Privacy Policy

SUMMARY OF KEY POINTS

• Our role depends on the data. For your account and billing information, we act as a Data Fiduciary. For candidate and employee data that our customers upload into the platform, we act as a Data Processor on the customer's behalf — the customer is the Data Fiduciary. See Section 1.
• What we process. Account and contact details, billing information, candidate data (including resumes), employee HR and payroll data (including bank details and PAN, stored encrypted), communications content and delivery data, and technical/usage data. See Section 2.
• Sensitive data. The platform is capable of storing sensitive information such as employee bank account details and PAN. Where we hold such data, it is encrypted. See Sections 2 and 6.
• Why we process it. To provide, secure, maintain, and improve the Services, to communicate with our customers, to process payments, and to comply with law. See Section 3.
• Sharing. We share data with sub-processors that help us run the Services (such as hosting, payment, and messaging providers), and only in the limited situations described in Section 4.
• Your rights. Depending on your location and applicable law, you may have rights to access, correct, or delete your data, and to withdraw consent. See Section 9.
• Grievances. You can contact our Grievance Officer as described in Section 13.

1. OUR ROLE: DATA FIDUCIARY VS. DATA PROCESSOR

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable data protection laws, AdsEra acts in two distinct capacities:

AdsEra as Data Fiduciary. For the personal data of our customers and their authorized users — such as account registration details, contact information, billing data, and information about how you use the Services — AdsEra determines the purposes and means of processing and is the Data Fiduciary. This Policy governs that processing.

AdsEra as Data Processor. For Candidate Data and Employee Data that a customer uploads to, generates within, or processes through AdsEra Recruit, the customer is the Data Fiduciary and AdsEra acts as a Data Processor, processing that data only on the customer's documented instructions and to provide the Services.

If you are a candidate or an employee whose data is being processed within AdsEra Recruit by one of our customers (for example, a recruitment agency or an employer), that customer is responsible for how your data is collected and used within the platform. For requests relating to your data — such as access, correction, or deletion — you should contact the relevant organization directly. We will assist our customer in responding to such requests as required by law and by our agreement with them.

2. INFORMATION WE COLLECT

2.1 Information you provide as a customer or authorized user

• Identity and contact data: name, email address, phone number, username, and password.
• Business data: company name, address, and business registration or tax details (such as GSTIN).
• Billing data: billing address and payment-related information (see Section 2.5).
• Support and communications data: information you provide when you contact us, respond to surveys, or communicate with our team.

2.2 Candidate Data (processed on behalf of our customers)

When our customers use the Services, they upload and generate information about job candidates, which may include:

• names, email addresses, phone numbers, and other contact details;
• resumes/CVs and the information contained within them (including work history, education, and skills);
• application responses, pipeline stage, ratings, tags, recruiter notes, and activity history; and
• communications with candidates via email and WhatsApp, including delivery and engagement data.

AdsEra processes Candidate Data solely as a Data Processor on the instructions of the relevant customer.

2.3 Employee Data (processed on behalf of our customers)

Where a customer uses the HR and payroll features for its own internal employees, the platform may process:

• employee identity, department, designation, and employment details;
• bank account details and PAN, which are stored encrypted;
• attendance, leave, and holiday records; and
• salary, payroll, and salary-slip information.

AdsEra processes Employee Data solely as a Data Processor on the instructions of the relevant customer.

2.4 Communications data

For email and WhatsApp messages sent through the Services, we process message content, templates, recipient identifiers, and delivery and engagement status (such as queued, sent, delivered, opened, or clicked), so that our customers can manage and track their communications.

2.5 Payment data

When a customer makes a payment, payment is processed by our third-party payment processor, Razorpay. Card and payment-instrument details are collected and stored by the payment processor in accordance with its own privacy policy, available at https://razorpay.com/privacy/. We do not store full card numbers on our own servers; we may retain limited transaction records for billing and accounting.

2.6 Technical and usage data

We automatically collect certain information when the Services are accessed, including IP address, device and browser information, log data, actions taken within the platform, and timestamps. Because the platform maintains an immutable audit trail for security and accountability, we record which authorized user performed an action, when, and from which IP address.

2.7 Cookies and similar technologies

Our website and application use cookies and similar technologies for authentication, security, preferences, and analytics. See Section 12.

3. HOW WE USE INFORMATION

As a Data Fiduciary for customer and authorized-user data, we process personal information to:

• create, authenticate, and manage accounts and authorized users;
• provide, operate, maintain, and secure the Services;
• process payments, manage subscriptions, and issue invoices;
• provide customer support and respond to enquiries;
• monitor, troubleshoot, and improve the Services, including their performance and security;
• detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms;
• send service-related and administrative communications; and
• comply with legal obligations and enforce our agreements.

Where we rely on your consent (for example, for certain marketing communications), you may withdraw it at any time. We otherwise process personal information on lawful bases such as performance of a contract, our legitimate business interests in operating and securing the Services, and compliance with law, as permitted under applicable law.

As a Data Processor, we process Candidate Data and Employee Data only to provide the Services and on the documented instructions of the relevant customer.

4. WHEN AND WITH WHOM WE SHARE INFORMATION

We do not sell personal data. We share information only in the following situations:

• Sub-processors and service providers. We use trusted third parties to help us provide the Services (see Section 5). They may access personal data only to perform services on our behalf and are bound by confidentiality and data-protection obligations.
• Between customer and their Clients. Our customers can share selected information with their own Clients through the Client Portal. The customer controls what is shared. Information made visible in the Client Portal is disclosed at the customer's direction, and the customer is responsible for that decision.
• Payment processing. Payment information is shared with our payment processor to complete transactions.
• Legal and safety. We may disclose information where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of AdsEra, our customers, or others, or to enforce our Terms.
• Business transfers. We may share or transfer information in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to appropriate protections.

