Privacy Policy

This notice is issued by [Registered entity name, e.g. Workfly Technologies Pvt. Ltd.] (CIN [CIN]), registered at [Registered office address, with PIN], trading as Workfly (“Workfly”, “we”, “us”).

It explains how we handle personal data across the Workfly website, the recruitment services we provide to client organisations, and the Workfly HRMS and Recruitment CRM products.

It is written to meet the notice requirements of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, and our obligations under the Information Technology Act, 2000.

The words the law uses

This distinction decides who you approach to exercise your rights, so it is set out first.

Workfly as Data Fiduciary

We decide the purpose and means, and we answer to you directly, for:

• Candidates who apply to or are sourced for a role we are mandated on.
• Client contacts — the people at client organisations we deal with.
• Visitors to the Workfly website, including anyone submitting a hiring requirement.
• Our own employees and contractors.

Workfly as Data Processor

When a client organisation subscribes to the Workfly HRMS or Recruitment CRM and loads their own employee or candidate records into it, that client is the Data Fiduciary and Workfly acts on their documented instructions under a written contract.

We collect only what the stated purpose needs. Categories differ by who you are.

Where it comes from

• Directly from you — forms, résumés, account fields, documents you upload.
• From your employer, where they operate a Workfly product.
• From a client organisation that has referred or submitted you for a role.
• From job portals and professional networks where you have made a profile available for recruitment, and from referrals.

Under the DPDP Act, personal data may be processed for a lawful purpose either with your consent, or for a “legitimate use” the Act specifically lists. Our basis for each purpose:

Consent, and withdrawing it

Where we rely on consent, we ask for it against an itemised description of the data and the purpose, in clear language, and we make the notice available in English and in the languages listed in the Eighth Schedule to the Constitution on request.

You may withdraw consent at any time, and withdrawing must be as easy as giving it. Write to [privacy@workfly.in]. Withdrawal is not retrospective — it does not undo processing already carried out lawfully, and we may continue to retain data the law requires us to keep. Where withdrawal makes it impossible to continue a service, we will tell you before acting.

• Client organisations — a candidate’s profile is shared with the specific client whose role they are being considered for, with their agreement.
• Service providers acting on our instructions — cloud hosting, database, object storage, email delivery, and payment processing. They are bound by contract to process only as instructed and to protect the data.
• Statutory and regulatory authorities — where disclosure is required by law, or by an order of a court or authority of competent jurisdiction.
• Professional advisers and, on a corporate transaction, an acquirer — subject to confidentiality and to this notice continuing to apply.

We do not disclose an employee’s HRMS data to anyone other than their employer and the processors above.

We host personal data on infrastructure located in India wherever the provider offers it, and we prefer Indian regions when configuring new services.

Some processors operate from outside India. Section 16 of the DPDP Act permits transfer of personal data outside India except to a country or territory the Central Government restricts by notification. We do not transfer personal data to any country currently restricted by such a notification, and we review our processor list against that list when it changes.

Where a sector-specific law requires particular data to be held only in India, that requirement prevails over this section.

We erase personal data once the purpose is no longer being served and retention is no longer necessary for a legal obligation — which is what the DPDP Act requires of us.

We are required to take reasonable security safeguards to prevent a personal data breach. The measures we operate include:

• Role-based access control — a client sees only their own mandates; an employee sees only their own record; a manager sees only their reports.
• Passwords stored only as salted hashes, never in a readable form.
• Server-side sessions that can be revoked immediately, and are revoked automatically when an account is deactivated or a password is reset.
• Rate limiting on authentication to blunt credential-stuffing.
• Encryption of data in transit, and encryption at rest as provided by our infrastructure.
• Documents served only through access-controlled endpoints, never from a publicly readable bucket.
• Audit trails of administrative actions, and monitoring of access to payroll and document stores.
• Contractual security obligations on every processor, and periodic review of them.
• Least-privilege access for our own staff, reviewed when roles change and removed on exit.

No system is immune. We do not claim our measures make a breach impossible — the next section sets out exactly what we do if one occurs.

A personal data breach means any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises the confidentiality, integrity or availability of personal data.

Our reporting obligations, and their deadlines

Two separate legal duties apply, with different clocks. We treat both as running from the moment the incident is first noticed or brought to our notice.

What our notice to you will contain

1. 01A description of the breach — its nature, extent, and when and where it occurred.
2. 02The categories of personal data affected, and as far as we can establish it, the specific data relating to you.
3. 03The likely consequences for you, stated plainly rather than minimised.
4. 04The measures we have taken to contain it and to prevent recurrence.
5. 05Steps you can take to protect yourself — for example changing a reused password, or watching for targeted phishing that references real details.
6. 06The name and contact details of the person at Workfly who can answer your questions about the incident.

How we will contact you

By email to the address on your account, and where the risk warrants it also by an in-product notice and by telephone. We will not require you to log in to a link in that email to learn the substance of what happened — a breach notice that behaves like a phishing message is a bad notice.

What we do internally

1. 01Contain — isolate affected systems, revoke sessions and credentials, stop the ongoing loss.
2. 02Assess — establish what data, whose data, how much, and over what period.
3. 03Report — to CERT-In within the 6-hour window, and to the Board and affected individuals as above.
4. 04Preserve — retain logs and forensic evidence, and cooperate with any authority investigating.
5. 05Remediate — fix the cause, and record what changed so the fix can be verified afterwards.
6. 06Review — a written post-incident review, with the actions arising tracked to completion.

If you believe you have found a vulnerability in a Workfly product, please report it to [grievance@workfly.in] rather than disclosing it publicly. We will acknowledge your report and keep you informed.

The DPDP Act gives you the following rights over personal data we hold as Data Fiduciary. Exercise any of them by writing to [privacy@workfly.in].

We respond to rights requests within the period prescribed under the Act and its rules. We may ask you to verify your identity before we act — that protection exists for you.

Your duties

The Act also places duties on Data Principals. You must not impersonate another person when providing data, must not suppress material information when providing it where legally required, and must not raise a false or frivolous grievance. The Act provides for a penalty where these duties are breached.

The DPDP Act treats anyone under 18 as a child. Workfly’s services are meant for organisations and for adults seeking employment, and we do not knowingly process a child’s personal data.

• Where processing a child's data is unavoidable, we obtain verifiable consent from the parent or lawful guardian before doing so.
• We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at them.
• We do not process a child's data in a way likely to cause any detrimental effect on their well-being.
• The same protections apply to a person with a disability who has a lawful guardian, with consent taken from that guardian.

If you believe a child’s personal data has reached us, write to [privacy@workfly.in] and we will erase it.

The Workfly website uses only what it needs to function. The HRMS portal sets a session cookie so you stay signed in; it is essential and the portal cannot work without it.

• Essential cookies — authentication and security. Always set.
• Preference storage — remembers choices such as a selected month or filter, held in your browser and never sent to us.
• Analytics — where enabled, configured to measure usage in aggregate. Where analytics is not strictly necessary, we ask for consent before it runs.

You can clear or block cookies in your browser. Blocking essential cookies will prevent you from signing in.

If you are unhappy with how we have handled your personal data or a rights request, contact our Grievance Officer. We are required to have one and to publish their details.

We acknowledge grievances on receipt and respond within the period prescribed by the applicable rules.

We update this notice when our processing changes or the law does. The current version is always published at this address, with the date it took effect at the top.

Where a change materially affects how we use personal data we already hold about you, we will tell you directly and, where the change relies on consent, ask for it afresh rather than assuming it.