Mahindra & Mahindra Limited having its registered office at Gateway Building, Apollo Bunder, Colaba, Mumbai 400 001, Maharashtra, India (“we” “us” “our” “M&M”) is committed to protecting the privacy and security of your Personal Data. Your privacy is important to us.

On the occasion of the Mahindra Group's 81st Founder’s Day on 2nd October 2026, M&M is launching a campaign titled "My Mahindra Story"/ “#MyMahindraStory” (the “Campaign’). We are collecting memorable stories from across the Mahindra Group. We invite individuals who have directly or indirectly been associated with the Mahindra Group ("you", "your" or "participant") to participate in this Campaign and share your memorable journey with us. You may wish to share your authentic testimony, photographs, audio and/or video recording, documents, memorabilia, or any content reflecting the Mahindra Group's positive impact, products, people, initiatives, or legacy that continues to hold a special place in your memory (“Submission”) with us. Participation in this Campaign is voluntary.

This Privacy Notice (“Notice”) explains how M&M collects and Processes your Personal Data when you participate in the Campaign and share your Submission with us. It also outlines how you can exercise your privacy rights in relation to such Processing.

This Notice is an integral part of the Campaign's Terms and Conditions. Please review both carefully before proceeding. By participating in the Campaign, you are consenting to the Processing of your Personal Data in the manner set forth in this Notice. Wherever Processing of your Personal Data is based on your consent, you may withdraw it at any time in accordance with Section 8 of this Notice.

1. PERSONAL DATA THAT WE COLLECT

“Personal Data” means any data about an individual who is identifiable by or in relation to such data.

“Process” “Processing” “Processed” in relation to Personal Data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

Any Personal Data provided by you will not be considered as private and confidential if it is freely available and / or accessible in the public domain like any comments, messages, blogs, available on social media platforms like LinkedIn, Facebook, X, etc.

We endeavour to collect and Process only such information that is adequate, relevant and limited to what is necessary for the specified purpose of participating in the Campaign. We will collect the following Personal Data from you directly:

• Identity information, such as your first name, last name;
• Contact information, such as your mobile number and email address;
• Submission information, such as your testimony, photographs, audio and/or video recording, documents, memorabilia, or any content voluntarily submitted by you.

If you send us personal correspondence, such as emails, we may collect and store such information, including but not limited to name, email address and phone number.

2. PURPOSE OF COLLECTION OF YOUR PERSONAL DATA

We will Process your Personal Data for the following purposes:

• Subject to your explicit consent, M&M and its Group entities may:
  • use your Submission along with your name, image, likeness, photograph, testimony, audio and/or video recording, documents, memorabilia, or biographical details across Mahindra Group’s internal & external communication platforms including in print advertisements, films, documentaries, digital and social media, corporate websites, press releases, outdoor advertising, internal communications, and corporate presentations.
  • retain, archive, and preserve your Submission for historical archives, corporate heritage, and museum collections.
  • feature your Submission in future branding, promotional campaigns, and Group-wide publications.
• to communicate with you
• to enforce our terms and conditions
• to comply with legal obligations
• to comply with obligations to public authorities
• for legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss prevention or prevention of fraud.
• to meet our internal and external audit requirements and for information security purposes

As otherwise described to you at the time of collection of your Personal Data.

If we wish to Process your Personal Data for purposes other than those mentioned above, we shall take your consent prior to Processing your Personal Data for such additional purposes unless this falls within our legitimate use for Processing your Personal Data as explained in this Notice.

3. BASIS FOR PROCESSING YOUR PERSONAL DATA

We use your Personal Data only if we have a legal basis for doing so. In case, we wish to use your Personal Data for purposes other than certain legitimate uses, we shall seek specific consent from you in a separate process prior to Processing your Personal Data for such additional purpose.

We may also be required to Process your Personal Data for certain legitimate uses, such as:

• To ensure compliance with our legal obligations and to also comply with our obligations towards public authorities;
• To Process your Personal Data voluntarily provided by you for specified purpose of participating in the Campaign in respect of which you have not denied your consent;
• To enforce any legal right or claim;
• For the prevention, detection, or investigation of a crime, loss prevention or prevention of fraud;
• As otherwise described to you at the time of collecting your personal data.

If we Process your Personal Data based on your consent, we will ask for your consent in a separate process. By submitting your Personal Data, you are explicitly consenting to the collection, use, and Processing of your Personal Data for the purpose of participating in the Campaign.

4. SHARING/DISCLOSURE OF PERSONAL DATA

As far as this is necessary for the purposes set out above, we will share your Personal Data with the following recipients who either have a need to know and who will Process it for us based on our instructions and for no other purpose:

External service providers: Occasionally, to support our Campaign, it is necessary to collaborate with external service providers. These external service providers shall Process your Personal Data on our behalf subject to appropriate safeguards only insofar as it is necessary for them to provide their services to us. They are contractually bound to comply fully with the applicable law on data protection. We make sure that such external service providers are capable of safeguarding data. Our prior authorisation is required before they are permitted to transfer responsibility for Processing Personal Data to a third party. We may share your Personal Data with our service partners/third-party entities for the purpose of completing the transaction or establishing the relationship.

We only share your Personal Data with recipients that have an adequate level of data protection by implementing appropriate technical and organizational security measures, or we take measures to ensure that all recipients provide an adequate level of data protection as prescribed by applicable law. We do not sell your Personal Data to anyone.

Courts and authorities: We will share your Personal Data when it is required for the following purposes:

1. To comply with legal obligations and respond to requests from government agencies, including law enforcement agencies and other public authorities.
2. To prevent or detect or investigate offences or cyber incidents or for the prosecution or punishment of offences.
3. To raise or defend against legal claims.
4. To protect our users and systems.

5. ACCURACY OF YOUR PERSONAL DATA

Notwithstanding the obligation on us to put in place all necessary means to maintain the accuracy of your Personal Data, you agree to provide us with accurate Personal Data at all times and you will notify us promptly upon any changes to your Personal Data.

6. HOW DO WE PROTECT YOUR PERSONAL DATA?

We are strongly committed to protecting your Personal Data and privacy online and accordingly, we have implemented technical and organizational security measures in relation to all the data or information including Personal Data that is Processed by us. However, we cannot guarantee the security of any Personal Data that you disclose online having regard to the nature of the internet.

In any event, you accept the inherent security implications of disclosing information over the internet and agree not to hold us responsible for any breach of information security unless we have been negligent or wilfully in default of our obligations under the relevant legislation.

We endeavour to detect and investigate every breach of security by having relevant controls in place which should alert us to a breach of security. Among other things, we ensure that there is restricted access to Personal Data to staff and service providers on a need-to-know basis. We may also use encryption technology from time to time to assist in protecting any information or data which you submit. Access to Personal Data is strictly controlled through role-based mechanisms and limited to authorized personnel on a need-to-know basis. All personnel are bound by confidentiality obligations and receive regular data protection training. Your Personal Data is stored and handled using secure practices, supported by monitoring and enhanced protections. Our safeguards are regularly reviewed and strengthened to address evolving risks and security requirements.

7. SAFEGUARDING THE PRIVACY OF CHILDREN

We do not knowingly collect or solicit Personal Data from minors. Our Campaign is ordinarily intended for individuals who are 18 years of age or older. If, in an exceptional case, an individual below 18 years of age is permitted to provide information, such submission shall be subject to the involvement, consent, or authorisation of a parent or lawful guardian to the extent required under applicable law. If you are under 18, please do not attempt to send any Personal Data about yourself to us.

Further, we do not undertake tracking and behavioural monitoring of children or targeted advertising directed to minors.

If we learn that we have collected Personal Data from a minor without verified parental consent, we will erase such Personal Data.

If you believe that a child under 18 years of age may have provided us their Personal Data, please contact us immediately using the contact details provided below.

8. YOUR RIGHTS IN CONNECTION WITH YOUR PERSONAL DATA

We respect your right to access and control your Personal Data, and we will respond to requests to exercise your rights under applicable laws for information and, where applicable, will correct, amend, or delete your Personal Data.

Please note that applicable law might require that we cannot comply with every request. We will be required to retain your Personal Data due to legitimate business/ regulatory/ statutory retention requirements despite your request for erasure.

You have the following rights:

• Right to access information about your Personal Data: At any point, you can contact us for a summary of your Personal Data we hold about you, the processing activities undertaken with respect to such Personal Data, the identities of all those persons with whom your Personal Data has been shared by us along with a description of the Personal Data so shared, and any other information related to your Personal Data and its Processing.
• Right to request correction: If your Personal Data is incomplete, inaccurate or misleading, or out of date, you can inform us about the same and your Personal Data will be corrected, completed, or updated, as the case may be.
• Right to request erasure: If you believe that we should discontinue the use of your Personal Data, you have the option to request the deletion of your Personal Data, unless retention is necessary for compliance with any law for the time being in force.
• Right of grievance redressal: We are committed to protecting your Personal Data collected by us. However, in case of any act or omission regarding the performance of our obligation in relation to your Personal Data or in the exercise of your rights under applicable law, we encourage you to contact us using the contact details provided in paragraph 10.
• Right to nominate: In the event of death or incapacity to exercise these rights, you can nominate any other individual to exercise such rights.
• Right to withdraw your consent to Process your Personal Data: You can withdraw/revoke your consent at any time, to the Processing of your Personal Data for which consent was sought earlier. You can withdraw your consent easily by contacting us using the contact details given below in paragraph 10. The withdrawal of consent previously granted for the Processing of Personal Data does not affect the lawfulness of the Processing until the withdrawal.

For exercising any of your rights, you can contact us using the contact details provided in paragraph 10. We will need you to furnish proof of your identity before you can exercise these rights. We may not be able to Process any requests made in the event you fail to establish your identity or if we are unable to authenticate your identity.

It is important that the Personal Data we hold about you is accurate and updated, and you agree to provide us accurate Personal Data at all times. Please write to us if the Personal Data given to us changes during the period for which we hold it.

9. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will retain your Personal Data which we have collected for as long as we reasonably consider it necessary for achieving the abovementioned purposes and as is permissible under applicable law. This is determined on a case-to-case basis. We will securely delete your Personal Data whenever you request us to do so and/or after the retention period has ended. However, we may archive and/or retain your Personal Data for as long as there are statutory retention obligations or potential legal claims are not, yet time barred.

10. OUR CONTACT DETAILS

If you have questions or comments regarding this Notice or want to exercise any of your rights or express your grievances regarding the Processing of your Personal Data, please write to us at:

Mahindra & Mahindra Limited
Gateway Building, Apollo Bunder,
Colaba, Mumbai – 400 001,
Maharashtra, India

To exercise your rights or submit a Data Subject Access Request, please use the following link: DSAR LINK

If you are not satisfied with the resolution provided, you may lodge your complaint with the Data Protection Board of India following the procedure prescribed by them.

11. CHANGES TO THIS PRIVACY NOTICE

We reserve the right to update or modify this Notice at our sole discretion at any time. If any material change affects the way we Process your Personal Data, we will provide you with prior notice through email, or other appropriate means, and where required, seek your consent. Any updates will become effective upon being published, unless stated otherwise.

This Notice was last updated as of October 2026.