Candidate Data Protection Policy

1 Introduction & Scope

FOGS Consultants provides HR consultancy, recruitment support, and talent acquisition services to employers across India. This Candidate Data Protection Policy applies to all individuals who:

• Submit an application for a job vacancy through our website, email, or partner platforms
• Register with us for recruitment assistance, permanent placement, or temporary staffing
• Provide a CV, resume, or professional profile to be considered for current or future roles
• Are referred to us by a third-party agency or professional network

This policy complies with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2 Information We Collect

We collect only the information necessary for effective recruitment and placement services. Categories include:

2.1 Identity & Contact Data

• Full name, preferred name, and pronouns (if provided)
• Personal email address and phone number (mobile/landline)
• Current postal address and city/locality of residence
• Links to professional profiles (e.g., LinkedIn, GitHub, portfolio)

2.2 Professional & Employment Data

• Resume/CV, cover letter, and employment history (including dates, job titles, responsibilities)
• Educational qualifications, certifications, professional memberships, and training records
• Language skills, technical competencies, and soft skills assessments
• Current and expected salary/rate information (where provided voluntarily)
• Notice period, availability, and work authorization status (e.g., Indian citizenship, visa requirements)

2.3 Sensitive Personal Data (SPD)

Under Indian law, Sensitive Personal Data includes information about passwords, financial data, physical/physiological/mental health condition, sexual orientation, medical records, biometric data, and caste. We generally avoid collecting SPD unless required by law or with explicit consent. Examples may include:

• Disability or health information (only for reasonable accommodation requests)
• Diversity monitoring data (caste, gender, etc.) – always anonymised and optional
• PAN, Aadhaar, or UAN numbers (only when required for statutory compliance after placement)
• Criminal record information (only where legally required for specific roles)

2.4 Technical Data

• IP address, browser type, and referral source when you visit our career portal
• Application timestamps and interaction logs with our recruitment emails

3 How We Collect Your Data

• Directly from you: When you submit an application via email, our website form, or a partner job portal (e.g., Naukri, Indeed, LinkedIn, Monster India).
• From recruitment partners: When a placement agency, headhunter, or referral source shares your details with us (we will notify you within a reasonable time).
• From publicly available sources: Professional networking sites, but only where lawful and with a legitimate interest (e.g., sourcing for a senior role).
• From interviews and assessments: Notes, feedback, and test results generated during our selection process.

4 Purpose of Data Collection

Your personal data is processed exclusively for the following recruitment-related purposes:

• Matching & Placement: Assessing suitability for current or future job openings with our client employers.
• Communication: Notifying you about relevant opportunities, interview schedules, and application updates.
• Client Submission: Presenting your profile (with your explicit consent) to employers for specific roles.
• Reference & Background Checks: Contacting referees or conducting verification checks only after obtaining your consent.
• Compliance & Legal Obligations: Meeting statutory requirements such as EPF, ESIC, professional tax, or equal opportunity monitoring.
• Improving Our Services: Analysing anonymised data to enhance our recruitment processes and diversity outcomes.

We do not use candidate data for automated marketing or unrelated commercial purposes.

5 Legal Basis for Processing

Under the DPDP Act, 2023, and other applicable Indian laws, we process personal data on the following lawful grounds:

• Contractual necessity: Processing is required to take steps at your request before entering a recruitment contract (e.g., assessing your CV).
• Legitimate interests: Operating an effective recruitment business, matching candidates with employers, and maintaining a talent database — always balanced against your rights.
• Legal obligation: Compliance with employment, tax, anti-discrimination, or statutory reporting laws.
• Consent: For sensitive personal data, for keeping your profile beyond the active application period, or for sharing with specific clients.

You may withdraw consent at any time (see Section 11).

6 Data Sharing & Disclosure

FOGS Consultants never sells candidate data. We share your personal data only when necessary and under strict confidentiality:

• With client employers: Only after obtaining your explicit consent for a specific role. Clients receive only the information relevant to the position.
• With service providers: ATS (Applicant Tracking System) vendors, cloud storage providers, and background check agencies — all bound by data processing agreements.
• With legal authorities: If required by court order, statutory obligation under Indian law, or to prevent fraud or harm.
• With professional advisors: Lawyers, auditors, or insurers where necessary for business operations.

