Privacy Policy
1. Introduction
ATWORKFORCE (hereinafter referred to as "ATWORKFORCE," "we," "us," or "our") is a recruitment and human resource consultancy firm committed to connecting talented professionals with rewarding career opportunities and helping organisations build high-performing teams. We understand the importance of privacy and are dedicated to protecting the personal information of our candidates, clients, website visitors, and all other stakeholders who interact with us.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website (www.atworkforce.com), register for our services, or engage with us as a candidate, client, or partner. It reflects our commitment to transparency and our compliance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
By accessing or using our website, submitting your information, or using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein. If you do not agree with our practices, please do not provide us with your personal information or use our services.
2. Who We Are
ATWORKFORCE is a recruitment and HR consulting firm that specialises in helping jobseekers at all career stages find meaningful employment aligned with their skills, aspirations, and values, while also partnering with startups, SMEs, and enterprises to secure the right talent that drives business success.
You can contact us through various channels. For general inquiries and grievance redressal, you may email us at contact@atworkforce.com. Our website is www.atworkforce.com.
For any privacy-related inquiries or to exercise your data protection rights, please contact our Grievance Officer at the email address provided above.
3. Purpose and Scope of This Policy
This Privacy Policy is designed to inform you about the types of personal information we collect, explain how we use, store, and protect your information, describe the circumstances under which we may share your information, outline your rights regarding your personal data under the DPDP Act, and provide information about how to contact us with privacy concerns.
This policy applies to all personal data processed by ATWORKFORCE, whether collected through our website (built on a secure third-party platform), during recruitment activities, through client engagements, or in the course of our business operations. It governs the practices of all ATWORKFORCE employees, contractors, and authorised third parties who handle personal data on our behalf.
4. Information We Collect
We collect and process various categories of personal information depending on your relationship with us and the services you request. In compliance with the data minimisation principle under the DPDP Act, we limit our collection to only such personal data as is necessary for the specified purposes.
4.1 Information You Provide Directly
For Candidates and Jobseekers:
We collect identity information such as your full name, date of birth, gender, and photograph for identification and communication purposes. We also collect contact information, including your email address, phone number, and postal address, to communicate with you and provide updates about opportunities.
Your professional information, including your resume or CV, employment history, educational background, professional qualifications, certifications, skills, languages, and achievements, is collected to assess your suitability for job opportunities. We also gather your career preferences, such as desired job roles, industries, locations, salary expectations, notice period, and work arrangement preferences (remote, hybrid, or on-site) to match you with suitable employers.
Where required for employment verification and with your explicit consent as permitted by law, we may collect identification documents, including your passport, driver's license, PAN card, or Aadhaar, for right-to-work verification and legal compliance. We also collect names and contact information of professional referees to conduct reference checks with your consent. Additionally, we maintain records of our communications with you, including emails, messages, call recordings, and interview feedback, for service delivery and quality improvement purposes.
For Employers and Clients:
We collect identity information such as your full name, job title, and designation for identification and communication purposes. Your contact information, including work email address, work phone number, and company address, is used for communication and service delivery. We also gather company information such as company name, registration details, industry, size, and hiring requirements to understand your needs.
Billing information, including GST number, PAN, payment details, invoices, and bank account information, is collected for invoicing and payment processing. We also maintain records of our communications, including emails, contracts, statements of work, and meeting records, for contract management and record-keeping purposes.
For Website Visitors:
When you visit our website, you may provide information through contact forms, newsletter subscriptions, event registrations, or inquiries made via chat, email, or phone.
4.2 Information Collected Automatically
When you visit our website, we may automatically collect certain information about your device and usage patterns. This includes device information such as your IP address, browser type and version, operating system, device type, and unique device identifiers. We also collect usage data, including pages visited, time spent on pages, clickstream data, referring website addresses, date and time stamps, and search queries.
We use cookies, web beacons, pixel tags, and similar technologies to enhance user experience and analyse website traffic. For more information, please see our Cookie Policy in Section 12.
