1. About this policy
In2Recruit (“the platform”) is a recruitment-management application operated by In2IT EBS (“we”, “us”). This policy explains what personal data we collect, why, how we use and protect it, and the rights available to you as a Data Principal. It is aligned with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
2. Personal data we collect
Platform users (recruiters and staff):
- Name, work email, role/designation, and account credentials.
- Activity and audit logs (actions taken in the platform, with timestamps).
Candidates:
- Identity and contact details — name, email, phone number.
- Professional profile — current employer, designation, location, total and relevant experience, education, certifications, and skills.
- Recruitment data — expected compensation, notice period, last working day, source, interview feedback, pipeline status, compatibility scores, and offer details.
- CV / résumé documents uploaded by you or a recruiter, and information automatically extracted from those documents.
Technical data:
- Essential cookies / local storage used to keep you signed in and remember preferences. We do not use advertising or tracking cookies.
- Standard server logs (IP address, device/browser information, timestamps) from our hosting provider.
3. How we use personal data
- To manage requisitions and run the recruitment process.
- To evaluate candidates and match them to roles, including automated scoring and short-listing.
- To schedule and record interviews and feedback.
- To communicate with users and candidates (for example, status updates and offers) by email.
- To produce internal analytics and reporting.
- To maintain security, audit trails, and the integrity of the platform.
4. Automated processing and AI
We use automated tools, including third-party AI models, to parse résumés, extract structured details, and score or compare candidates against role requirements. To do this, the text of CVs and job descriptions is sent to our AI processing provider. These tools assist recruiter decisions; final hiring decisions are made by people.
5. Legal basis
We process personal data on the basis of consent and/or the legitimate uses permitted under the DPDP Act, including for employment and recruitment purposes. Where we rely on consent, you may withdraw it at any time (see Section 8).
6. Service providers and data sharing
We share personal data only with service providers (data processors) that process it on our behalf under appropriate safeguards:
- Cloud hosting and database (InsForge / Vercel).
- AI model processing (OpenRouter).
- Email delivery (Microsoft 365).
- Document parsing services.
We do not sell personal data or share it for advertising. We may disclose data where required by law.
7. Data retention
We retain candidate personal data only for as long as necessary for the recruitment purposes described above. Candidate records that are archived (removed from active use) are retained for no longer than 24 months, after which they are eligible for permanent erasure — including any uploaded CVs. You may request erasure of your data at any time (see Section 8), which we action promptly by permanently deleting the record and associated files.
8. Your rights as a Data Principal
Subject to the DPDP Act, you may:
- Access a summary of the personal data we hold about you and how it is processed.
- Request correction, completion, or updating of your data.
- Request erasure of data that is no longer necessary.
- Withdraw consent where processing is based on consent.
- Nominate another individual to exercise your rights in the event of death or incapacity.
- Raise a grievance and seek redressal.
To exercise any of these rights, contact our Grievance Officer (Section 9).
9. Grievance Officer
For any questions, requests, or complaints about your personal data, contact:
[Grievance Officer name], In2IT EBS — privacy@in2itebs.com
We will acknowledge and respond to requests within the timelines required by applicable law.
10. Children’s data
The platform is intended for professional recruitment and is not directed at children. We do not knowingly process the personal data of children.
11. Changes to this policy
We may update this policy from time to time. The “last updated” date above reflects the current version, and we will communicate material changes through the platform.