DPDPA & GDPR Compliance

This Data Protection & Privacy page ("Policy") describes how TalentSpotify Private Limited (CIN: U72900KA2022PTC157845), registered at Sy No. 135/1, No. 87, Ground Floor, Flushing Meadows Layout, Yettakodi, Malur, Kolar, Karnataka, India – 563130, collects, processes, stores, and protects personal data.

This Policy applies to:

• Data Principals / Employees whose performance data is processed through the Platform.
• HR Administrators and Managers who configure and operate the Platform.
• Visitors to our website and marketing materials.

Regulatory framework: Our primary compliance framework is the Digital Personal Data Protection Act, 2023 (DPDPA) — India's landmark data protection legislation. For customers or data principals located in the European Economic Area (EEA), the United Kingdom, or the Gulf Cooperation Council (GCC), we additionally apply the principles of the General Data Protection Regulation (GDPR).

We collect only the personal data necessary to provide the contracted services (data minimisation principle). This includes:

We do not collect or process sensitive personal data (biometric identifiers, health records, religious beliefs, caste) as defined under DPDPA unless explicitly contracted and consented for a specific purpose.

We process personal data only for specific, lawful purposes. Under DPDPA, our lawful bases are consent and legitimate use. Under GDPR, we rely on contract performance, legitimate interests, and legal obligation.

Under the DPDPA 2023, consent must be free, specific, informed, unconditional, and unambiguous. We implement this as follows:

• TARA Session Consent: Before every AI-assisted review conversation, each participant receives a clear, plain-language consent notice in their preferred language (22 Indian languages + English). The session does not begin until affirmative consent is recorded.
• Granular Controls: Employees can consent to transcript generation without consenting to voice recording, and vice versa. No mid-session scoring without prior explicit consent.
• Consent Records: Timestamped consent records are stored and linked to each session. These are available to your HR administrator via the compliance dashboard.
• Withdrawal: Employees may withdraw consent at any time through the Platform's privacy settings or by contacting your HR administrator. Withdrawal does not affect processing already carried out before withdrawal.
• No Dark Patterns: Consent is never bundled with Terms acceptance or pre-ticked. We do not use deceptive design to obtain consent.

Under the Digital Personal Data Protection Act 2023, every Data Principal (employee) has the following rights. To exercise any right, contact your HR administrator or email contact@talentspotify.com.

If you are located in the European Economic Area, United Kingdom, or in GCC countries where GDPR-equivalent obligations apply, you additionally have the following rights under Regulation (EU) 2016/679:

If you believe we have not addressed your concern adequately, you have the right to lodge a complaint with your national supervisory authority (e.g., the ICO in the UK or relevant DPA in the EEA).

We retain personal data only for as long as necessary for the stated purpose or as required by law. Our standard retention schedule:

All data is securely destroyed at end-of-life using NIST SP 800-88 compliant methods. Customers may request early deletion at any time during the subscription.

We implement layered security controls proportionate to the sensitivity of performance and HR data:

We engage the following categories of sub-processors to deliver the Platform. All sub-processors are contractually bound to data protection obligations at least equivalent to those we owe you.

We will notify you of any intended changes to sub-processors with at least 30 days' notice, giving you the opportunity to object. An up-to-date list is available on request.

By default, all Customer Data is stored and processed in India (AWS Mumbai region) and does not leave India. For customers who explicitly enable cross-border features (e.g., GCC payroll integrations), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): For transfers to EEA or UK-based sub-processors, we use the European Commission-approved SCCs (2021/914/EU).
• Adequacy Decisions: Where the destination country has received an adequacy decision from the European Commission or a DPDPA-equivalent notification from the Indian government, we rely on that decision.
• Cross-Border Transfer Agreements: Under DPDPA §16, we enter into a cross-border data transfer agreement with the overseas entity before any transfer of personal data.

We will not transfer your data to countries identified as restricted under DPDPA notifications without your explicit prior consent.

In the event of a personal data breach affecting your data:

1. We will notify your designated security or privacy contact within 72 hours of becoming aware of the breach (as required by DPDPA §8 and GDPR Article 33).
2. Notification will include: nature of the breach; categories and approximate number of data principals affected; likely consequences; measures taken or proposed to address the breach.
3. Where required by DPDPA, we will simultaneously report the breach to the Data Protection Board of India.
4. Where required by GDPR, we will notify the relevant supervisory authority and, where high risk to data subjects is likely, notify affected data subjects directly.
5. We will cooperate fully in any investigation and provide all reasonable assistance.

The TalentSpotify Platform is designed exclusively for use in professional workplace settings. We do not knowingly collect personal data from individuals under the age of 18. If you believe that a minor's data has been collected through the Platform, please contact us immediately at contact@talentspotify.com and we will take prompt steps to delete that data.

Under DPDPA §9, processing of personal data of children requires verifiable parental consent and additional safeguards. Our standard service agreements expressly prohibit use of the Platform to process data of individuals below 18 years of age.

In accordance with the Digital Personal Data Protection Act 2023, TalentSpotify has designated a Grievance Redressal Officer (GRO) to handle complaints and queries from Data Principals.

We acknowledge all grievances within 24 hours and resolve them within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted, as provided under DPDPA §20.

For GDPR purposes and as a matter of best practice, TalentSpotify has designated a Data Protection Officer (DPO) responsible for overseeing compliance with data protection laws and acting as the point of contact for supervisory authorities.

EEA/UK data subjects may also contact our EU Representative (Article 27 GDPR) for matters relating to EU data protection law. Contact details available on request.

We may update this Policy to reflect changes in our data practices, product features, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify Customer account administrators by email at least 30 days before material changes take effect.
• Where consent is the legal basis, obtain fresh consent before the new processing begins.

Continued use of the Platform after the effective date of the updated Policy constitutes acceptance of the revised terms. If you do not agree, you may terminate your subscription as described in our Terms & Conditions.

For all data protection queries, rights requests, or privacy concerns: