Candidate Privacy Notice (GDPR)
Version 7.0 · effective 5 October 2026
| Data controller | NAZZTEC PRIVATE LIMITED, World Trade Center Bengaluru, Regus, Unit No 2201A, 22nd Floor, Brigade Gateway, Rajajinagar Extension, Malleswaram (W), Bengaluru, Karnataka 560055, India |
|---|---|
| Privacy contact | privacy@nazztec.com · Data Protection Officer: dpo@nazztec.com |
| Applies to | https://careers.nazztec.com (NAZZTEC Careers) |
| Legal framework | the EU General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and India's Digital Personal Data Protection Act, 2023 (DPDP Act) |
| Version | 7.0 — effective 5 October 2026 |
1. What this notice covers
This notice explains how NAZZTEC PRIVATE LIMITED ("NAZZTEC", "we") collects and uses your personal data when you use NAZZTEC Careers. It supplements the general privacy policy at https://www.nazztec.com/privacy-policy/.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, mobile and optional WhatsApp number, country and city | You |
| Professional profile | Headline, current employer, years of experience, notice period, skills, languages, LinkedIn / GitHub / portfolio links, professional summary, employment and education history | You (and text read from your CV to pre-fill empty fields, which you review) |
| CV and documents | CV / résumé files you upload, verification documents NAZZTEC requests, and text extracted for search | You |
| Application data | Roles applied for, answers to screening questions, cover note, application status and history | You and NAZZTEC recruiters |
| Assessment data | Interview schedules, interviewer feedback and scorecards, offer details | NAZZTEC staff |
| Optional compensation data | Current and expected salary and currency (only if you choose to provide it) | You |
| Consent and acknowledgement records | Which document versions you accepted, when, and keyed one-way hashes of your IP address and browser | Generated by the Portal |
| Security and technical data | Sign-in times, failed sign-in counts, session records, audit log entries, IP address, time zone | Generated by the Portal |
We do not ask for special-category or sensitive data (such as health, religion, ethnicity, biometrics or criminal records) through the Portal. Please do not include it in your CV. If a role later requires lawful background or medical checks, we will tell you separately.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and managing your candidate account | Contract / steps at your request (GDPR Art. 6(1)(b)) |
| Assessing your application, interviews and offers | Steps prior to entering a contract (Art. 6(1)(b)) and legitimate interests in recruiting (Art. 6(1)(f)) |
| Keeping you in the NAZZTEC talent pool for future roles | Consent (Art. 6(1)(a)) — you can withdraw it at any time |
| Sending job alerts | Separate, optional consent (Art. 6(1)(a)) |
| Security, fraud prevention and audit logging | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| Employment law, immigration and regulatory requirements | Legal obligation (Art. 6(1)(c)) |
We do not make recruitment decisions by automated means alone. Matching scores and CV keyword search only help recruiters, who review every application.
4. Who can see your data
- Authorised NAZZTEC recruiters, hiring managers and administrators, on a need-to-know basis. Interviewers see only what they need for their interview and never your contact details.
- Our hosting provider (Hostycare (managed web hosting)) and email provider, acting as processors under contract.
- Other NAZZTEC group companies only where you apply for a role they are hiring for.
- Authorities where the law requires it. We never sell your personal data.
5. Where your data is stored and international transfers
The Portal is hosted by Hostycare (managed web hosting). Where your data is transferred outside the EU/EEA or UK (for example to NAZZTEC entities in India, Saudi Arabia or the United States), we use Standard Contractual Clauses or the UK International Data Transfer Addendum, or another lawful transfer mechanism under GDPR Chapter V.
6. How long we keep it
Profiles with no activity for the retention period set by NAZZTEC (24 months by default) are automatically anonymised. Deleted accounts are erased immediately, except minimal records we must keep to evidence compliance (for example, the audit entry that your data was erased and your consent history, which contains no contact details).
7. Your rights
- Right of access and to a copy of your data (Art. 15) — use Download my data.
- Right to rectification (Art. 16) — edit your profile at any time.
- Right to erasure (Art. 17) — use Delete my account.
- Right to restriction (Art. 18) and to object (Art. 21) — contact us.
- Right to data portability (Art. 20) — the download is machine-readable JSON.
- Right to withdraw consent at any time (Art. 7(3)) and to opt out of job alerts.
- Right to complain to the competent supervisory authority (in the EU/EEA the authority of your country of residence, in the UK the Information Commissioner's Office, and in India the Data Protection Board of India).
Self-service tools are on the Privacy & account page. For anything else email privacy@nazztec.com. We respond within one month of receiving a verified request (extendable by two further months for complex requests, GDPR Article 12(3)).
8. Security
The Portal enforces HTTPS, hashes passwords with scrypt, encrypts stored secrets with AES-256-GCM, protects every form against cross-site request forgery, limits sign-in attempts, checks every uploaded file by its content, applies role-based access control and records security-relevant actions in an audit log. Staff accounts require two-step verification.
9. Personal data breaches
If a breach is likely to result in a risk to you, we will notify the supervisory authority within 72 hours where required (Art. 33) and notify you without undue delay if the risk is high (Art. 34).
10. Changes
We publish a new version number whenever this notice changes materially, and ask you to acknowledge it the next time you sign in.