4.3 Information from Third Parties
We may receive information about you from third-party sources to supplement our recruitment services and ensure the accuracy of our records. This includes information from job boards and professional networks such as LinkedIn, Naukri, and Indeed, where you have made your profile publicly available or have consented to share. With your explicit consent, we may receive verification reports from background check providers confirming your education and employment history. We may also receive professional references and feedback about your work history and performance from referees you have listed. Additionally, we may receive feedback and assessment data from clients or employers during the recruitment process.
Our legal basis for collecting information from job boards and professional networks is legitimate interests or your consent. For background check providers and referees, we rely on your explicit consent. For feedback from clients and employers, our legal basis is the performance of the contract.
5. Legal Basis for Processing Your Personal Data
Under the DPDP Act, we process your personal data only when we have a lawful basis to do so. The lawful bases we rely upon include consent, where you have given clear, affirmative consent for processing your personal data for a specific purpose, such as optional processing activities, sharing profiles with employers, and marketing communications. Performance of contract applies where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract, such as providing recruitment services, candidate placement, and client services. Legal obligation applies where processing is necessary for compliance with a legal obligation to which we are subject, such as statutory record-keeping, tax compliance, and regulatory requirements. Legitimate uses for employment purposes apply where processing is for purposes of employment or to safeguard the employer from loss or liability, including recruitment, background verification, performance management, and employee records.
Under the DPDP Act, processing for "purposes of employment" is recognised as a legitimate use where explicit consent may not be required. This includes recruitment and candidate assessment, background verification and reference checks where reasonably necessary, onboarding and employment administration, payroll and benefits management, performance management and evaluations, and compliance with employment laws and regulations.
Even where consent is not required for employment purposes, we remain committed to transparency. We will always provide clear notice of our processing activities and respect your rights under the DPDP Act.
6. How We Use Your Information
We use your personal information for various purposes depending on your relationship with us. For recruitment and placement services, we assess your qualifications, skills, and suitability for current and future job opportunities. We match your profile with employer requirements and share your information with potential employers, obtaining your consent where required. We communicate with you about job opportunities, interview schedules, and application status. With your consent, we conduct reference checks and verify your qualifications and employment history. We negotiate employment offers and facilitate placements on your behalf. With your consent, we maintain a pipeline of potential candidates for future opportunities.
For client services, we understand client hiring needs and provide suitable candidate recommendations. We manage client accounts, contracts, and billing, and communicate about service delivery, updates, and new offerings.
For communication and relationship management, we respond to your inquiries and requests. We send service-related communications, including updates about applications or placements. With opt-out options, we provide career resources, insights, and market intelligence. We also conduct surveys and gather feedback to improve our services.
For website improvement and analytics, we analyse website usage and improve user experience. We monitor and ensure the security of our website and systems, personalise content based on your interests, and troubleshoot technical issues and optimise website performance.
For legal and compliance obligations, we verify identity and right-to-work eligibility. We maintain records as required by applicable laws and regulations, detect, prevent, and address fraud, security incidents, or other unlawful activities, establish, exercise, or defend legal claims, and comply with court orders, legal processes, or governmental requests.
For business operations, we use information for internal training, quality assurance, and service improvement, data analysis, market research, and business planning, and in connection with a merger, acquisition, or sale of business assets.
7. Data Sharing and Disclosure
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share your information in specific circumstances.
With prospective employers, when we identify a potential job opportunity that matches your profile, we may share your relevant information with the prospective employer for recruitment purposes. This typically occurs after we have discussed the opportunity with you and, where required by law, obtained your explicit consent.
With service providers and processors, we engage trusted third-party service providers to assist in delivering our services. These providers act as data processors on our behalf and are contractually bound to protect your information, use it solely for the purposes we specify, and comply with the DPDP Act. This includes technology providers for applicant tracking systems, CRM platforms, website hosting, cloud storage, and analytics tools. It also includes background check agencies for verification of education and employment history with your consent, communication tools for email services, messaging platforms, and video conferencing tools, payment processors for billing, invoicing, and payment collection, and marketing partners for email marketing, social media advertising, and campaign management with your consent.