5. SUB-PROCESSORS

To operate AdsEra Recruit, we rely on the following categories of sub-processors and infrastructure providers. Personal data may be processed by these providers strictly to deliver the Services:

• Cloud hosting and storage — for hosting the platform and storing files such as resumes, generated PDFs, and receipts (including cloud object storage such as Amazon Web Services / Amazon S3).
• Database and caching infrastructure — for storing and processing platform data and background jobs.
• Payment processing — Razorpay, for processing subscription payments.
• Messaging providers — the WhatsApp Business Platform (Meta) for WhatsApp messaging, and the customer's configured email/SMTP provider for email delivery.
• Communications and support tools — for transactional email and customer support, where applicable.

We maintain oversight of our sub-processors and require them to protect personal data consistent with this Policy and applicable law. A current list of sub-processors can be provided to customers on request, and material changes may be notified to customers as required by any applicable Data Processing Agreement.

6. DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to provide the Services, and to comply with legal, tax, accounting, and regulatory obligations. Retention of Candidate Data and Employee Data processed on a customer's behalf is generally controlled by that customer.

Indicative retention periods for certain platform records include:

• Audit logs: retained for up to 7 years to meet security, accountability, and compliance requirements.
• Email tracking data: retained for up to 1 year.
• Workflow run history: retained for up to 6 months.

Following termination of a customer's subscription, Customer Data is handled as described in our Terms & Conditions and any applicable Data Processing Agreement — generally, data may be exported during a grace period and is then deleted or anonymized from active systems, except where retention is required by law or where data persists in routine backups that are cycled out in the ordinary course. When we no longer have a legitimate need to process personal data, we delete or anonymize it, or securely isolate it from further processing until deletion is possible.

7. DATA SECURITY

We implement reasonable technical and organizational measures designed to protect personal data, consistent with the DPDP Act and applicable law. These include:

• encryption of data in transit;
• encryption of sensitive fields at rest, using strong encryption (AES-256-GCM), including for employee bank details and PAN;
• role-based access control (RBAC) enforced across the platform;
• multi-tenant data isolation, so that each customer's data is segregated;
• secure authentication using short-lived access tokens and protected session handling; and
• audit logging of actions within the platform.

No system can be guaranteed to be completely secure. While we work to protect personal data, we cannot guarantee that unauthorized third parties will never defeat our safeguards. Customers and authorized users are responsible for maintaining the confidentiality of their credentials and for configuring access controls appropriately. If we become aware of a personal-data breach, we will act in accordance with applicable law and, where AdsEra acts as a Data Processor, notify the relevant customer as required.

8. INTERNATIONAL DATA TRANSFERS

AdsEra Recruit is operated from, and hosts data primarily in, India. Some of our sub-processors may process data in other jurisdictions. Where personal data is transferred across borders, we take steps to ensure it remains protected consistent with this Policy and applicable law. If you access the Services from outside India, you understand that your information may be transferred to, stored, and processed in India and other locations where we or our sub-processors operate.

9. YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have rights in respect of your personal data, which may include:

• the right to access the personal data we hold about you;
• the right to correct inaccurate or incomplete data;
• the right to erase your data in certain circumstances;
• the right to withdraw consent where processing is based on consent;
• the right to grievance redressal; and
• the right to nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.

For customers and authorized users: you may review and update much of your account information directly within the Services, or contact us using the details in Section 14. You may opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us; we may still send you service-related messages necessary to administer your account.

For candidates and employees: where your data is processed within AdsEra Recruit by one of our customers, that customer is the Data Fiduciary. Please direct requests to access, correct, or delete your data to the relevant organization. If you contact us directly, we will forward your request to the appropriate customer and assist them as required by law.

We will respond to verifiable requests in accordance with applicable data protection law. We may need to verify your identity before acting on a request.

10. CHILDREN'S DATA

The Services are intended for use by businesses and their authorized users, and are not directed to children. We do not knowingly collect personal data directly from children. Our customers are responsible for ensuring that any processing of data relating to minors through the platform complies with applicable law, including any consent requirements under the DPDP Act.

11. THIRD-PARTY LINKS AND SERVICES

The Services may link to or integrate with third-party websites and services (such as WhatsApp/Meta, email providers, or systems you connect via API or webhook). This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with AdsEra Recruit.

12. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies for essential functions such as authentication and security, to remember preferences, and to understand how the Services are used so we can improve them. Most browsers let you refuse or delete cookies; however, disabling certain cookies may affect the functionality of the Services. We do not currently respond to browser "Do-Not-Track" signals, as no common standard has been finalized.

13. GRIEVANCE OFFICER

In accordance with applicable law, including the DPDP Act and the Information Technology Act, 2000, you may contact our Grievance Officer with any concerns regarding your personal data or this Policy:

Grievance Officer

AdsEra IT Services Private Limited

MDV Colony, Bikaner, Rajasthan 334001, India

Email: [grievance@adsera.in]

We will acknowledge and address grievances within the timeframes required by applicable law.

14. HOW TO CONTACT US

If you have questions, comments, or requests regarding this Policy or our data practices, please contact us at:

AdsEra IT Services Private Limited

MDV Colony, Bikaner

Rajasthan 334001, India

Email: [privacy@adsera.in] / [support@adsera.in]

Website: https://adsera.in

15. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. The updated version will be indicated by a revised "Last updated" date and will be effective when posted. If we make material changes, we will provide notice by reasonable means, which may include posting a prominent notice or sending a direct notification. We encourage you to review this Policy periodically.

*AdsEra Recruit is a product of AdsEra IT Services Private Limited. This Privacy Policy applies specifically to AdsEra Recruit and supplements any general privacy notice applicable to other AdsEra products you may use.*