1. Purpose

Zebrold Private Limited has its operational office in Germany and its registered office in India. Personal data therefore moves between the two, and to vendors in other countries. This policy sets the conditions under which that happens.

2. Principles

• No personal data is transferred unless the transfer is recorded in the processing register (CYD-DP-01) and approved by the data protection lead.
• Only the data that is needed is transferred, and it is encrypted in transit and at rest.
• Access from another country is limited to named roles and is logged.

3. From the European Union to India and other countries

India is not currently covered by a European Commission decision that finds its data protection adequate. A transfer of personal data covered by the General Data Protection Regulation to India or to any other country without such a decision therefore needs an appropriate safeguard. The usual safeguard is the standard contractual clauses approved by the European Commission, signed between the exporter and the importer, together with a written transfer impact assessment and supplementary measures such as strong encryption, pseudonymisation and strict access controls. Explicit consent of the patient may be used only in exceptional cases and not as the routine basis.

4. From India to other countries

The Digital Personal Data Protection Act allows transfer of personal data outside India, except to countries that the Government of India restricts by notification. Sector laws, and any restrictions on particular kinds of data, may be stricter. The legal adviser checks the current list and rules before each new destination is approved.

5. Checklist before a new transfer

6. Vendor register

7. Requests by foreign authorities

If any authority outside the country in which the data is held asks for personal data, nobody discloses it. The request is sent at once to the legal adviser, who decides how to respond lawfully and tells the affected people where the law allows.

8. Access from other countries by staff

• Staff in India may see patient data held in the European Union, and staff in Germany may see data held in India, only where their role requires it and where the transfer has been approved under this policy.
• Access is through the company's secure systems and virtual private network, never by copying data to personal devices or storage.
• Access from a new country, or by a new team, needs the approval of the data protection lead in advance.
• Staff who travel must not access patient data from a country that is not on the approved list.

9. Onward transfers

A vendor that receives personal data may pass it to a sub-processor, or to another country, only with the company's prior written approval and on terms that give the same level of protection. The company keeps the list of approved sub-processors and tells the people who must know of any change.

10. Where data is stored

Primary storage of patient data is in a region that the directors choose after advice. For patients in the European Union, the default is a data centre in the European Union, with access from India under the safeguards above. For patients in India, the default is a data centre in India. Any change is assessed under this policy and recorded in the register of processing.

11. Documentation

For each transfer the data protection lead keeps the record in CYD-DP-01, the signed agreements and clauses, the transfer impact assessment, the approvals and the review dates, and produces them to a regulator on request. The records are reviewed every year, and at once when a law, a court decision or a regulator's guidance changes.

1. Purpose

Zebrold Private Limited has its operational office in Germany and its registered office in India. Personal data therefore moves between the two, and to vendors in other countries. This policy sets the conditions under which that happens.

2. Principles

• No personal data is transferred unless the transfer is recorded in the processing register (CYD-DP-01) and approved by the data protection lead.
• Only the data that is needed is transferred, and it is encrypted in transit and at rest.
• Access from another country is limited to named roles and is logged.

3. From the European Union to India and other countries

India is not currently covered by a European Commission decision that finds its data protection adequate. A transfer of personal data covered by the General Data Protection Regulation to India or to any other country without such a decision therefore needs an appropriate safeguard. The usual safeguard is the standard contractual clauses approved by the European Commission, signed between the exporter and the importer, together with a written transfer impact assessment and supplementary measures such as strong encryption, pseudonymisation and strict access controls. Explicit consent of the patient may be used only in exceptional cases and not as the routine basis.

4. From India to other countries

The Digital Personal Data Protection Act allows transfer of personal data outside India, except to countries that the Government of India restricts by notification. Sector laws, and any restrictions on particular kinds of data, may be stricter. The legal adviser checks the current list and rules before each new destination is approved.

5. Checklist before a new transfer

6. Vendor register

7. Requests by foreign authorities

If any authority outside the country in which the data is held asks for personal data, nobody discloses it. The request is sent at once to the legal adviser, who decides how to respond lawfully and tells the affected people where the law allows.

8. Access from other countries by staff

• Staff in India may see patient data held in the European Union, and staff in Germany may see data held in India, only where their role requires it and where the transfer has been approved under this policy.
• Access is through the company's secure systems and virtual private network, never by copying data to personal devices or storage.
• Access from a new country, or by a new team, needs the approval of the data protection lead in advance.
• Staff who travel must not access patient data from a country that is not on the approved list.

9. Onward transfers

A vendor that receives personal data may pass it to a sub-processor, or to another country, only with the company's prior written approval and on terms that give the same level of protection. The company keeps the list of approved sub-processors and tells the people who must know of any change.

10. Where data is stored

Primary storage of patient data is in a region that the directors choose after advice. For patients in the European Union, the default is a data centre in the European Union, with access from India under the safeguards above. For patients in India, the default is a data centre in India. Any change is assessed under this policy and recorded in the register of processing.

11. Documentation

For each transfer the data protection lead keeps the record in CYD-DP-01, the signed agreements and clauses, the transfer impact assessment, the approvals and the review dates, and produces them to a regulator on request. The records are reviewed every year, and at once when a law, a court decision or a regulator's guidance changes.