Privacy Policy

1. Introduction

This Privacy Policy ("Policy") explains how AMPSTAR, a company incorporated under the Companies Act, 2013, having its registered office at JSW Centre, Bandra Kurla Complex, Bandra (East), Mumbai-400051 (referred to here as "AMPSTAR", "the Company", "we", "us" or "our"), collects and processes your Personal Data when you visit https://ampstar.in/ (the "Website") or otherwise interact with us through it.

The Website is the official website of AMPSTAR. It provides information about the Company, its business and operations, leadership and governance, sustainability and corporate-responsibility initiatives, investor and media information and ways to contact us. It is not a transactional or se-commerce platform.

We are committed to protecting your privacy and handling your Personal Data responsibly and in accordance with Applicable Laws.

For the purposes of the Applicable Law, AMPSTAR is the Data Fiduciary that determines the purpose and means of Processing your Personal Data, and you (the individual whose Personal Data we process) are the Data Principal.

By accessing the Website or sharing your Personal Data with us, you acknowledge that you have read and understood this, Policy. Where we rely on your consent, we will obtain it separately as described in Section 6 of this Policy.

2. Terms and Interpretations

  1. "Applicable Laws" means all applicable data protection and privacy laws, rules, and regulations in force governing the Processing of Personal Data, including, where applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India along with the Digital Personal Data Protection Rules, 2025, as may be amended from time to time.
  2. "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of Processing of Personal Data;
  3. "Data Principal" means the individual to whom the Personal Data relates;
  4. "Personal Data" means any digital information that relates to an identified or identifiable individual, who is identifiable by or in relation to such data;
  5. "Processing" means, in relation to Personal Data, any operation or set of operations performed on such data, whether wholly or partly by automated means, including but not limited to collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, and destruction;
  6. "Third-Party" means any natural or legal person, public authority, agency, or body other than AMPSTAR and the User;
  7. "Services" means the facilities made available through the Website for the purpose of browsing and accessing; and
  8. "User", "you" and "your" means any natural or legal person who accesses or uses the Website as applicable.

3. Scope of this Policy

This Policy applies to Personal Data we collect:

  • through the Website and any associated microsites or pages;
  • through online forms, including general contact, business and partnership enquiry, media and press, investor-relations and grievance hosted on Website;
  • through cookies and similar technologies (see Section 9);
  • when you contact us by email, telephone, post, or social media in relation to the Services provided on the Website;

This Policy does not apply to the independent privacy practices of third parties, including our group companies acting as separate data fiduciaries, recruitment platforms, our registrar and transfer agent, depositories, payment or banking providers, or operators of third-party websites linked from the Website. We encourage you to review their privacy policies separately. This Policy also does not govern any separate consumer or product website operated under any of the Company's brands, which may have its own privacy notice.

4. The Personal Data We Collect

We may Process the Personal Data collected for the following purposes, as permitted under Applicable Law:

  • to operate, maintain, secure, and improve the Website;
  • to conduct analytics and understand how the Website is used;
  • to detect, prevent, and address fraud, security incidents, and misuse of the Website;
  • to comply with Applicable Laws, regulatory requirements, corporate-governance and disclosure obligations, and legal process; and
  • to establish, exercise, or defend legal claims.

5. Effects of Not Providing Personal Data

We collect Personal Data only to the extent necessary to fulfil the purposes outlined in this Policy, provide you with the Services, and comply with our obligations under Applicable Laws. Failure to provide certain Personal Data may result in certain features of the Website or the Services being restricted, unavailable, or otherwise unusable. You may manage cookies and tracking technologies through your browser or cookie-preference settings; however, disabling such features may impact the functionality of the Website.

6. How We Collect Personal Data

We collect Personal Data:

  • directly from you, when you visit the Website and complete a form, submit an enquiry or grievance, subscribe to updates, or otherwise contact us;
  • automatically, through cookies and similar technologies when you use the Website (see Section 9).

7. Consent, and Lawful Basis

Consent under the DPDP Law. Where we rely on consent, that consent will be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and limited to the Personal Data necessary for the specified purpose. We do not use pre-ticked boxes or deceptive design ("dark patterns"). You may withdraw your consent at any time by contacting us using the details set out in Section 16 of this Policy; however, such withdrawal does not affect the lawfulness of Processing carried out before the withdrawal.

Legitimate uses. In limited circumstances permitted by the DPDP Law, we may process Personal Data for certain legitimate uses without separate consent — for example, where you voluntarily provide data for a specified purpose, to comply with law, or to respond to a medical or other emergency.

