Privacy Policy

01Introduction and scope

1.1 Recruit360 Technologies Private Limited (CIN U58202KA2026PTC230025), with its registered office at Innov8, Prestige Tech Platina, 11th Floor, No. 32/2 & 34/1, Kadabisanahalli, Bengaluru, Karnataka 560087, India (“Recruit360.AI”, “we”, “us”, “our”), is committed to protecting personal data and respecting privacy. This Privacy Policy explains how we collect, use, disclose, transfer, retain and protect personal data, and the rights available to individuals.

1.2 This Policy applies to: (a) our website at https://www.recruit360.ai and any sub-domains; (b) the Recruit360.AI recruitment management platform and related applications, APIs and services — including our mobile Call App, which recruiters use to call Candidates directly from the app, with call details and, where call recording is enabled on the device, call recordings synced to the Platform (together, the “Platform”); and (c) our sales, marketing, support and business operations. It does not apply to third-party websites or services we do not control.

1.3 This Policy is designed to align with the Digital Personal Data Protection Act, 2023 of India (the “DPDP Act”) and the rules made under it, the Information Technology Act, 2000 and applicable rules, and, where applicable, the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where a specific law grants greater rights, that law prevails for the individuals it protects.

1.4 This Policy forms part of, and should be read with, our Terms of Service, Cookie Policy, Data Processing Agreement, Acceptable Use Policy and (for candidates) the Candidate / Applicant Privacy Notice.

02Definitions

For this Policy: “personal data” means any data about an individual who is identifiable by or in relation to such data; “processing” means any operation on personal data (collection, storage, use, disclosure, erasure, etc.); “Data Principal / Data Subject” means the individual to whom personal data relates; “Data Fiduciary / Controller” means the person

who determines the purpose and means of processing; “Data Processor / Processor” means a person who processes personal data on behalf of a Data Fiduciary; “Customer” means a business that subscribes to the Platform; “Candidate” means an individual whose data is processed through the Platform in connection with a Customer’s recruitment; “sub-processor” means a third party we engage to process personal data. Other capitalised terms have the meanings given in our Terms of Service. In addition, for this Policy: “Client” means an organisation of a Customer, managed by that Customer within the Platform’s client-management module, to which recruitment requirements are mapped; “Vendor” means an organisation a Customer onboards to assist with its recruitment.

Clients and Vendors. A Customer may record, within the Platform, the organisation details, points of contact and designations of its Clients and Vendors. Clients do not have access to the Platform; their information is maintained by the Customer to manage client relationships and to create recruitment requirements beneath them. Vendor organisations a Customer onboards may be given user logins to support the Customer’s recruitment activities. We process the personal data of Client and Vendor contacts and users as a Processor, on the Customer’s documented instructions.

02Our two roles: Controller and Processor

3.1 We process personal data in two distinct capacities, and this Policy covers both:

3.2 As a Data Fiduciary / Controller. For personal data we collect about our website visitors, account administrators, Authorised Users, prospects and business contacts (for example, name, work email, company, billing details and usage data), we decide why and how that data is processed, and this Policy governs it.

3.3 As a Data Processor. For the Candidate personal data that a Customer uploads to, or generates through, the Platform (for example, resumes, contact details and AI-generated scores), the Customer is the Data Fiduciary / Controller — it decides why and how that data is processed. We act as a Processor, processing such data only on the Customer’s documented instructions, as set out in our Data Processing Agreement. If you are a Candidate, please read the Candidate / Applicant Privacy Notice and direct requests about a specific application to the Customer (the prospective employer or agency); we will support the Customer in responding.

03The personal data we collect

4.1 Data you provide to us.

4.2 Data we collect automatically. When you use the Platform or website, we collect: log and usage data (pages/features used, actions, timestamps), device and connection data (IP address, browser type, operating system, device identifiers), and data collected via cookies and similar technologies (see the Cookie Policy).

4.3 Candidate data we process on a Customer’s behalf (as Processor). Resumes/CVs and their contents (identity, contact details, work and education history, skills), application and stage history, assessment, interview and communication data, call details and logs from the Call App — including, where call recording is enabled on the recruiter’s device, the call recording uploaded to the Platform — and data the Platform generates such as match scores and rankings. We process this only on the Customer’s instructions.

4.4 Data from third parties. We may receive data from: our Customers (who provide Authorised User and Candidate data); payment processors (transaction confirmations); analytics and security providers; and, where you choose, single-sign-on or integration providers. We may also receive business-contact data from lawful B2B sources for marketing, subject to your right to object.

