Privacy Policy

SunKey Asset Management Services Pvt. Ltd. ("SunKey", "we", "us", or "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy describes how we collect, use, process, disclose, and safeguard personal information obtained through our website (www.sun-key.com) and our communications with you.

This policy complies with applicable data protection laws, including India’s Digital Personal Data Protection Act, 2023 (DPDPA 2023) and the Information Technology Act, 2000 (and applicable rules thereunder), as well as the data protection frameworks of the jurisdictions in West Asia where we operate: the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Kingdom of Saudi Arabia Personal Data Protection Law (Royal Decree No. M/19, as amended), and the Kingdom of Bahrain Personal Data Protection Law (Law No. 30 of 2018).

1. Information We Collect

We collect personal information directly from you when you interact with our website, request a consultation, submit an inquiry, or apply for a position. This includes:

• Business & Contact Information: Name, professional email address, telephone number, company or organisation name, job title, and country of residence.
• Commercial & Asset Inquiries: High-level project specifications, asset capacity, technology type, and portfolio management requirements provided during business consultations.
• Recruitment & Candidate Data: Curriculum vitae (CV) or résumé, cover letters, educational background, employment history, certifications, references, and any supplementary information submitted via our Careers application form or direct email to our recruitment team.
• Correspondence: Records of communications, questions, or feedback you transmit to us via website forms, email, or telephone.
• Technical & Log Information: Standard server logs, IP address, browser type, operating system, pages viewed, and date/time stamps collected automatically to maintain website stability and security.

2. How We Use Your Information

We process personal data only for legitimate business and operational purposes, including:

• Responding to your inquiries and providing information regarding our asset management, O&M, advisory, and technology services.
• Preparing proposals, service scopes, and commercial consultations requested by asset owners, IPPs, lenders, and investors.
• Evaluating job applications, assessing candidate qualifications, scheduling interviews, and managing recruitment operations.
• Operating, maintaining, troubleshooting, and improving the functionality and performance of our website.
• Protecting our website, IT infrastructure, and users against fraudulent activity, unauthorised access, and cyber threats.
• Fulfilling legal, statutory, and regulatory obligations under applicable Indian and international laws.

3. Recruitment & Job Applicant Data

When you submit an application or CV through our Careers page or via hr@sun-key.com, your personal information is processed exclusively for recruitment purposes. We evaluate your suitability for current and anticipated job openings, verify credentials where appropriate, and communicate recruitment progress.

Applicant data is retained for up to twelve (12) months following the completion of a recruitment cycle to consider candidates for future opportunities, after which it is securely deleted or anonymised unless you request earlier deletion or a longer retention period is mandated by law.

4. Third-Party Service Providers & Data Processors

We do not sell, rent, or trade your personal data. We engage vetted third-party service providers ("Data Processors") who assist in our business operations under strict contractual confidentiality and data security terms:

• greytHR (Greytip Software Pvt. Ltd.): Cloud-based human resource management and applicant tracking platform utilised to receive, manage, and process recruitment workflows and candidate submissions.
• Google Workspace (Google LLC): Enterprise email, document management, and communication infrastructure utilised for internal correspondence and client communication.
• Google Maps (Google LLC): Optional interactive mapping service on our Contact page, loaded strictly after you provide explicit cookie consent.
• Infrastructure & SMTP Providers: Secure web hosting environments and mail transfer agents utilised to host website files and deliver inquiry notifications.

5. Data Security

We take appropriate technical and organisational measures to safeguard personal data against unauthorised access, alteration, disclosure, accidental loss, or destruction. These measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your browser and our website.
• Role-based access controls ensuring personal data is accessible only by authorized employees and contractors on a need-to-know basis.
• Strict administrative credentials and authentication standards for internal business tools and email servers.
• Routine vulnerability assessments, firewall protection, and system patch management on our hosting servers.
• Contractual confidentiality obligations binding all personnel and vendors who handle personal data.

While we implement rigorous security practices, transmission over the Internet cannot be guaranteed as completely invulnerable. Users transmit information to our website at their own risk.

6. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, dispute-resolution, or statutory reporting requirements. General website inquiries are retained for up to two (2) years following the conclusion of correspondence unless converted into an active client engagement governed by a separate contract.

7. Cross-Border Data Transfers

SunKey is headquartered in India with regional operations in the United Arab Emirates and broader West Asia (including Saudi Arabia and Bahrain). Personal data collected through our website may be transferred, stored, and processed in India, the UAE, or other jurisdictions where our cloud service providers maintain infrastructure.

Where personal data is transferred across international borders, we ensure that adequate safeguards are implemented in accordance with Chapter III of India's DPDPA 2023, Article 22 of the UAE PDPL, Article 29 of the Saudi Arabia PDPL, and Chapter 4 of the Bahrain PDPL.

8. Your Legal Rights

Depending on your jurisdiction and applicable data protection legislation (including DPDPA 2023, UAE PDPL, Saudi Arabia PDPL, and Bahrain PDPL), you possess the following rights regarding your personal information:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Erasure: You may request the rectification of inaccurate data or the deletion of personal information no longer necessary for its original purpose.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Grievance Redressal: You may raise complaints or concerns regarding our data processing practices with our designated Grievance Officer.
• Right to Nominate: Under India’s DPDPA 2023, you have the right to nominate an individual who will exercise your rights in the event of death or incapacity.

To exercise any of these rights, please write to our Grievance Officer at privacy@sun-key.com.