8. Sharing and Disclosure of Personal Data

We do not sell your Personal Data. We do not disclose or make available Personal Data to any Third-Party in any form whatsoever, unless we have obtained the necessary consent from the relevant Data Principal or are required to do so under Applicable Laws. We retain control of and responsibility for the use of any Personal Data disclosed to a Third-Party. We share Personal Data only as described below:

  • Group companies within the JSW Group, including JSW Steel Ltd, JSW Eco Mobility Pvt Ltd, and JSW Motors Limited, where necessary for the purposes set out in this Policy and subject to appropriate safeguards.
  • Service providers and data processors: Save for analytics and cookie service providers whose technologies may be deployed on the Website (see Section 9), as of the date of this Policy, we do not engage any third-party service providers or data processors for the Processing of Personal Data collected through the Website. In the event that we engage any data processors in the future, we shall require them by contract to implement reasonable security safeguards in accordance with the DPDP Law and to process Personal Data only as instructed by us.
  • Registrar and transfer agent, depositories, banks, and financial institutions, in connection with investor, shareholder, supplier, or payment matters, where relevant.
  • Professional advisers, auditors, and regulators, and to courts, law-enforcement, stock exchanges, or government authorities, where required or permitted by law or to meet corporate-governance and disclosure obligations.
  • In connection with a corporate transaction, such as a merger, acquisition, restructuring, or financing, subject to appropriate confidentiality and legal safeguards.
  • Legal and Regulatory Requirements: Where such disclosure is required or permitted by law, regulation, legal process, or governmental request; or where it is necessary to protect our rights, property, or safety, or that of the Users, employees, or the public.

9. Cross-Border Transfers of Personal Data

We are based in India and process all Personal Data within India. We do not transfer or process Personal Data outside India. In the event that any such transfer becomes necessary in the future, we shall do so in accordance with the Applicable Laws including any restrictions notified by the Central Government on transfers to specified countries or territories, and this Policy shall be updated accordingly.

10. Cookies and Similar Technologies

The Website uses cookies and similar technologies to make the site work, to remember your preferences, to measure traffic and performance, and — with your consent where required — for analytics.

Where required by law, we will request your consent through a cookie banner before setting non- essential cookies, and you can manage your preferences from your browser settings. Disabling certain cookies may affect how the Website functions. For more detail, please see our Cookie Policy.

11. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected including to satisfy any legal, regulatory, accounting, corporate-governance, tax, or reporting requirements, or to establish, exercise, or defend legal claims. When Personal Data is no longer required, and where there is no legal basis to retain it — for example, where you withdraw consent or the purpose has been served — we will erase it or anonymise it in accordance with the DPDP Law and our internal retention schedule.

12. Your Rights as a Data Principal

Subject to Applicable Law, you have the following rights in respect of your Personal Data:

  • Right to access: You have the right to obtain a summary of the Personal Data we Process about you and the Processing activities undertaken with respect to such Personal Data.
  • Right to correction: You have the right to request the correction, completion, or updating of any inaccurate, incomplete, or outdated Personal Data that we hold about you.
  • Right to erasure: You have the right to request erasure of your Personal Data where it is no longer required for the purpose for which it was collected, unless retention is required by law.
  • Right to withdraw consent: You have the right to withdraw your consent at any time, where Processing is based on consent.
  • Right to grievance redressal: You have the right to seek redressal of any grievance through the contact details provided in Section 16.
  • Right to nominate: You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.
  • Right to complaint: You have the right to make a complaint to the Data Protection Board of India ("DPBI"), in such manner as may be prescribed, after exhausting the grievance redressal mechanism provided herein.

How to exercise your rights. You may submit a request using the contact details in Section 16. We may need to verify your identity before acting on a request. We will respond within the timelines required by Applicable Law.

13. Children's Personal Data

The Website is not intended for use by or for the collection of Personal Data from, individuals who are considered children or minors Applicable Laws (each, a "Child" and collectively, "Children").We do not knowingly process the Personal Data of children without verifiable consent of a parent or lawful guardian obtained in accordance with Applicable Laws. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe we have collected a child's Personal Data without appropriate consent, please contact us using the details in Section 16 so that we can take appropriate action to remove such Data from our records.

14. Security Safeguards

We implement reasonable technical and organisational security safeguards in accordance with Applicable Laws designed to protect Personal Data against unauthorised or unlawful access, use, alteration, disclosure, loss, or destruction. These measures may include encryption of Personal Data in storage and in transit, access controls limiting access to authorised personnel, logging and monitoring, incident-response procedures, and contractual safeguards with our data processors. While we strive to protect your Personal Data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a Personal Data breach, we will notify the DPBI and affected Data Principals in the manner and within the timelines required by the Applicable Laws.

15. Third-Party Links

The Website may contain links to third-party websites, applications, or services that we do not control, including group-company websites, brand or product websites, social-media platforms, recruitment portals, and the websites of our registrar and transfer agent or regulators. Such third-party websites are not operated, controlled, or endorsed by AMPSTAR, and we make no representations or warranties regarding their accuracy, completeness, or reliability. This Policy does not apply to those third parties. We do not share any Personal Data with such third-party websites unless we have obtained the necessary consent from the relevant Data Principal or are required to do so under Applicable Laws. Any Personal Data provided by you directly to such third-party websites shall be governed by the respective privacy policies of those Third Parties, and we shall not be responsible or liable for their content, privacy practices, or terms of use, or for any issues arising from your interactions with such third-party websites. We strongly encourage you to review the privacy policies and terms of use of each third-party website before sharing any Personal Data or engaging with such sites.

16. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last Updated" date at the top indicates when it was last revised. Material changes will be notified through the Website or by other appropriate means prior to the change becoming effective. Your continued use of the Website after changes take effect constitutes acknowledgement of the updated Policy.