4.5 Sensitive personal data. We do not seek sensitive or special-category personal data in the ordinary course. Customers are instructed not to upload sensitive personal data (such as data revealing health, religion, caste, or similar) beyond what is necessary and lawful for recruitment, and not to use such data to make discriminatory decisions. Where any such data is processed, we handle it with additional safeguards and only as permitted by Applicable Law.

05How and why we use personal data (purposes and lawful bases)

5.1 We use personal data for the purposes below. Where the DPDP Act applies, we rely on your consent or on a legitimate use permitted by the Act; where the GDPR applies, we rely on the lawful basis indicated.

5.2 If we intend to use personal data for a new purpose incompatible with the above, we will update this Policy and, where required, obtain your consent.

06Artificial intelligence, automated processing and profiling

6.1 The Platform uses artificial intelligence and machine learning to parse resumes, and to match, score, rank and shortlist Candidates against a role, and to assist with first-round interviews and candidate communications. To extract and structure information from Candidate resumes, we use large language models (LLMs), which may include third-party and/or our in-house LLM models; where a third-party LLM is used, that provider acts as a sub-processor under appropriate contractual and security safeguards.

6.2 Human-in-the-loop. AI outputs are recommendations and estimates to support recruiters; they are not automated decisions. A human within the Customer’s organisation reviews results and makes all hiring, shortlisting, rejection and assessment decisions. We do not, on our own account, make decisions about Candidates based solely on automated processing that produce legal or similarly significant effects.

6.3 Candidate rights regarding automated processing. Where the GDPR or DPDP Act applies, Candidates have rights in relation to automated processing and profiling, including the right to request meaningful human review of, and to contest, a decision that significantly affects them, and to a meaningful explanation. Because the Customer is the Controller of Candidate data, such requests should be directed to the Customer; we will assist the Customer in responding.

6.4 Fairness and accuracy. We take reasonable steps to test and monitor our models for quality and to mitigate unfair bias, and we provide features that surface the basis for a recommendation. AI outputs may nonetheless be inaccurate or incomplete; they must not be relied on as the sole basis for any decision

07Cookies and similar technologies

7.1We use cookies, SDKs, pixels and similar technologies to operate the website, remember preferences, provide security, and measure and improve usage. Non-essential cookies are used only with consent. Full details, categories and controls are in our Cookie Policy.

08How we share and disclose personal data

8.1 We do not sell personal data. We disclose personal data only as follows:

• Sub-processors: service providers who host and support the Platform, under contracts requiring appropriate security and confidentiality and permitting processing only on our instructions. A current list of sub-processors is available at [link].
• Customers: we make available to each Customer the data relating to its own account and Candidates.
• Our group / affiliates: where relevant, for the purposes in this Policy, under appropriate safeguards.
• Professional advisers and auditors: lawyers, accountants, insurers and auditors, bound by confidentiality.
• Authorities and legal process: where required to comply with law, legal process, or a lawful request, or to protect rights, safety and property.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy and Applicable Law.
• With your consent or at your direction: for any other disclosure you request or agree to.

09International data transfers

9.1 We primarily store and process personal data in India (for example, cloud infrastructure in the AWS Asia-Pacific / Mumbai region). Some sub-processors may process data in other countries.

9.2 Where we transfer personal data across borders, we implement appropriate safeguards. In particular, because India is not currently the subject of an EU “adequacy” decision, transfers of personal data of individuals in the EU/EEA or the UK to India or other third countries are made under appropriate transfer mechanisms such as the Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum, where applicable), together with any supplementary measures identified by a transfer-risk assessment.

9.3 Cross-border transfers of personal data governed by the DPDP Act are made in accordance with that Act and any restrictions notified by the Central Government.

10Data retention

10.1 We retain personal data only for as long as necessary for the purposes described in this Policy, to provide the Platform, and to comply with legal, tax, accounting and regulatory obligations, after which it is deleted or anonymised. Criteria we use include the duration of our relationship, the nature of the data, and legal limitation periods.

10.2 For Candidate data processed as a Processor, retention is determined by the Customer (as Controller) through its instructions and our Data Processing Agreement. We retain such data only for as long as the Customer instructs, and we will permanently delete or return it in accordance with the Customer’s instructions — and in any event on termination of the Customer’s account — subject to any retention required by Applicable Law.

10.3 Indicative retention periods: account data — for the life of the account plus 6 months; billing records — 8 years; support records — 8 years; marketing data — until you opt out; backups — on our standard backup cycle.

