Privacy policy

Part A. About this notice

1 Who we are

WorkKar Global LLP is a recruitment and staffing firm with its registered office at Shop No. 10, Ganesh Signifia, Param Pujya Ravishankarji Marg, near Wadala-Pathardi Road, Indira Nagar, Nashik, Maharashtra 422009, India. In this notice, "WorkKar", "we", "us" and "our" mean WorkKar Global LLP.

For the personal data described below we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and you are the Data Principal. Where we also handle information as part of a service we perform for a client employer, we act on that client's written instructions for that part of the work.

We earn our income from employers, who pay a recruitment fee when a candidate joins. Job seekers and partner training institutes pay us nothing. Nothing in this notice creates a way for us to charge a candidate, and nothing in our business model depends on selling your information.

Our contact details are at section 20, and the same details are on the contact page.

2 Who this notice covers

This notice applies to everybody whose personal data reaches us through www.workkarglobal.com, through our recruitment work, or through any WhatsApp, email or telephone conversation with our team. That includes:

• Job seekers who register, apply, send a resume or speak to one of our consultants.
• Employers and client contacts, meaning the individual people at a company who brief us and interview our candidates.
• Recruitment partners, meaning independent recruiters and small staffing firms who work on our mandates under a partner agreement.
• Training institutes and the students whose details an institute sends us with that student's consent.
• Visitors who only read the site and never register.

It does not cover what an employer does with your data after we introduce you. Once an introduction is made, that employer decides the purposes of its own hiring process and is an independent Data Fiduciary, with its own privacy notice. It also does not cover websites we link to; section 10 and the terms of use say more about that.

Part B. What we collect, and why

3 What we collect

We collect different things from different people. The table below is the complete list. If a field is marked optional, the service still works without it.

4 Where the data comes from

• From you When you register, fill a form, upload a resume, send it on WhatsApp or email, or speak to a consultant who types notes into our system.
• From a partner training institute When an institute sends us a placement list. The institute must take each student's consent first, and we ask for proof of it.
• From a client employer When a client asks us to verify or assess a candidate they already have in their own process.
• From a recruitment partner When a partner puts a candidate forward for one of our mandates. The partner is responsible for having taken that candidate's consent.
• From public professional profiles Where you have chosen to make a profile public and it is lawful for us to view it. If we contact you from such a source, we say so in the first message and delete the record if you ask.
• Automatically From cookies and server logs, as described in section 17.

5 Why we use it, and on what basis

The DPDP Act allows us to process your personal data with your consent, or for certain legitimate uses the Act itself lists, which include data you voluntarily give us for a purpose and processing needed to meet a legal obligation. This table sets out every purpose, the basis we rely on, and how long we hold the data for that purpose.

We do not use your personal data to take a decision that produces a legal effect on you without a person reviewing it, and we do not build advertising profiles.

6 Consent, and how to withdraw it

Where we rely on consent, we ask for it in clear words, for a stated purpose, with a tick box that is never pre-ticked. A separate consent is taken for each introduction to a named employer, and for any background check. We keep a record of what you agreed to, and when.

Withdrawing consent

You may withdraw consent at any time. It is as easy to withdraw as it was to give. Use any of these:

• The privacy settings in your WorkKar account.
• An email to info@workkarglobal.com with "Withdraw consent" in the subject line.
• A WhatsApp message to +91 73873 63472 from the number on your file.

When you withdraw, we stop the processing that depended on that consent, and we instruct our processors to do the same. Two honest limits apply. First, a withdrawal does not undo anything already done lawfully while consent was in force. Second, if your resume has already reached an employer, we cannot reach into that employer's system, but we will tell them in writing that you have withdrawn and ask them to delete it, and we will send you a copy of that message. Where we must keep a record to meet a legal obligation, for example an invoice, we keep that record and nothing more.

Consent notices are published in English. Hindi and Marathi versions are available on request from the grievance officer.

7 AI shortlisting and scoring

Our consultants work inside our own applicant tracking system. It reads a resume, extracts skills, experience and education, and scores how closely a profile fits an open role. It writes one line explaining the score, for example that four of five required skills are present but the notice period is longer than the client asked for.

