HMD Privacy Portal

DPDP Act Supplement

Effective June 17, 2026

HMD Global Oy and its Indian subsidiary, HMD Mobile India Pvt Ltd (“HMD”, “we”, “us”) comply with the Digital Personal Data Protection Act, 2023 (the “DPDPA”). This statement supplements HMD Global Privacy Policy for products and services and applies only to individuals residing in India from whom we collect personal data as defined in the DPDPA (“data principals”). It stipulates how HMD processes personal data as a data fiduciary as defined in the DPDPA in India.

Purposes of processing your personal data

Information regarding the categories of personal data we process, the purposes for the processing of each category of personal data, and how we share your personal data are described in detail in HMD Global Privacy Policy for products and services and its supplements. The applicable legal grounds for processing are described in the HMD Global Privacy Policy for products and services and its supplements using the European Union’s General Data Protection Regulation (the “GDPR”) terminology. The applicable legal grounds under the DPDPA are:

· “Your consent” means we have obtained your free, specific, informed, unconditional and unambiguous consent with a clear affirmative action in accordance with the DPDPA.

· “Legitimate use” means we are processing your data for one of the following purposes:

o for the specified purpose for which you have voluntarily provided your personal data to HMD, and in respect of which you have not indicated to us that you do not consent to the use of your personal data;

o for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State of India or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force;

o for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India;

o for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.

Where the HMD Global Privacy Policy refers to legal grounds under the GDPR, these should be interpreted for India as follows:

· Processing based on ‘consent’ under the GDPR corresponds to ‘consent’ under the DPDPA.

· Processing based on ‘legal obligation’, ‘contract’, or certain ‘legitimate interests’ corresponds to ‘legitimate uses’ under the DPDPA, where applicable.

HMD ensures that each processing activity concerning individuals in India is supported by a valid legal basis under the DPDPA.

Grievance Officer and contact details

Our Grievance Officer in India, as per the DPDPA, is Varun Menon.

For any questions about the processing of your personal data, you may contact us through: · Email: [email protected]

· Mail: HMD Mobile India Private Limited, 607, 6th Floor, Ansal Chamber - II, 6, Bhikaji Cama Place, New Delhi – 110066

Right to withdraw your consent

When the legal ground for processing your personal data is based on your consent, you have the right to withdraw your consent. The withdrawal does not affect the validity of the processing activities conducted prior the withdrawal.

The applicable method of withdrawal, such as using the unsubscribe link at the bottom of the newsletter or opting out from your device’s settings, has been described in the applicable supplement.

Right to access

When the legal ground for processing your personal data is based on your consent, you have the right to receive a summary of your personal data and processing activities undertaken with respect to the data, identities of all other data fiduciaries and data processors with whom your personal data has been shared with along with description of the shared data. Please contact us for requests concerning your data.

Right to correction and erasure

You have the right to access data we have about you and copy your data in computer-readable format on your device to be transferred to other systems. You have the right to correct, complete, or update your personal data. You may also request the erasure of your data if we don’t have compelling reasons to process it. Please contact us for requests concerning your data.

Right of grievance redressal

You have the right to have readily available means of grievance redressal provided by HMD in respect of any act or omission of HMD regarding the performance of HMD’s obligations in relation to your personal data or the exercise of your rights under the provisions of the DPDPA and the rules made thereunder. HMD will respond to grievances in 1 month from the receipt of the grievance.

Right to nominate

HMD allows any individual you nominate to exercise your rights as a data principal on your behalf in the event of your passing or incapacity. The nominated person may exercise the rights through contacting us through the contact details provided above. In such cases, we may request the nominated person to provide sufficient evidence of their status to exercise the rights.

Children’s personal data

In India, we define a child as an individual under the age of 18. HMD processes children’s personal data only after obtaining verifiable consent from the child’s parent or lawful guardian, in accordance with the DPDPA and applicable rules.

HMD does not undertake tracking or behavioural monitoring of children, nor does it carry out targeted advertising directed at children.

HMD applies appropriate technical and organisational measures to ensure that processing of children’s personal data is undertaken in a manner that does not cause harm to the child. HMD will treat children's personal data in accordance with its Privacy Policy. HMD also treats children's personal data as sensitive personal data and complies with the rules specific to sensitive personal data under the DPDPA.