Privacy Notice
Candidate and Employee Personal Data Processing Principles
Email: raktaspriha@gmail.com
This Privacy Notice explains how Raktaspriha collects, processes, protects, and stores personal information collected through our official career and onboarding portal (onboard.raktaspriha.site). We treat candidate and employee privacy with the utmost seriousness in alignment with principles under the Digital Personal Data Protection Act (DPDP), 2023 and applicable Indian data protection standards.
1. Personal Data Collected & Purpose of Processing
| Category | Data Fields | Purpose of Processing |
|---|---|---|
| Personal Contact | Full legal name, email, phone number, residential address, city, state, postal code. | Identification, candidate communication, background checks, and official correspondence. |
| Application Profile | Position applied for, skills, experience level, introduction/motivation, resume/CV upload. | Evaluating suitability, competence, and qualifications for open positions. |
| Signatures | Image scan/photograph of handwritten paper signature. | Authenticating candidate submission intent and maintaining audit files. |
| Onboarding Data | Emergency contact details, bank account & IFSC, PAN, joining date. | Statutory payroll processing, employee benefits administration, and emergency safety. |
| Technical Audit | Timestamp, IP address, user agent, agreement acceptance version. | Maintaining an indisputable audit log and defending against fraudulent submissions. |
2. Identity and Aadhaar Verification Safeguards
Raktaspriha designs identity verification as a strictly modular, optional integration point until full regulatory eligibility is established under applicable UIDAI frameworks.
- We do not store raw Aadhaar numbers or unredacted Aadhaar card photos by default.
- We never request Aadhaar OTPs or biometrics directly through standard web forms.
- Identity verification tracks distinct audit states: Not Required, Pending, Verified, Failed, and Manual Review.
- Identity documentation is never transmitted in email attachments. All files are deposited exclusively in encrypted private storage buckets.
3. Service Providers & Data Processors
We partner with industry-standard, ISO/SOC2-certified infrastructure providers to safely host and process application records:
- Supabase: PostgreSQL relational database, Row-Level Security (RLS) policies, and private object storage buckets for handwritten signatures and approved documents.
- Resend: Transactional email delivery service utilized exclusively to dispatch application alerts and confirmation notices without sensitive document payloads.
- Telecommunication / SMS Gateway: SMS verification services (when enabled) solely for one-time passcode (OTP) delivery to candidate phone numbers.
4. Data Retention and Deletion Schedule
Personal data is retained only for the duration reasonably necessary to fulfill the recruitment and onboarding purposes for which it was gathered, or as mandated by applicable labor, tax, and corporate statutes:
- Unselected Applicants: Retained for a standard period of 12 months following application closure for potential future openings, after which records may be securely purged or anonymized.
- Selected & Onboarded Personnel: Retained throughout the duration of employment and for statutory audit periods (typically 7 to 8 years under statutory tax and labor retention rules).
- Security Audit Logs: Maintained for a minimum of 24 months to support information security auditing.
5. Your Rights & Grievance Redressal
Subject to applicable legal constraints, candidates and employees have rights regarding their personal information:
- Right of Access & Review: You may request a summary of personal information we hold about you.
- Right of Rectification: You may request correction of inaccurate or incomplete contact or qualification data.
- Right of Erasure: You may request deletion of your job application records if you no longer wish to be considered for employment, subject to our lawful record retention duties.
- Right to Withdraw Consent: Where processing is premised on your consent, you may withdraw consent by written notice. Withdrawal does not affect the lawfulness of prior processing.
To exercise any of these rights, or to submit a privacy grievance, please email our Privacy Officer at raktaspriha@gmail.com.
6. Security Safeguards & Practical Limitations
We implement technical and organizational controls including encryption at rest, TLS transmission encryption, strict database Row Level Security (RLS), role-based administrator access controls, and rate-limiting.
Note: While we adhere to industry best practices, no electronic transmission over the internet or digital storage architecture can be guaranteed 100% impenetrable. We do not claim absolute, unbreakable security.
7. Policy Changes
We may periodically revise this Privacy Notice to reflect evolving regulatory requirements or operational practices. Any material modification will be posted on this portal with an updated document version and effective date.