Privacy Policy

This summary is for convenience. The full policy below is what applies.

• We collect only what we need: the details you send us through this website or by email, the information we must hold about our shareholders, and basic technical logs that keep the website secure.
• We use it to respond to you, to meet our obligations as a company listed on BSE Limited, and to keep our systems secure. We do not sell personal data, and we do not use it for advertising.
• This website does not use advertising, analytics or tracking cookies.
• You can ask to see, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance with us and then with the Data Protection Board of India.
• Write to our Grievance Officer at cs@continentalcontrols.co.in.

This policy is issued by Continental Controls Limited (CIN L66110MH1995PLC086040), a company incorporated under the laws of India with its registered office at Plot No. A 356/357, Road No. 26, Wagle Industrial Estate, MIDC, Thane (West) – 400604, Maharashtra, India ("Continental Controls", "the Company", "we", "us").

For the personal data described in this policy, the Company is the Data Fiduciary under the DPDP Act: we decide why and how that data is processed.

Our group businesses, such as ReadyRetail and ReadyDelivery, operate their own websites and services, which have their own privacy notices. This policy covers only this website and the Company's own processing described below.

This policy applies to personal data we process in digital form, or that we collect offline and later digitise, in connection with:

• this website and the enquiry form on it;
• emails and other correspondence sent to the Company;
• job applications sent to us;
• our shareholders and investors, and investor grievances;
• our business contacts, partners and suppliers.

We process personal data in line with:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, including provisions that come into force in phases;
• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, for as long as they continue to apply;
• the Directions of the Indian Computer Emergency Response Team (CERT-In) dated 28 April 2022 on information security practices and incident reporting;
• the Companies Act, 2013, the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, the SEBI (Prohibition of Insider Trading) Regulations, 2015 and the Depositories Act, 1996, for shareholder and investor records.

This policy does not apply to personal data you make publicly available yourself, or to anonymised data that can no longer identify you.

We do not ask for sensitive personal data such as health, biometric, or financial account information through this website. Please do not send it to us unless we specifically ask for it for a lawful purpose. Shareholders' bank and identity details are handled by our Registrar and the depositories in the course of shareholder services.

Under the DPDP Act we may process personal data only for a lawful purpose, either with your consent or for one of the legitimate uses the Act allows. We do not use personal data for a purpose that is incompatible with the one for which it was collected.

Where we rely on your consent, it must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. We will ask only for the data necessary for the purpose, and you can withdraw your consent at any time (see “Your rights”).

We do not sell personal data, rent it, or use it for profiling, behavioural monitoring or targeted advertising.

This website does not set advertising, analytics or tracking cookies, and does not use third-party tracking pixels or social media plug-ins.

Your browser may store small technical files needed for the website to display and work correctly. These do not identify you and are not used to track you across other websites.

If we introduce analytics or any non-essential cookies in future, we will update this policy and, where the law requires, ask for your consent first.

We share personal data only where it is necessary for the purposes above, and only with:

• Data Processors acting on our instructions under a valid contract — for example, our website hosting provider, email service provider and IT service providers. They may use the data only to provide their services to us and must protect it.
• Our Registrar and Share Transfer Agent, Purva Sharegistry (India) Private Limited (SEBI Registration No. INR000001112), and the depositories (NSDL and CDSL), for shareholder services.
• Stock exchanges, the Securities and Exchange Board of India, the Ministry of Corporate Affairs, tax authorities and other regulators, where a law requires us to file or disclose information.
• Courts, tribunals, law enforcement and government agencies, where we are legally required to, or to protect our rights, our people or the public.
• Our professional advisers, such as auditors and legal counsel, under a duty of confidentiality.
• A successor entity, if the Company is involved in a merger, amalgamation or similar arrangement approved under law.

We do not share personal data with our group businesses for their own marketing. If your enquiry concerns one of them, we will pass it on only so that it can respond to you.

We aim to store and process personal data in India. Some of our service providers may store or process data outside India.

Under section 16 of the DPDP Act, personal data may be transferred outside India except to a country or territory that the Central Government has restricted by notification. We do not transfer personal data to any restricted country or territory, and we require our service providers to protect it to the standard required by Indian law.

Logs of our information and communication technology systems are maintained in line with the CERT-In Directions, which require them to be kept within Indian jurisdiction.

We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. When it is no longer needed, we erase it, and we require our Data Processors to do the same.

We take reasonable security safeguards to prevent personal data breaches, as required by section 8(5) of the DPDP Act, the DPDP Rules, 2025 and the SPDI Rules, 2011. These include:

• encryption of data in transit using HTTPS (TLS) across the website;
• access to personal data limited to people who need it for their role, with appropriate authentication;
• logging and monitoring of access to our systems so that unauthorised access can be detected and investigated;
• secure hosting, regular updates and backups, and measures to keep data available if a system is compromised;
• contracts with Data Processors that require them to apply equivalent safeguards;
• confidentiality obligations for our employees and advisers.

No method of transmission or storage is completely secure. If you believe your interaction with us is no longer secure, please contact us immediately.

If a personal data breach occurs, we will:

• take immediate steps to contain it and reduce its impact;
• inform each affected Data Principal without delay, in clear language — describing the breach, its likely consequences, what we are doing about it, the steps you can take to protect yourself, and who you can contact;
• inform the Data Protection Board of India without delay, and provide a detailed report within 72 hours of becoming aware of the breach, or such longer period as the Board allows;
• report cyber security incidents to CERT-In within six hours of noticing them, as required by the CERT-In Directions.

As a Data Principal under the DPDP Act, you have the right to:

• Access information — obtain a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared (section 11).
• Correction and erasure — have inaccurate or misleading data corrected, incomplete data completed, outdated data updated, and data erased when it is no longer needed, unless we must keep it to comply with law (section 12).
• Withdraw consent — where we rely on your consent, withdraw it at any time, as easily as you gave it. This does not affect processing already carried out, and we will stop processing within a reasonable time (section 6).
• Grievance redressal — have a grievance about our processing handled by us (section 13).
• Nominate — nominate another person to exercise your rights if you die or become incapable of exercising them (section 14).

To exercise any of these rights, write to cs@continentalcontrols.co.in with the subject “Data request”. We may need to verify your identity before acting on a request. We will respond within the time limits set by the DPDP Act and Rules, and in any case within 90 days.

Shareholders: to update your address, bank details, nomination or other KYC information, please follow the process on our Shareholder services page, as these changes are handled by our Registrar and your depository participant under SEBI rules.

Section 15 of the DPDP Act also places duties on Data Principals. When you share personal data with us or exercise your rights, you must comply with applicable law, not impersonate another person, not suppress material information when providing data for an official document, not register a false or frivolous grievance or complaint, and provide only information that is verifiably authentic when asking for correction or erasure.

Breach of these duties can attract a penalty of up to ₹10,000 under the DPDP Act.

This website is not directed at children. Under the DPDP Act, a child is anyone under 18 years of age. We do not knowingly collect personal data from children, and we do not track, behaviourally monitor or target advertising at children.

Where we need to process a child's personal data — for example, a minor who holds shares through a guardian — we will do so only with the verifiable consent of a parent or lawful guardian, as required by section 9 of the DPDP Act and the DPDP Rules, 2025. The same applies to a person with a disability who has a lawful guardian.

If you believe a child has sent us personal data without that consent, please contact us and we will erase it.

If you have a question or a complaint about how we handle personal data, please contact our Grievance Officer, who is also the person able to answer questions about our processing under section 8(9) of the DPDP Act:

We will acknowledge your grievance promptly and aim to resolve it within 30 days, and in any case within the period prescribed under the DPDP Act and Rules.

You must first raise your grievance with us. If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner it prescribes.

We may update this policy to reflect changes in the law, our practices or this website. We will publish the updated policy here with a new “Last updated” date. Where a change materially affects how we use personal data you have already given us, we will tell you directly where we can, and seek fresh consent where the law requires it.

This policy is available in English. You may request it in any language listed in the Eighth Schedule to the Constitution of India by writing to us.