Data privacy & the DPDP Act

Who is responsible for what

• Your agency is the Data Fiduciary for your candidates’ and clients’ data. You decide why and how it is collected and used.
• SohamRecruit is the Data Processor. We store and process that data only to provide the service to you, and we do not sell it.

Helping you meet candidates’ rights

• Access and correction: candidate records can be viewed, edited and exported by your team.
• Erasure: deleting a candidate also deletes their CV file, parsed text and related records.
• Requests from candidates: candidates can use our privacy request form; we pass the request to the agency that holds their record.
• Consent: public job applications ask candidates for consent before they apply.

Where data is stored

Data is hosted on Google Cloud in the United States (us-central1). The DPDP Act allows transfers outside India except to countries the Government restricts. If you need data kept in India, please talk to us before you sign up.

How long data is kept

• Your data is kept while your account is active, and you can delete records or the whole account at any time.
• Activity-log entries are deleted automatically after 36 months.
• If a free trial ends without a subscription, the account is paused and then deleted 30 days later.

Security and breach notice

We protect data with encryption, per-agency isolation and access controls (see Security). If a personal data breach affects your agency, we will tell you without undue delay and within 72 hours of becoming aware of it, so you can inform the Data Protection Board of India and affected people as the Act requires.

Sub-processors

We use Google Cloud (hosting, database, storage, AI), Razorpay (payments in India), Sentry (error monitoring), Google reCAPTCHA, and Microsoft only if you connect Outlook. The full list is in our privacy policy.

Grievance contact

For privacy questions or grievances, email our Grievance Officer at privacy@sohamrecruit.com. We reply within 30 days.