1. Introduction & Applicability

India Talent Hub Pvt. Ltd. (CIN: U74999KA2010PTCxxxxxx), registered in Bengaluru, Karnataka, India ("India Talent Hub", "we", "us", "our") is committed to protecting and respecting your privacy. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us in compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDPA) and rules notified thereunder;
• The Information Technology Act, 2000 (IT Act) and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• Applicable provisions of the Employment Exchanges (Compulsory Notification of Vacancies) Act, 1959; and
• Any other applicable state, central, or international law (e.g. GDPR for EU data subjects).

By using our website, submitting your resume, completing a job-posting form, or otherwise engaging with our services, you confirm that you have read and understood this Privacy Policy.

2. Personal Data We Collect

Depending on the nature of your interaction with us, we collect the following categories of data:

2.1 Candidate / Job Seeker Data

• Name, contact details (email, phone, WhatsApp, address, location PIN code), photograph
• Resume / CV, employment history, educational qualifications, professional certifications
• Salary history, current CTC, expected CTC, notice period
• Skill assessments, interview scores, and feedback shared with clients
• Government-issued identifiers (PAN, Aadhaar last-4-digits, passport number for international roles)
• Disability status, veteran status (where voluntarily disclosed)
• Any other information contained in uploaded documents or forms

2.2 Employer / Client Data

• Company name, CIN / GSTIN, registered office address
• Authorised signatory name, designation, email, phone
• Billing details, KYC documents for empanelment
• Job descriptions, role requirements, hiring preferences
• Feedback on candidates submitted

2.3 Website Visitor Data

• IP address, device type, browser type, OS, referring website
• Pages visited, duration of visit, actions performed
• Information submitted via contact forms, newsletter signups, survey responses

3. How We Use Your Data

We use the personal data we collect for the following lawful purposes:

Legal bases (DPDPA): Processing is based on your consent (where required), the performance of a contract to which you are a party, compliance with a legal obligation, protection of vital interests, or our legitimate business interests (e.g. improving our service quality and detecting fraud).

4. Sharing & Disclosure

We may share your data in the following circumstances:

• With clients / prospective employers: When shortlisting you for a specific job opening — we share only relevant profile information after confirming your explicit interest.
• Statutory authorities: EPFO, ESIC, Income Tax authorities, Labour Department — to the extent required for payroll/compliance.
• Service providers: Background verification agencies (post-consent), cloud hosting providers (AWS/GCP), email delivery services, payment gateways, ATS partners, and auditors.
• Business transfers: In the event of merger, acquisition, or restructuring, to the successor entity with equivalent privacy commitments.
• Court / law enforcement: When required by a valid legal order, summon, or government notice.

5. Your Data Rights (as a Data Principal)

Under the Digital Personal Data Protection Act, 2023, and other applicable laws, you have the following rights with respect to your personal data:

To exercise any of these rights, email our Data Protection Officer at privacy@indiatalenthub.com quoting your registered email/mobile. We respond to verifiable requests within 30 days.

6. Data Retention

We retain your personal data for no longer than is necessary to fulfil the purposes for which it was collected, or for our legal/regulatory obligations. Our standard retention policy:

• Candidate records: Up to 5 years from last interaction, unless longer retention is required for active engagements.
• Client engagement records: Up to 7 years after contract expiry (for tax, audit and dispute resolution).
• Payroll & compliance records: As mandated by the EPF Act (7 years), ESI Act (5 years), Income Tax Act (8 years), Shops & Establishments Acts.
• Marketing preferences: Until you opt out.

7. Security Measures

We implement appropriate technical, organisational, and physical security measures as required under Rule 5 of the SPDI Rules, 2011 and DPDPA-2023, including:

• AES-256 encryption for data at rest and TLS 1.3 for data in transit.
• Role-based access control (RBAC) with MFA on all internal systems.
• ISO 27001-aligned information security management system.
• Quarterly vulnerability assessments and annual penetration testing.
• Confidentiality / non-disclosure obligations on all employees and data processors.
• Incident response plan with mandatory Data Protection Board (DPB) notification within 72 hours of a breach likely to cause harm.

8. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to improve your experience, analyse site traffic, and deliver personalised communications. We use the following categories:

• Necessary cookies: Required for core functionality (e.g. session IDs, form CSRF tokens). Cannot be switched off.
• Analytics cookies (Google Analytics 4, Plausible): Help us understand which pages are visited, where traffic comes from. Data is anonymised where possible.
• Functional/Preference cookies: Remember your settings (e.g. language, region) and persist cookie consent preferences.
• Marketing pixels (Meta, LinkedIn, Google Ads): Only set after receiving your explicit consent via our cookie banner. Used for retargeting and conversion measurement.

You can manage cookie preferences at any time by clicking "Cookie Settings" in the footer, or via your browser settings. Blocking cookies may impair some functionality.

9. International Transfers

Where our clients or service providers are based outside India, we may transfer your personal data across borders only when permitted under Chapter V of the DPDPA-2023 and any official notifications issued by the Central Government thereunder. For transfers to countries notified as "white list" jurisdictions, transfers are permitted by default. For all others, we use Standard Contractual Clauses (SCCs), Binding Corporate Rules, or equivalent adequacy safeguards approved by the DPB.

10. Children's Privacy

Our services are directed exclusively to individuals who are at least 18 years of age (or the age of majority in their jurisdiction). We do not knowingly collect, store, or process personal data of children under the age of 18. If you believe we have inadvertently collected data from a minor, please contact privacy@indiatalenthub.com and we will delete it without delay.

11. Policy Updates

We may revise this Privacy Policy from time to time to reflect changes in law, our processing activities, or business practices. The "Last updated" date at the top of this page indicates when this policy was last materially changed. Any significant changes will be communicated via a prominent banner on the Platform or by email to registered users before they take effect.

12. How to Contact Us

For grievances under DPDPA Section 15: Write to the DPO with the subject line "DPDPA Grievance: [Your Full Name]". We acknowledge within 72 hours and dispose of the grievance within 30 days. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India (DPB) via www.dpb.gov.in.