With regulatory authorities and law enforcement, we may disclose your information when required by law, regulation, legal process, or governmental request. This includes responding to court orders, subpoenas, or valid requests from law enforcement agencies, tax authorities, or other regulatory bodies.
In business transactions, in the event of a merger, acquisition, restructuring, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify you of any such change and ensure your information remains protected in accordance with this Privacy Policy.
With your consent, we may share your information for other purposes with your explicit consent.
8. Cross-Border Data Transfers
As a recruitment firm operating in a global marketplace, your personal information may be transferred to and processed in countries outside India, including jurisdictions that may have different data protection laws. This may include transfers to potential employers located outside India, our service providers and partners located in other countries, and cloud servers located in various regions.
When we transfer your information internationally, we take appropriate safeguards to ensure your data remains protected in accordance with this Privacy Policy and the DPDP Act. Where required, we obtain your explicit consent for international transfers. We enter into data processing agreements with recipients that include appropriate data protection obligations. We only transfer data to countries that are not restricted by the Government of India under the DPDP Act framework.
By submitting your information to us, you acknowledge and agree to such transfers, storage, and processing as described in this section. We are committed to taking all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.
9. Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, or reporting requirements. For active candidate data, we retain information during the duration of active candidacy plus up to 2 years for future suitable opportunities, based on your consent or our legitimate interests. For placed candidate data, we retain information for the duration of the placement guarantee period plus up to 6 years for legal, audit, and reference purposes, based on legal obligation and contract. For unsuccessful candidate data, we retain information for up to 2 years from the end of the recruitment process, unless consent is obtained for longer retention, based on consent. For client and vendor data, we retain information during the duration of engagement plus up to 6 years for legal, accounting, and tax purposes, based on legal obligation. For website usage data, we retain information for up to 12 months for analytics purposes, based on legitimate interests. For communication records, we retain information for up to 2 years from the last contact, based on legitimate interests. For marketing contact data, we retain information until you unsubscribe or request deletion, based on consent.
We consider various factors when determining retention periods, including the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, whether we can achieve those purposes through other means, and applicable legal, regulatory, tax, or accounting requirements.
After the retention period expires, your personal data will be securely deleted, anonymised, or archived in compliance with applicable laws. If we need to extend the retention period for a valid reason, we will obtain your consent where required.
10. Data Security
ATWORKFORCE implements appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration, as required under the DPDP Act.
Our technical measures include encryption of data during transmission using SSL/TLS protocols and storage where appropriate. We implement role-based access controls, ensuring only authorised personnel can access information relevant to their duties. We maintain firewalls and intrusion detection systems as network security measures to prevent unauthorised access. We ensure secure infrastructure through regular security updates, patches, and vulnerability assessments. We also maintain regular data backups and disaster recovery procedures.
Our organisational measures include regular staff training on data protection, confidentiality obligations, and privacy best practices. All employees and contractors sign confidentiality agreements. We maintain written data protection policies and handling procedures. We have incident response procedures to detect, report, and investigate data breaches. We also conduct periodic reviews of security practices and compliance.
We require our service providers, contractors, and other third parties to maintain similar levels of data protection measures when processing your personal data on our behalf. We conduct due diligence and include data protection obligations in our contracts with them.
While we strive to protect your personal information, please note that no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability. In the event of a data breach that affects your rights and freedoms, we will notify you and the Data Protection Board of India as required by law.
