance Center, Vesu, Surat 395007, India
• Email: reachus@orbiscorpsol.com
• Telephone: +91 9023816799