DPDP Act Notice

Purpose

This notice describes how ResumeON processes personal data in connection with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), where applicable. It supplements our Privacy Policy.

How ResumeON follows the DPDP Act

Below is how we put DPDP Act principles into practice on ResumeON. This is a plain-language summary of our current controls and processes, not legal advice or a certification of compliance.

DPDP principle	What ResumeON does
Lawful purpose and notice	We collect personal data to run the hiring platform: accounts, profiles, authentication, matching, and security. Purposes are described in this notice and our Privacy Policy before or when data is collected.
Consent	We ask for consent where required, including through sign-in and account creation, optional cookie choices via our cookie banner, and when you choose to publish a profile or post a job. Service emails such as OTP codes are sent to verify access you request.
Data minimization	We limit what is shown publicly. For example, job seeker salary expectations are not displayed on the public talent directory. Employers sign in with company email addresses rather than personal consumer domains where our validation rules apply.
Accuracy	You can update profile, company, and job information from your account. You may request correction of inaccurate personal data by contacting us.
Storage limitation	We retain account and profile data while your account is active and for periods needed for security, dispute resolution, and legal obligations. You may request deletion subject to applicable limits.
Security safeguards	We use database-backed sessions, email OTP and OAuth sign-in, role-based access for admin and portal areas, account status controls, and technical logging for security and abuse prevention. Admin actions such as impersonation are audit logged.
Data principal rights	Job seekers and employers can download their profile data anytime from Settings and delete their account and profile anytime from the same page. Users in India may also request access, correction, erasure, or grievance redressal by emailing privacy@resumeon.com. We verify identity before fulfilling email requests and respond within timelines required by applicable law.
Breach handling	If we become aware of a personal data breach affecting users, we investigate promptly and notify affected individuals and authorities where required under the DPDP Act and applicable rules.
Cross-border transfers	ResumeON may use cloud infrastructure and processors such as database, hosting, email, and OAuth providers that operate outside India. We use providers under contractual terms and take steps intended to meet applicable DPDP Act transfer requirements.
Accountability	We maintain internal records of login events and selected admin actions, review abuse reports, and update policies as our product or the law changes.

Consent and controls in the product

Sign-in: By signing in, you request access to ResumeON and agree that we process account and authentication data for that purpose.
Cookies: Our cookie banner lets you accept all cookies or essential cookies only. See the Cookie Policy.
Public profiles: Job seeker profiles are not public until published. You control draft vs published status from your account.
Job posts: Employers control when job listings are draft or published.
Download your data: Job seekers and employers can download a copy of their account and profile data anytime from Settings as a JSON file.
Delete your profile: Job seekers and employers can permanently delete their account and profile anytime from Settings. Deletion removes related profile data from ResumeON, subject to limited retention required by law or security.
Withdrawal of consent: Where processing is based on consent, you may withdraw it by contacting privacy@resumeon.com. Withdrawal may limit features that require that data.

Data fiduciary

For personal data processed through ResumeON, ResumeON acts as a data fiduciary with respect to platform account, profile, authentication, and service-related data we determine the purpose and means of processing.

Personal data we process

Identity and contact details such as name and email
Professional profile data for job seekers and employers
Authentication, session, and security records
Communications related to account access and platform operations
Technical logs used for fraud prevention and service reliability

Lawful purposes and consent

We process personal data to provide the ResumeON service, authenticate users, enable hiring workflows, maintain security, comply with law, and improve platform performance.

Where consent is required under the DPDP Act, we seek it through account registration, profile submission, cookie choices, and other clear in-product notices. You may withdraw consent where applicable by contacting us, subject to legal and operational limits.

Rights of data principals

Subject to the DPDP Act and applicable rules, individuals in India may have the right to:

Download a copy of their profile data anytime from Settings
Delete their account and profile anytime from Settings
Access information about personal data we process about them
Request correction of inaccurate or incomplete personal data
Request erasure of personal data in permitted circumstances
Seek grievance redressal regarding our processing practices
Nominate another individual to exercise rights in certain cases

To exercise these rights, email privacy@resumeon.com with enough detail for us to verify your request.

Compliance retention and lawful requests

When you delete your account or an employer closes a job, ResumeON removes live public data promptly. We retain compliance archives, submission logs, login metadata, and issue reports for at least 180 days to meet security, fraud prevention, and legal obligations under applicable Indian law, including IT Act intermediary due diligence and lawful government or agency requests.

Footprint data (such as IP address, user agent, and timestamp) is collected when you sign in, publish content, submit a report, or trigger an archive. This processing is limited to what we consider necessary for those purposes.

Compliance retention and lawful requests

Data retention and security

We retain personal data for as long as needed to provide the service, resolve disputes, enforce agreements, and meet legal obligations. We use administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, or misuse.

Cross-border processing

ResumeON may use infrastructure or service providers located outside India. Where personal data is transferred cross-border, we take steps intended to comply with applicable DPDP Act requirements for such transfers.

Grievance redressal

If you have a concern about our handling of personal data under the DPDP Act, contact our grievance contact:

Grievance contact

Email: privacy@resumeon.com

Subject line: DPDP grievance

Include your account email, a description of the issue, and the remedy you are seeking. We aim to acknowledge grievances promptly and resolve them within timelines required by applicable law.

You may also have the right to approach the Data Protection Board of India or other competent authority where permitted by law.

Children

ResumeON is not intended for individuals below the age permitted under applicable law to enter into employment or data-processing agreements without appropriate consent. We do not knowingly collect personal data from children in violation of the DPDP Act.

Updates

We may update this notice as the DPDP Act rules evolve or as our processing practices change. Material updates will be reflected by the "Last updated" date above.