11. Your Rights Under the DPDP Act
As a Data Principal under the DPDP Act, you have various rights regarding your personal information. You have the right to access, which allows you to request a copy of the personal information we hold about you. You have the right to correction, which allows you to request correction of inaccurate or incomplete information. You have the right to erasure, which allows you to request deletion of your personal information where there is no compelling reason for its continued processing, subject to legal obligations. You have the right to withdraw consent at any time where processing is based on consent. You have the right to nominate a representative to exercise your rights in case of death or incapacity. You have the right to grievance redressal, allowing you to register a complaint regarding data processing. You also have the right to complain to the Data Protection Board of India.
To exercise any of these rights, please contact our Grievance Officer at contact@atworkforce.com with the subject line "Data Subject Request." We will respond to your request within the timeframes required by applicable law, typically within a reasonable period not exceeding 30 days. We may need to verify your identity before processing certain requests to protect your privacy and security.
Where processing is based on your consent, you have the right to withdraw your consent at any time. To withdraw consent for marketing communications, click the "unsubscribe" link in our emails. To withdraw consent for profile sharing, contact your consultant or email contact@atworkforce.com. For all other consent-based processing, submit a request to our Grievance Officer. Please note that withdrawal of consent applies only to future processing activities and does not affect the lawfulness of processing based on consent before its withdrawal. In some cases, we may continue to retain certain data if required to comply with legal obligations.
Under the DPDP Act, you have the right to nominate an individual to exercise your rights in the event of death or incapacity. To make a nomination, please contact our Grievance Officer with the nominee's details.
12. Cookies and Tracking Technologies
Our website, built on a secure third-party platform, uses cookies and similar tracking technologies to enhance user experience, analyse traffic, and personalise content. Cookies are small text files placed on your device when you visit a website. They help us remember your preferences, understand how you interact with our site, and improve your browsing experience.
We use various types of cookies on our website. Essential cookies are required for website functionality, such as login sessions, security, and form submissions, and may be session-based or persistent. Preference cookies remember your settings, language preferences, and choices, and are persistent for up to one year. Analytics cookies track website usage, page visits, and user behaviour to improve our site, and are persistent for up to two years. Marketing cookies deliver relevant content and measure campaign effectiveness, with your consent, and are persistent for up to two years. Third-party cookies from platforms like LinkedIn, Facebook, and Google are used for ad personalisation, with duration varying by provider.
Most browsers allow you to refuse cookies and to delete existing cookies. You can manage cookie preferences via your browser settings. In Google Chrome, navigate to Settings, then Privacy and Security, then Cookies and other site data. In Mozilla Firefox, go to Options, then Privacy and Security, then Cookies and Site Data. In Safari, access Preferences, then Privacy, then Manage Website Data. In Microsoft Edge, go to Settings, then Site permissions, then Cookies and site data. Please note that disabling certain cookies may affect website functionality and your user experience.
13. Grievance Redressal Mechanism
In compliance with the DPDP Act, ATWORKFORCE has established a grievance redressal mechanism to address any concerns or complaints regarding the processing of your personal data. We have appointed a Grievance Officer to oversee data protection compliance and handle your concerns. The Grievance Officer can be contacted at contact@atworkforce.com. We aim to respond to all grievances within 30 business days.
If you have any concerns or complaints regarding our data practices, please contact our Grievance Officer with your full name and contact details, a description of the grievance, any relevant supporting information, and your preferred resolution, if any.
If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.
14. Children's Privacy
Our services are not directed to individuals under the age of 18. We do not knowingly collect, use, or disclose personal information from minors. If you become aware that a minor has provided us with personal information, please contact us immediately, and we will take steps to delete such information.
Under the DPDP Act, verifiable parental consent is required before processing the personal data of children. Where we become aware that we have inadvertently collected information from a child without such consent, we will delete it promptly.
15. Third-Party Links and Services
Our website may contain links to external sites operated by third parties, including job boards and professional networks such as LinkedIn, Naukri, and Indeed, social media platforms including Facebook, Twitter, and Instagram, client websites, and partner organisations. We are not responsible for the privacy practices or content of such third-party sites. We encourage you to review the privacy policies of any external sites you visit, as their practices may differ from ours.
16. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or industry standards. When we make material changes, we will update the "Last Updated" date at the top of this policy, post a prominent notice on our website, and, for significant changes, notify you directly via email.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our website and services after any changes constitutes your acceptance of the revised policy.
17. Specific Provisions for Candidates
As a candidate, we want you to know that your profile will only be shared with employers after meaningful discussion and, where appropriate, your explicit consent. You will receive updates on your candidacy with no ghosting. Our services are completely free for candidates, always. You can update, access, or delete your profile at any time. We are your advocates, not just your agents.
If you are currently employed and exploring opportunities discreetly, we take additional precautions to protect your privacy. Your profile will be marked as "confidential." We will not share your information without your explicit consent for each opportunity. We will discuss with you the best approach for each potential employer. Please inform your consultant if you require confidential handling of your search.
In line with the DPDP Act's data minimisation principle, we collect only such information as is necessary to assess your suitability for employment opportunities. We do not request or collect information about physical fitness for desk jobs where not relevant, marital status or family details unless required for statutory benefits, or information unrelated to your professional qualifications.
18. Specific Provisions for Employers
As an employer client, we commit to sharing only relevant candidate information necessary for your hiring decisions, protecting your confidential business information, maintaining transparency about our data practices, obtaining candidate consent where required before sharing profiles, and deleting candidate data when no longer needed for specific hiring purposes.
When we share candidate information with you, you agree to use the information solely for recruitment purposes related to the specific role, protect candidate data in accordance with applicable privacy laws, not share candidate information with unauthorized third parties, maintain the confidentiality of candidate information, delete candidate data when no longer needed for the specific hiring purpose, and not use candidate information for any purpose other than evaluating them for employment.
As a Data Fiduciary under the DPDP Act, you are responsible for complying with data protection obligations when processing candidate information shared by us.
19. Website Platform and Hosting
Our website operates on a secure, third-party-hosted platform that provides the infrastructure necessary to deliver our services online. This platform provider acts as a data processor on our behalf, storing information on enterprise-grade servers protected by firewalls, encryption, and other industry-standard security measures. All data collected through our website is transmitted using secure protocols and stored in compliance with applicable data protection laws.
While our platform provider may have access to your data solely for the purpose of maintaining and improving website functionality, they are contractually prohibited from using your information for any independent purposes. We have entered into appropriate data processing agreements with our provider to ensure your information is protected in accordance with this Privacy Policy and the Digital Personal Data Protection Act, 2023.
All data processed through our website remains under our control, and we are fully responsible for ensuring its protection and lawful use. For more information about the technical and organisational security measures we implement, please contact our Grievance Officer.
20. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us. For general privacy inquiries, email us at contact@atworkforce.com. For grievance redressal and data subject requests, email our Grievance Officer at contact@atworkforce.com. We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy.
21. Definitions
Under this Privacy Policy, certain terms have specific meanings. "Data Principal" means the individual to whom personal data relates, which is you. "Data Fiduciary" means the entity that determines the purposes and means of processing personal data, which is ATWORKFORCE. "Data Processor" means the entity that processes personal data on behalf of the Data Fiduciary. "Personal Data" means any data about an individual who is identifiable by or in relation to such data. "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion. "Consent" means freely given, specific, informed, unconditional, and unambiguous agreement to processing. "DPDP Act" means the Digital Personal Data Protection Act, 2023 of India.
22. Consent Acknowledgement
By using our website, submitting your information, or engaging our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein.
For candidates, by submitting your profile, you agree that we may process your personal information to provide recruitment services, match you with potential employers, and communicate with you about opportunities. You confirm that all information provided is accurate and complete.
For employers, by registering or engaging our services, you agree that we may process your business contact information to provide recruitment services, communicate about placements, and manage our business relationship.
At ATWORKFORCE, your trust is our most valuable asset. We are committed to protecting your privacy and being transparent about how we handle your information. Thank you for partnering with us on your career journey or talent acquisition needs.