Privacy Policy

ShiftHain.Com ("Platform", "we", "us", "our") operated by ShiftHain Technologies Private Limited, a company incorporated under the Companies Act, 2013, is committed to protecting your personal data.

This Privacy Policy is drafted in compliance with:

• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• The Digital Personal Data Protection Act, 2023 ("DPDP Act") — as applicable upon its enforcement
• The Consumer Protection Act, 2019 — for grievance redressal obligations

1. Definitions

As used in this Policy:

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act, 2023.
• "Sensitive Personal Data" includes passwords, financial data, biometric data, health data, and official identifiers as defined under the SPDI Rules, 2011.
• "Data Fiduciary" means ShiftHain.Com / ShiftHain Technologies Private Limited who determines the purpose and means of processing your personal data.
• "Data Principal" means you — the Jobseeker — whose personal data is being processed.
• "Consent Manager" means the mechanism through which you give, manage, review, and withdraw consent as required under the DPDP Act, 2023.

2. Data We Collect

We collect the following categories of data when you register and use ShiftHain.Com as a Jobseeker:

• Identity Data: Full name, date of birth, gender
• Contact Data: Email address, mobile number, city/district, state, PIN code
• Professional Data: Resume, skills, educational qualifications, work experience, certifications
• Account Data: Username, encrypted password, profile photo
• Usage Data: IP address, browser type, device identifiers, pages visited, time spent, click patterns
• Application Data: Jobs applied to, application status, employer interactions
• Communication Data: Messages sent via platform, Feed posts, comments, reactions

3. Purpose of Processing & Legal Basis

Under the DPDP Act, 2023, we process your data based on your free, specific, informed, unconditional, and unambiguous consent given at the time of registration. Purposes include:

• Creating and managing your Jobseeker profile
• Matching your profile with relevant job listings using algorithmic tools
• Enabling employers to discover and contact you for recruitment
• Sending job alerts, platform notifications, and service updates
• Improving our platform services, features, and user experience
• Preventing fraud, abuse, and ensuring platform security
• Complying with applicable laws and legal obligations

You may withdraw your consent at any time. However, withdrawal of consent may result in inability to use certain platform features.

4. Sharing & Disclosure of Data

We do not sell, rent, or trade your personal data. Your data may be disclosed to:

• Registered Employers on ShiftHain.Com: your profile is shared when you apply for a job or set your profile to "visible"
• Third-party service providers: for hosting, email delivery, analytics, and platform operations, bound by data processing agreements
• Law enforcement, courts, or government authorities: when required by law, court order, or to protect rights and safety
• Business successors: in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections

ℹ️ Note: All third-party service providers are contractually bound under data processing agreements to comply with the SPDI Rules, 2011 and applicable provisions of the DPDP Act, 2023.

5. Cross-Border Data Transfer

Your data is primarily stored on servers located in India. In cases where data is transferred outside India (e.g., cloud service providers), such transfer shall comply with Section 16 of the DPDP Act, 2023, and any conditions prescribed by the Central Government from time to time.

6. Data Retention

• Active account data is retained for the duration of your account
• Deleted account data is purged within 30 days of account deletion, except where retention is required by law
• Application records may be retained for up to 2 years for dispute resolution purposes
• Log data (IP addresses, usage records) is retained for 90 days as required under the IT Act, 2000

7. Security of Personal Data

We implement reasonable security practices as mandated under Rule 8 of the SPDI Rules, 2011, including:

• SSL/TLS encryption for data in transit
• AES-256 encryption for sensitive data at rest
• Role-based access controls limiting employee access to personal data
• Regular security audits and vulnerability assessments
• A documented Information Security Policy reviewed annually

In the event of a personal data breach, we shall notify the Data Protection Board of India and affected users as required under the DPDP Act, 2023.

8. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

• Right to Access (Section 11): Obtain a summary of personal data processed and processing activities
• Right to Correction & Erasure (Section 12): Correct inaccurate/incomplete data or erase data no longer necessary
• Right to Grievance Redressal (Section 13): Have grievances addressed within the timelines prescribed
• Right to Nominate (Section 14): Nominate another individual to exercise your rights in case of death or incapacity
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, contact our Grievance Officer (details in Section 12).

9. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Maintain your login session
• Remember your preferences and settings
• Analyze platform traffic and usage patterns (via anonymized analytics)

You can control cookie preferences via your browser settings. Disabling essential cookies may affect platform functionality. We do not use third-party advertising cookies or cross-site tracking technologies.

10. Children's Data

ShiftHain.Com is not intended for individuals under 18 years of age. We do not knowingly collect personal data of minors. If we become aware that a minor has provided personal data, it will be deleted immediately. Pursuant to Section 9 of the DPDP Act, 2023, processing of children's personal data is prohibited without verifiable parental consent.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law or our practices. Material changes will be notified to you via email or a prominent notice on the platform at least 7 days before they take effect. Continued use after the effective date constitutes acceptance.

12. Grievance Officer

In accordance with Rule 5(9) of the SPDI Rules, 2011 and Section 13 of the DPDP Act, 2023, we have appointed a Grievance Officer: