Privacy and Cookie Notice

01

ArcelorMittal Global Capability Center India Privacy Notice

Also referred to as ArcelorMittal Global Business and Technologies (ArcelorMittal GBT)

Protecting privacy and Personal Data is important to ArcelorMittal Global Capability Center Private Limited ("AMGCC", "we", "our" or "us").

AMGCC applies the ArcelorMittal Group Data Protection Policy, the ArcelorMittal Group Data Protection Procedure and the AMGCC India Data Protection and Privacy Policy. These frameworks support the protection of Personal Data processed within the ArcelorMittal Group.

AMGCC processes Personal Data in accordance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where applicable, Regulation (EU) 2016/679 ("GDPR").

Definitions

“Personal Data” means any data about an individual who is identifiable by or in relation to such data. “Processing” means any operation performed on Personal Data, including its collection, use, storage, disclosure, transfer or deletion.

“Data Principal” means the individual to whom Personal Data relates under the DPDP Act. “Data Fiduciary” means a person who determines the purpose and means of Processing Personal Data under the DPDP Act. Where the GDPR applies, “Data Subject”, “Controller” and “Processor” have the meanings given under the GDPR.

For the purposes of the DPDP Act, AMGCC acts as a Data Fiduciary in relation to the Personal Data processed under this Privacy Notice and determines the purposes and means of such processing. Where AMGCC processes Personal Data on behalf of another ArcelorMittal Group entity or third party, AMGCC may act in a different capacity as required by applicable law and contractual arrangements.

03

How We Use Personal Data

AMGCC collects and uses Personal Data for specific and limited purposes, including:

• responding to enquiries and requests;
• recruitment and employment administration;
• supplier, customer and business-partner management;
• provision of shared services within the ArcelorMittal Group;
• compliance with legal, regulatory and contractual obligations;
• website security, fraud prevention and risk management;
• website analytics and service improvement; and
• establishing, exercising or defending legal claims.

Where required by applicable law, AMGCC will obtain consent before processing Personal Data.

04

Sharing of Personal Data

AMGCC may share Personal Data with:

• ArcelorMittal Group entities;
• service providers acting on AMGCC’s behalf;
• professional advisers;
• customers, suppliers and business partners where necessary; and
• competent public authorities where required or permitted by law.

AMGCC does not sell Personal Data.

05

International Transfers

As part of the operations of the ArcelorMittal Group, Personal Data may be transferred to, accessed from or processed in countries outside the country where it was originally collected.

Where required by applicable law, AMGCC implements appropriate safeguards and lawful transfer mechanisms for such transfers.

06

Data Retention

AMGCC retains Personal Data only for as long as necessary to fulfil the purposes described in this Notice, unless a longer retention period is required or permitted by applicable law.

07

Your Rights

Depending on the law applicable to the processing of your Personal Data, you may have rights relating to:

• access;
• correction or rectification;
• erasure;
• restriction of processing;
• data portability;
• objection to certain processing activities;
• withdrawal of consent where processing is based on consent;
• grievance redressal;
• Right to Nominate another person to exercise your rights in the event of your death or incapacity, where provided under applicable law; and
• other rights available under applicable law.

Where the GDPR applies, individuals may also lodge a complaint with the competent supervisory authority.

08

Exercising Your Rights

To exercise any applicable privacy rights, including requests for access, correction, erasure, withdrawal of consent, nomination, or grievance redressal, you may contact AMGCC using the contact details provided in this Notice.

AMGCC may request reasonable information and documentation to verify your identity before responding to a request. AMGCC will assess and respond to requests in accordance with applicable law.

Where a request is denied, restricted or cannot be fulfilled, AMGCC will communicate the reasons to the extent required by applicable law.

09

Children's Privacy

The AMGCC website and services are not intended for children. AMGCC does not knowingly collect or process Personal Data relating to children through this website.

10

Cookies and Similar Technologies

AMGCC uses cookies and similar technologies to:

• operate and secure the website;
• remember user preferences;
• understand website usage;
• improve website performance; and
• enhance user experience.

Where required by applicable law, non-essential cookies are activated only after the user has provided the necessary consent.

A detailed and current list of cookies used on the website is available in the Cookie Declaration below.

12

Cookie Declaration

This Cookie Declaration provides information about cookies and similar technologies used on the AMGCC website.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function correctly, remember preferences, improve performance and provide analytical information regarding website usage.

How We Use Cookies

14

Managing Cookie Preferences

You may accept, refuse or manage non-essential cookies through the cookie preference tool available on the website.

You may also change your browser settings to block or delete cookies. Please note that disabling certain cookies may affect website functionality and performance.