We require all third parties to respect the security of your data and to treat it in accordance with the DPDP Act.

7 Data Retention Periods

We retain candidate data only as long as necessary for recruitment purposes or to comply with legal obligations under Indian law.

• Active candidates (under consideration for a role): Data retained until the recruitment process concludes (usually 3 months).
• Talent pool (future opportunities): If you consent, we retain your CV and profile for 24 months from the last active engagement. After that, we will seek renewed consent or delete the data.
• Unsuccessful applications: Application data is deleted after 12 months, unless you opt into the talent pool.
• Successful placements: Limited data (name, role placed, date) retained for 7 years for reference, audit, and statutory compliance (e.g., EPF/ESIC records).
• Records of consent: Retained for 6 years to demonstrate compliance.

You may request earlier deletion at any time (see Section 9).

8 Data Security Measures

We implement appropriate technical and organisational measures to protect your data as required under the Information Technology Act, 2000 and DPDP Act, 2023:

• Encrypted storage and transmission (TLS 1.3, AES-256 for sensitive data)
• Role-based access control: only recruitment staff directly handling your application can view your data
• Regular security audits and vulnerability scanning of our systems
• Staff training on data protection and confidentiality obligations
• Incident response plan for any suspected data breach

9 Your Rights as a Candidate

Under the DPDP Act, 2023, you have the following enforceable rights regarding your personal data:

• Right to be informed: You have received this policy — clear and transparent.
• Right of access: Request a free copy of all personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete information (e.g., wrong phone number, outdated CV).
• Right to erasure (right to be forgotten): Request deletion of your data when it is no longer needed or if consent is withdrawn.
• Right to restrict processing: Ask us to stop using your data while you challenge its accuracy or our lawful basis.
• Right to data portability: Receive your data in a structured, machine-readable format (e.g., JSON, CSV) and transfer it to another recruiter.
• Right to object: Object to processing based on legitimate interests (e.g., talent pool retention).
• Right to withdraw consent: Withdraw consent at any time without affecting previous lawful processing.
• Right to grievance redressal: Have your concerns addressed by our designated officer.

How to exercise your rights: Send an email to info@fogsconsultants.com with the subject "Candidate Data Request - [Your Name]". We will respond within 30 days.

10 Automated Decision-Making

FOGS Consultants does not use fully automated decision-making or algorithmic profiling that produces legal or similarly significant effects on candidates.

We may use keyword matching in our ATS to filter CVs based on skills you provide, but a human recruiter always reviews every application before any decision is made. You have the right to request human intervention if you believe an automated process has adversely affected you.

11 Consent & Withdrawal

Where we rely on your consent (e.g., keeping your CV in our talent pool, sharing with a specific client, collecting sensitive personal data), you will be presented with a clear, opt-in consent statement.

Withdrawing consent: You may withdraw consent at any time by emailing info@fogsconsultants.com. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw consent, we will cease the relevant processing and delete your data unless another lawful basis exists.

You are not required to consent to any processing that is not necessary for the initial recruitment assessment.

12 Grievance Redressal & Contact

In compliance with the DPDP Act, 2023, FOGS Consultants has appointed a Grievance Officer / Data Protection Officer (DPO) to address your concerns.

Grievance Officer Contact Details:

• Name: Grievance Redressal Officer
• Email: info@fogsconsultants.com (put "Grievance - Candidate Data" in the subject line)
• Office Address: FOGS Consultants, Kochi, Kerala, India
• Phone: +91 8891 909965

For any questions, to exercise your rights, or to lodge a complaint:

• General queries & data requests: info@fogsconsultants.com (subject: "Candidate Data")
• Grievance/complaint escalation: Use the Grievance Officer contact above

Regulatory complaints: If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India (DPBI) once established under the DPDP Act, 2023.