CANDIDATE PRIVACY NOTICE
FOR PROCESSING OF DIGITAL PERSONAL DATA
IN COMPLIANCE WITH APPLICABLE LAWS INCLUDING DIGITAL PERSONAL DATA PROTECTION ACT, 2023 (DPDP ACT)
INTRODUCTION
We, GI Human Resources and Services Private Limited and/or GI Staffing Services Private Limited (jointly and severally referred to as “Company”) are part of Gi Group Holding, and are involved in providing recruitment and staffing services including other services in human capital management. This Candidate Privacy Notice is to inform you of our commitment to protecting the privacy and security of your digital personal data, and it describes how the Company collects, uses, discloses and processes personal data which you share with the Company during the job application and recruitment process. The Company processes the digital personal data in compliance with applicable data protection laws of India including Digital Personal Data Protection Act, 2023 (DPDP Act). As per the DPDP Act, you shall be referred to as “Data Principal” and the Company shall be referred to as “Data Fiduciary” in this Candidate Privacy Notice.
DATA FIDUCIARY
Data Fiduciary: GI Human Resources and Services Private Limited
Corporate Office: 503, 5th Floor, Tower B, World Trade Tower, Sector 16, Noida 201301 Uttar Pradesh
Country: India
Email: contracts.gihr@gigroup.com
Telephone: +91 120 4510900
PERSONAL DATA COLLECTED
In connection with your job application, interview and recruitment process, the Data Fiduciary will collect the following categories of digital personal data:
• Identification Data: Name, surname, date of birth, Aadhar Card, PAN Card (Passport or Voter ID card)
• Contact Details: residence address, email address, contact number
• Experience Details: Resumes, Work Experience Certificates, Employment history, Academics certificates
• Compensation Details: Current salary, salary expectation and benefits details
• Medical Certificates: Medical certificates on exceptional cases if required by Client.
The personal data will be collected in any of the following ways:
• Registration to the myGiGroup/myGrafton personal area carried out from the websites of the Companies (hereinafter also "Site") or via App;
• Websites of any third-party companies and social networks;
• E-mail exchanges between you and the Company;
• At the interview stage, directly by the Company or the organization who interviews to recruit you.
PURPOSE AND LEGAL BASIS FOR COLLECTION AND PROCESSING OF PERSONAL DATA
The Company collects and processes your digital personal data based on your express consent (which you grant by applying and submitting your details) and for specific, lawful purposes related to evaluating your employment potential. The digital personal data are processed under the following lawful grounds:
• Assessing your suitability, qualifications, and skills for open roles.
• Conducting background verification and reference checks.
• Communicating with you regarding your job application status and future job opportunities.
• Complying with applicable legal, statutory, or regulatory obligations in India.
As a Data Principal, you have the right to provide your free, specific, informed, unconditional and unambiguous consent for process of your digital personal data, and the Data Fiduciary will process your personal data only basis your consent. For your information, the legal basis applicable to the processing of your digital personal data are provided under Sections 4, 5, 6 and 7 of the DPDP Act.
1. PORTAL REGISTRATION:
Your digital personal data are processed for registration in the myGiGroup/myGrafton personal area, to be carried out to create a personal profile on the portal that allows you to review our job offers and apply to them. The legal basis applicable to the processing of your digital personal data for portal registration purpose is broadly pursuant to Section 4(1)(a) and Section 6 of the DPDP Act.
2. APPLICATION TO A JOB OFFER AND CANDIDATE SELECTION PROCESS:
Your personal data are processed both in case of application in response to a specific advertisement published on the site and in case of voluntary application through the site for the pursuit of the purpose of search and selection of candidates, in particular:
• for placement on a temporary basis at our client user company
• for direct placement at our third-party customer company
• for the implementation of measures or in the framework of collaborations and/or partnerships with public and private market operators.
3. INFORMATION:
Your personal data are also processed to send you communications strictly related to the purpose of search and selection of candidates by traditional or automated contact methods, including communications relating to training initiatives strictly linked to a specific position, financed by our client companies or by interprofessional funds (together the “Information Purpose”). The legal basis applicable to the processing of your digital personal data for information purpose is broadly pursuant to Sections 5 and 11 of the DPDP Act.
4. PROPOSAL OF JOB OFFERS:
Your personal data may be processed to propose searches and selections of personnel in line with your profile in order to provide job placement, including by sending job offers by traditional or automated contact methods. Should you object to such processing, your personal data shall be processed exclusively in the context of the specific selections for which you have applied.
5. AGGREGATE ANALYSIS:
Your personal data may be processed:
(a) for analyses of aggregate data for statistical purposes, not aimed at detecting the behaviour of data principals and without direct effects on the data principals, and for analyses of data for the purpose of verifying and forecasting business results and for internal and external auditing purposes, which do not affect the legal sphere of the data principals. Such analysis activities may also be carried out through the use of IT and artificial intelligence tools;
(b) in an aggregate manner for the maintenance and improvement of the systems used to perform the services, in a manner not aimed at detecting the behaviour of the persons concerned and without direct effect on them.
6. LEGAL DEFENSE:
Your personal data may also be processed to ascertain, exercise or defend a right of the Company in court or judicial / quasi-judicial / administrative proceedings. The legal basis applicable to the processing of your personal data for the legal defense purpose in the legitimate interest of the Companies is pursuant to Section 17(1)(a) of DPDP Act.