• A WorkKar consultant reads every shortlist before it goes to a client. No candidate is rejected by software alone.
• The score is an internal working number. It is not published on your profile, not shown to other candidates and not used to set any price.
• You may ask us why a score was low. We will explain it in plain words and correct any data that turns out to be wrong.
• We do not use your resume to train a general purpose AI model, and we do not send resumes to a public AI tool.

More about how our team works is on the AI in our hiring process page.

Part C. Sharing

8 How your resume reaches an employer

This is the part most people want to read, so it is set out step by step.

1. We tell you who and what. Before anything is sent, a consultant tells you the employer's name, the role, the location, the salary band and the interview process.
2. We ask, and we record the answer. Your yes is taken on a call, on WhatsApp or by email, and saved against your file with the date. A yes for one employer is not a yes for another.
3. We send a defined set. The employer receives your resume, our written summary of your fit, and, where a check has been run with your consent, the verification result. Your contact details go at the same time, because the employer needs to be able to call you.
4. You can block an employer. Tell us any company, group or competitor you do not want approached, including your current employer. We add it to your file as a block list and it is checked before every submission.
5. Confidential mandates. A client sometimes asks us not to name them until the first interview. In that case we tell you the industry, the city, the role and the salary band, and take your consent on that basis. You are free to say no.
6. After the introduction. The employer becomes an independent Data Fiduciary for its own hiring process. Our engagement letter requires every client to use the data only for that role, keep it confidential, not to pass it to a third party, and to delete it when the role closes.

9 Who else sees your data

Beyond the employer introductions described above, a small number of service providers process data on our instructions. They are bound by written contracts, may use the data only for the task we give them, and may not use it for their own purposes.

If the firm is ever restructured, merged or acquired, your data may pass to the successor entity, which will be bound by this notice until it publishes one that is at least as protective, and we will tell you before that happens.

We never sell your personal data. There is no advertising network on this site, and a resume is not a product we trade.

10 Where data is stored, and transfers outside India

Our primary storage is on servers located in India. Some of the providers listed above operate global networks, so limited data, for example the routing of an email or a message, may be processed outside India.

The DPDP Act permits transfers outside India except to countries the Central Government restricts by notification. We keep to that list. Where data does leave India, we require the provider to hold it under a written contract with confidentiality, security and deletion obligations equal to those in this notice, and we keep the transfer to the minimum the task needs.

Part D. Keeping data safe

11 How long we keep things

Each purpose in section 5 carries its own period, and we delete or anonymise data when the last purpose it serves has ended. In addition:

• An account with no login for 24 months is flagged as dormant. We email and message you before anything is deleted, and you have 30 days to keep it.
• Deleting your profile removes your resume, your documents and your activity from our live systems. Backups roll off within 90 days.
• We keep a minimal record of introductions already made, containing the employer, the role and the date, because both sides may need to prove who was introduced and when.
• Invoices, GST records and books of account are kept for 8 financial years because the law requires it, and no request can shorten that.
• Data held under a legal hold, for example an ongoing dispute, is kept until the matter closes.

12 Security

We take reasonable security safeguards to prevent a personal data breach, as the DPDP Act requires. In practice that means:

• Passwords stored only as salted hashes, never in readable form.
• Encryption in transit over TLS, and encryption at rest for the database and backups.
• Role based access, so a consultant sees the mandates assigned to that consultant and not the whole database.
• Access logs on resume downloads and bulk exports, reviewed by the partner in charge.
• Company laptops with disk encryption and screen locks, and no candidate data stored on personal devices.
• Written contracts, confidentiality clauses and need to know access for every vendor and every partner recruiter.
• Staff training on data handling and on refusing any request that looks like a fraud, repeated at least once a year.

We are a young firm and we will not claim a certification we do not hold. No system is perfectly secure, so please use a strong, unique password and never share a one-time password with anyone, including somebody claiming to be from WorkKar.

13 If something goes wrong

If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal in the form and within the time the DPDP Act and its rules require. Our notice to you will describe, in plain words, what happened, the data involved, the likely consequences, what we have done about it, and what we suggest you do. We will not wait for a complete investigation before telling you that something has happened.

Part E. Your control

14 Your rights

As a Data Principal under the DPDP Act you have the following rights, and exercising them is free.

Right to access

A summary of the personal data we hold about you, what we are doing with it, and the identities of the Data Fiduciaries and processors with whom it has been shared.

