1. Introduction

Star India Private Limited (the “Company”) might collect and process personal data about business contacts operating in the media and entertainment sector and in any other sector that is relevant for the promotional activities carried out by the Company (the "Promotional Activities") including personal data about you (the "Business Contact") and/or about the Business Contact's employees and collaborators (hereinafter defined, also together with the Business Contact the " Data Subjects"). This Privacy Policy describes the processing of all personal data of Data Subjects, carried out in connection with the Promotional Activities of the Company (hereinafter the “Data”).

2. Who is the data controller?

The Company, with registered office at Star House, Urmi Estate, 95 Ganpatrao Kadam Marg, Lower Parel, Mumbai 400013, India, is the data controller with regard to the processing of the Data.

3. What kind of Data does the Company process?

During the performance of its Promotional Activities, the Company collects and processes the Data provided by the Business Contact directly, or by third parties operating in the media and entertainment sector or in any other sector connected with the Promotional Activities of the Company, such as press agencies, PR agencies, marketing and communication agencies, event organizers, other Company's customers, etc., as well as Data that are publicly available, such as data of social media or public databases. These Data include Data Subjects' name, surname, email address, telephone number and similar contact data.

4. For what purposes is the Data processed?

The Company processes the Data through manual and electronic means to manage it Promotional Activities and in particular:

a) To fulfill requests of information by Business Contacts regarding the Company products and services and/or to take steps requested by the Business

Contacts prior to entering into a contract;

b) To send to its Business Contacts news and updates, invitation to premieres and events, information on Company products and services and any other information related to the Company business that may be of interest for

Business Contacts within the context of their business activities;

c) To protect and defend the rights of the Company, in particular there may be instances in which the Company may disclose the Data in case the disclosure is necessary to (i) protect, enforce or defend the legal rights, privacy, safety or property of the Company, its employees, agents and contractors, (ii) protect the Company against fraud or (iii) for risk management purposes;

d) To comply with applicable laws and legal procedures and to respond to requests from the relevant government authorities;

e) To complete a corporate transaction, such as a proposed or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of the Company’s business, assets or stock (including in connection with any bankruptcy or similar proceedings). If the Company is involved in a merger or transfer of all or a material part of its business, the Company may transfer the information on the PR Contact and the relevant Data Subject to the party or parties involved in the transaction as part of the transaction.

5. On which legal basis is the Data processed?

The processing of the Data for the purposes of:

• Section 4 (a) is carried out in order to take steps at the request of the Data Subject prior to entering into a contract;

• Section 4 (b) is carried out on the basis of consent, if required, or on the basis of the Company's legitimate interest to perform its Promotional Activities and in particular to send to its Business Contacts the communications referred to in Section 4 (b). The Company's legitimate interest is adequately balanced with the interests of the Data Subjects to receive such type of communications, as they are useful for the performance of their business activities. The Data Subjects can object at any time to the performance of the activity under Section 4 (a) as described in Section 10 of this Privacy Policy [or by mean of the unsubscribe option contained in the communications received from the Company];

• Section 4(c) is necessary for Company's legitimate interest to establish or defense its legal rights. The Data Subjects can object at any time to the performance of such processing activity as described in Section 10 of this Privacy Policy;

• Section 4(d) is necessary in order to comply with applicable laws;

• Section 4(e) is carried out based on the legitimate interest of the Company to perform a Corporate transaction and in some countries also based on applicable laws. Data Subjects can object at any time to the processing based on legitimate interest as described in Section 10 of this Privacy Policy.

6. Who has access to the Data?

Data will be accessed only by those employees duly authorized and instructed for accessing Data by the Company and to the extent necessary for their business need.

The Company might communicate the Data to (a) third party service providers, entrusted with processing activities and, when required by applicable laws, appointed as data processors (e.g., cloud service providers, other entities of the group, providers of services instrumental to the Company’s Promotional Activities, such as, by way of example and without limitation, companies that provide IT services, experts, marketing agencies, event organizers, consultants and lawyers - companies resulting from possible mergers, demergers or other transformations) and (b) competent authorities, when allowed under applicable laws.

7. Is the Data transferred abroad?

The Data may be transferred to countries within and outside the European Economic Area (EEA) and in particular in [India]. The Company will use appropriate and suitable safeguards compliant with applicable data protection laws to protect the Data and the transfer outside the EEA of the Data.

In any case, the Data Subject has the right to obtain a copy of the measures adopted to protect the transfer of the Data outside the EEA by contacting the Company at the address indicated in Section 10 of this Privacy Policy.

8. For how long the Company will keep the Data?

The Company will retain the Data Subjects' Data for the period necessary to fulfill the purposes for which the Data was collected as outlined in this Privacy Policy, in particular, with reference to the processing activities under Section 4 (b) for no more than 2 years after collection, unless the Data Subject express his consent to continue to be involved in the Promotional Activities of the Company.

9. Do the Data Subjects have rights with regard to their Data?

According to GDPR, the EU General Data Protection Regulation 2016/679 that has become effective on the 25 May 2018, the Data Subject with regard to his/her Data has the right, in any given time, to:

a) obtain confirmation as to whether or not his/her Data exists, to receive a copy of it and to be informed of its content, source, as well as of further information, also available in this Privacy Policy, on the purposes of processing of your personal data, the categories its recipients, the existence of any automated decision-making, if any, the envisaged period for which the Company will store it, where possible, as well as the safeguards the Company has adopted for transfers outside the EEA;

b) verify the accuracy of the Data and request its rectification, update or amendment;

c) request the deletion or anonymisation of the data Data where:

a. The Data are processed in breach of the applicable law;

b. The Company no longer need the Data for the purposes for which it has been collected;

c. The Company has a legal obligation to erase it;

d. The Data Subject has objected to the processing justified on legitimate grounds according to point d) below and has no overriding and compelling legitimate grounds to continue such processing;

d) request the Company to limit the processing of the Data Subjects' Data where:

• It challenges the accuracy of the Data until the Company has taken sufficient steps to correct or verify its accuracy;

• The processing is unlawful, but the Data Subject does not want the Company to erase the Data;

• The Company no longer needs the Data for the purposes of the processing, but the Data Subject requires the Data for the establishment, exercise or defense of a legal claim; or

• The Data Subject has objected to the processing justified on legitimate interest grounds pending verification as to whether the Company has compelling legitimate grounds to continue processing.

e) Object to the processing of the Data, when it is based on legitimate interest;

f) Request the erasure of the Data without undue delay;

g) Receive an electronic copy of the Data (“data portability”), when the Data is processed by automatic means and the processing is either (i) based upon Data Subjects’ consent or (ii) necessary for the performance of an agreement with the Company; and

h) Lodge a complaint with the relevant supervisory authority.

10. How can you contact the data controller?

If the Data Subject has questions about this Privacy Policy or wishes to exercise the rights provided in Section 9 above, the Company may be contacted at the following email address: contentsales@startv.com.