7. MARKETING:
Your data may be processed for the purpose of sending information and promotional communications relating to the services offered by the Company (in particular, training initiatives, career development, coaching), or carrying out studies and statistical and/or market research relating to employment services, using both traditional and automated contact methods (e.g., e-mail, SMS, instant messaging systems, operator calls, paper mail). The legal basis applicable to the processing of your digital personal data for marketing purpose is broadly pursuant to Section 4(1)(a) and Section 6 of the DPDP Act.
DATA RETENTION
Your personal data will be retained until the completion of the specified purpose in compliance with the applicable laws. If your job application is successful, relevant personal data will be transferred to your personnel file. However, if your job application is unsuccessful, we will retain your personal data for a period of forty-eight (48) months to consider you for future roles, after which it will be securely deleted or anonymized, unless a longer retention period is required by any other prevailing law or agreed upon. The 48-month retention period is calculated starting from the date of the last activity recorded in the current system. In case you withdraw your consent, the Company will take steps to cease processing and erase your personal data, subject to technical deletion and backup procedures. The legal basis applicable to the retention and deletion of your digital personal data is broadly pursuant to Sections 8(7) and 8(8) of the DPDP Act.
NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL
As a responsible Data Fiduciary, your personal data will be processed by the Company only upon your consent. he provision of the data marked with an asterisk in the registration form for the myGiGroup/myGrafton personal area is necessary to allow the Companies to complete your registration (Portal Registration purpose). Therefore, any refusal to provide the requested data will prevent the Company from completing your registration to myGiGroup/myGrafton.
The provision of the data marked with an asterisk in the data collection form is necessary to allow the Company to pursue the search and selection purposes; therefore, any refusal to provide the requested data shall prevent the Company from carrying out the search and selection activity and shall not allow your application to be taken into consideration.
The provision of data for the marketing purposes is optional. Any refusal to provide data or consent will have no consequence on your registration to myGiGroup/myGrafton and will not prevent the Company from carrying out search and selection activities.
DATA SHARING AND DISCLOSURES / DATA RECIPIENTS
Your personal data will be accessed internally by the Company’s authorized personnel involved in the search and selection and recruitment process, such as HR Team, hiring managers, legal team, Finance and IT Support). These personnel have received adequate operational instructions in this regard. Your personal data may also be shared with third-party Data Processors / Group companies as may mentioned below:
• Background verification service providers, recruitment platforms, IT service providers.
• Affiliates or subsidiaries of the Company where recruitment functions are managed centrally.
• Legal / Labour Authorities, judicial and quasi-judicial or regulatory authorities when mandated by law.
• Client companies or entities, legal advisors / auditors
• Other Data Processors as expressly appointed who provide services such as site operation and maintenance services, candidate database management and maintenance services, archiving services, communication mailing services, market research services, assessment and training services, event organization services and marketing services.
In the event your personal data is transferred outside India to the Company’s global entities or cloud servers, the Company will ensure that the destination recipient provides protection aligned with DPDP Act requirements.
RIGHTS OF DATA PRINCIPAL
As a Data Principal, you have certain statutory rights regarding your personal data as provided under the DPDP Act (mainly under Sections 6(4), 11, 12, 13 and 14 of the DPDP Act).
• Right to Withdraw Consent: You have the right to withdraw your consent at any stage of the recruitment process by way of written information to the Company. Upon such withdrawal of consent, the Company will cease processing your personal data, which may result in the cancellation of your job application.
• Right to Access Information about Personal Data: You have the right to request and obtain (i) a summary of all your personal data currently being processed by the Company; (ii) A description of the processing activities being carried out; and (iii) The identities of all other Data Fiduciaries and Data Processors with whom your data has been shared.
• Right to Correction and Erasure of Personal Data: You have the right to request correction of inaccurate data, updates to incomplete data, or erasure of personal data that is no longer necessary for recruitment.
• Right of Grievance Redressal: If you have any grievances against the Company or any Data Processors engaged by the Company, you may seek redressal of your grievances to the designated grievance officer of the Company.
• Right to Nominate: You also have the right to nominate another individual to act on your behalf and such nominated individual can exercise all of the user's data privacy rights in the event of Data Principal’s death or medical/physical incapacity.
CONTACTING COMPANY AND GRIEVANCE REDRESSSAL
If you have any questions about this Candidate Privacy Notice, or if you wish to exercise any of your rights as mentioned in this document or if you have any grievance regarding your personal data, you may reach out to the below contact person and address of Grievance Officer:
Name: Maya Nair
Designation: Executive Director
Email: contracts.gihr@gigroup.com
Address: 503, 5th Floor, Tower B, World Trade Tower, Sector 16, Noida 201301 Uttar Pradesh (India)
If your grievance is not resolved by the Company as per the statutory provisions, you reserve the right to approach the Data Protection Board of India in compliance of the provisions of Section 13(1) of DPDP Act.
BY SUBMITTING YOUR APPLICATION AND PROFESSIONAL CREDENTIALS, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS CANDIDATE PRIVACY NOTICE AND CONSENT TO THE COLLECTION AND PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS DOCUMENT.