Right to correction and completion

Correction of anything inaccurate, completion of anything partial, and updating of anything that has changed. Most of this you can do yourself in your profile.

Right to erasure

Deletion of your personal data, unless a law requires us to keep it or it is needed for a legal claim. We will say clearly which items are held back, and why.

Right to withdraw consent

At any time, by the routes in section 6.

Right to nominate

You may nominate another individual to exercise these rights on your behalf if you die or become unable to act.

Right of grievance redressal

A readily available route to complain to us, described in section 20, which you must use before approaching the Data Protection Board of India.

How to make a request

Email info@workkarglobal.com with "DPDP request" in the subject line, or use the form on the grievance page. Tell us which right you are exercising and the mobile number or email on your file. We may ask for proof of identity, because handing your data to the wrong person would be the larger harm. We acknowledge within 48 hours, and we complete the request within 30 days. If a request is unusually complex we will tell you why and give you a date.

If you remain unsatisfied after our grievance process, you may complain to the Data Protection Board of India.

15 Your duties

The DPDP Act places duties on a Data Principal too, and they are sensible ones. Please:

• Give information that is true and complete, particularly on a resume. A false claim about experience or education can end an offer.
• Do not impersonate another person, or register using somebody else's documents.
• Do not suppress material information where the law requires it to be disclosed.
• Do not file a false or frivolous complaint or grievance.

The Act provides for a penalty where these duties are breached. Our own rules on accurate information are in the terms of use.

16 Children's data

Our service is for people aged 18 and over. We do not knowingly create an account for a child, and the sign-up form asks you to confirm your age.

Where a partner training institute sends us details of a student under 18, we process only what that institute's verifiable parental or guardian consent covers, strictly for placement support. We do not track a child, we do not run behavioural advertising, and we do not send marketing messages to a child. If you believe a child's data has reached us without that consent, write to the grievance officer and we will delete it.

17 Cookies and local storage

A cookie is a small file a site stores in your browser. Local storage is similar, and we use it for a few conveniences such as your saved jobs. On your first visit the cookie bar asks what you allow. Only strictly necessary cookies load before you answer.

What we store in your browser

These keys sit in your own browser's local storage, never on our servers, and clearing your browser data removes them: your saved jobs, your recent searches, the audience tab you last chose, and your cookie decision.

Changing your mind

Use the cookie settings link, which is also in the footer of every page, or clear cookies in your browser. Rejecting non-essential cookies does not reduce your access to jobs, courses or any part of the service. Browsers also offer their own controls, and we honour a Global Privacy Control signal where your browser sends one.

We do not run third party advertising cookies on this site today. If that ever changes, the cookie bar will ask before anything loads.

18 Calls, WhatsApp and SMS

With your consent we send job alerts, invitations to walk-in drives, and updates about roles you have applied for. Our consultants also call you about live opportunities.

• To stop marketing messages: reply STOP to an SMS, use the unsubscribe link in an email, change the alert settings in your account, or send one line to info@workkarglobal.com. We action it within 7 days.
• Service messages continue. One-time passwords, application status and interview details are needed to run your account, so they are sent even if you have opted out of marketing.
• WhatsApp. We message from our business number, +91 73873 63472. Reply STOP and we stop. WhatsApp's own privacy terms apply to the delivery of that message.
• Telecom rules. Commercial messages are sent through registered templates under the applicable TRAI regulations, and we respect a number registered on the national Do Not Disturb list.

Part F. Housekeeping

19 Changes to this notice

We update this notice when the law changes, when we add a service, or when we find a sentence that is not clear enough. The version number and the "last updated" date at the top of the page always tell you which edition you are reading.

For a material change, for example a new purpose or a new category of recipient, we will give notice on the site and, where we hold your email address, by email, at least 15 days before it takes effect. Where the change needs fresh consent under the DPDP Act, we will ask for it rather than assume it. Older versions are available from the grievance officer on request.

20 Grievance officer and contact

Every question about this notice, every request to use a right, and every complaint goes to the same desk. You will get a person, not a ticket queue.

We acknowledge a grievance within 48 hours and resolve it within 30 days of the date it was first raised. The full escalation route, the fraud alert and the complaint form are on the grievance page. If we have not resolved your grievance to your satisfaction, you may then approach the Data Protection Board of India.

This notice is published in English. In case of any conflict between a translated version and this English text, the English text prevails.