11Security

11.1 We maintain technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest; identity and access management with multi-factor authentication and least-privilege; network controls and database authentication; logging, monitoring and alerting; a secure software-development lifecycle with code review and dependency scanning; backups with tested restoration; vendor due diligence; incident-response procedures; and personnel confidentiality and security training. Our security programme is built to align with SOC 2 security practices and the GDPR/DPDP Act security requirements.

11.2 No method of transmission or storage is completely secure. While we work hard to protect personal data, we cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.

12Personal-data breach

12.1 We maintain procedures to detect, investigate, contain and respond to personal-data breaches. Where a breach is likely to cause harm, we will notify the relevant authority (including the Data Protection Board of India and, where the GDPR applies, the competent supervisory authority) and affected individuals, within the timelines required by Applicable Law. Where we act as a Processor, we will notify the affected Customer without undue delay so it can meet its own obligations.

13Your rights and choices

13.1 Subject to Applicable Law, you have the following rights in relation to your personal data:

• Access — to obtain confirmation and a copy of your personal data and information about its processing;
• Correction and updating — to have inaccurate or incomplete data corrected;
• Erasure — to have personal data deleted where it is no longer necessary or where you withdraw consent (subject to legal retention);
• Withdrawal of consent — where processing is based on consent, you may withdraw it at any time (without affecting prior lawful processing);
• Grievance redressal — to raise a grievance with us and have it addressed;
• Nomination — under the DPDP Act, to nominate another individual to exercise your rights in the event of death or incapacity;
• (GDPR) restriction of processing, objection to processing (including direct marketing and processing based on legitimate interests), data portability, and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects.

13.2 How to exercise your rights. Contact our Grievance Officer (clause 18). We may need to verify your identity before acting. We will respond within the timelines required by Applicable Law and, where permitted, may charge a reasonable fee or decline manifestly unfounded or excessive requests.

13.3 Candidates. If you are a Candidate, the Customer (the prospective employer or agency) is the Controller of your data; please direct your request to that Customer. We will assist the Customer in responding, and will action requests we receive directly by forwarding them to the relevant Customer.

13.4 Complaints. You have the right to complain to a supervisory authority — in India, the Data Protection Board of India; in the EU/EEA or the UK, your local data-protection authority. We ask that you contact us first so we can try to resolve your concern.

14Consent and its withdrawal

14.1 Where we rely on consent, it is sought through a clear affirmative action, for a specified purpose, and you may withdraw it at any time via the mechanism provided (for example, account settings, an unsubscribe link, or by contacting the Grievance Officer). Withdrawing consent may limit our ability to provide certain features. Where the DPDP Act provides for a Consent Manager, you may be able to manage consents through a registered Consent Manager.

15Marketing communications

15.1 We send B2B marketing only where permitted. You can opt out at any time using the unsubscribe link in our emails or by contacting us. We will still send essential service communications (for example, security, billing and legal notices).

16Children’s data

16.1 The Platform is intended for business users and is not directed to children. We do not knowingly collect personal data of children. Customers must not upload children’s data except where lawful and necessary for recruitment with all required consents and verifications under the DPDP Act.

17Third-party websites and services

17.1 The Platform and website may link to third-party sites and services that we do not control. Their privacy practices are governed by their own policies; please review them.

18Grievance Officer, Data Protection Officer and contact

18.1 Grievance Officer. In accordance with the DPDP Act and the Information Technology Act, our Grievance Officer is: Abraham Cyriac, Grievance Officer, Recruit360 Technologies Private Limited, Innov8, Prestige Tech Platina, 11th Floor, Kadabisanahalli, Bengaluru, Karnataka 560087, India. Email: [email protected]. We acknowledge grievances within 2 business days and endeavour to resolve them within the period prescribed by Applicable Law.

18.2 Data Protection Officer. If and when we are classified as a Significant Data Fiduciary under the DPDP Act, or where the GDPR requires, we will appoint a Data Protection Officer and publish their contact details here.

18.3 General contact. [email protected].

19Region-specific terms

19.1 EEA/UK. If you are in the EEA or UK, the GDPR / UK GDPR applies to our processing of your personal data as a Controller; the lawful bases are indicated in clause 5, and your rights are described in clause 13. Transfers are addressed in clause 9.

19.2 India. The DPDP Act applies to the processing of digital personal data of Data Principals in India; notice, consent (or legitimate uses), data-principal rights, grievance redressal and cross-border rules are addressed throughout this Policy.

20Changes to this Policy

20.1 We may update this Policy from time to time. We will post the updated version with a new “last updated” date and, for material changes, provide additional notice (for example, by email or an in-product notice). Your continued use after the effective date constitutes acceptance of the updated Policy.