Careers Platform — Privacy Policy

1. Introduction

This Privacy Policy explains how Hell Craft Tech ("Company", "we", "us", or "our") collects, uses, discloses, retains, and otherwise processes personal data in connection with the HellCraft Tech Careers Platform (careers.hellcraft.in) and the Gapso Careers Platform (careers.gapso.in) (together, the "Platform").

This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 and the rules made thereunder ("DPDP Act"). By accessing or using the Platform, you acknowledge that you have read and understood this Policy.

2. Who Operates the Platform

Hell Craft Tech is a sole proprietorship registered under the Udyam registration scheme, with its registered address at #69, Hanchala, Bangarpet, Kolar, Karnataka 563114, India and its operating office at Metro Mingle, #59 (1st Floor), 10th A Cross, 2nd Stage, Mahalakshmipuram, West of Chord Road, Next to Rajajinagar Metro Station, Bengaluru, Karnataka 560086, India.

"HellCraft Tech" and "Gapso" are both brands currently operated by Hell Craft Tech. Gapso does not yet have a separate corporate registration; until it does, Hell Craft Tech is the data fiduciary / body corporate responsible for personal data collected under both brands, and this Policy governs both. If Gapso is separately incorporated in the future, this Policy will be updated to reflect the new entity and the "Last Updated" date above will change accordingly.

3. Information We Collect

3.1 Job Applicants

When you apply for a role through the Platform, we collect:

• Your full name, phone number, email address, and date of birth (used to confirm you meet the minimum age to apply)
• Your graduation year (used to assess relevant experience for the role)
• Your resume/CV, and any cover letter or portfolio material you attach to it
• The Google account email address returned when you verify your email via Google Sign-In
• Any information you voluntarily include in your application or resume (e.g. work history, education, links)

3.2 Employees

If you are hired, we additionally hold, as part of your employment record:

• Employee ID, designation, job title, and role information
• Gender, join date, and (where applicable) expected end date and employment status
• Offer details and any documents generated or exchanged as part of onboarding

3.3 Interview Scheduling

If an interview is scheduled for you and our team has connected a Google Calendar account, your name, email, and interview time may be used to create a Google Calendar event and Google Meet link. That event is subject to Google's own privacy practices in addition to this Policy.

3.4 Website Visitors and Enquiries

If you contact us through a general enquiry or contact form, we collect your name, email, phone number, organisation (if provided), and the content of your message, solely to respond to you.

3.5 Information Collected Automatically

When you visit the Platform, we may automatically collect:

• Your IP address and browser type
• Pages visited and time spent on the Platform
• Device information and operating system
• Cookies and similar technologies (see Section 10)

3.6 Sensitive Personal Data

The SPDI Rules classify certain categories of information — including health condition, medical records, and biometric information — as "Sensitive Personal Data or Information." Resumes, cover letters, and employment records can incidentally contain such information (for example, a disclosed health condition, or a photograph). By submitting your application, resume, or any other document through the Platform, you provide explicit, informed consent for us to process any such sensitive personal data it may contain, solely for the recruitment and employment purposes described in this Policy. You are not required to disclose sensitive personal data you do not wish to share, and we do not request it as a condition of applying.

4. Consent

Where we rely on your consent to process personal data, that consent is free, specific, informed, unambiguous, and given through a clear affirmative action (for example, submitting the application form, or completing Google Sign-In verification). You may withdraw consent at any time by contacting us at the details in Section 13; withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer process your application.

5. How We Use Your Information

We use the information we collect to:

• Process your job application and evaluate your candidacy
• Verify your identity/email via Google Sign-In
• Communicate with you regarding your application, interviews, and offers
• Schedule interviews, including creating calendar events and meeting links where applicable
• Onboard and administer your employment, if you are hired
• Respond to enquiries submitted through our contact form
• Comply with legal, regulatory, and audit requirements
• Detect, investigate, and prevent fraud or misuse of the Platform
• Improve and operate the Platform (e.g. basic analytics, security monitoring)

6. How We Share Your Information

We may share your information with:

• Internal Teams: our recruiting, HR, and hiring personnel who need it to process your application or employment
• Service Providers: cloud infrastructure, file storage, email delivery, and identity verification providers we use to operate the Platform (see Section 7)
• Legal Requirements: where required by law, regulation, or a valid legal process
• Business Transitions: in connection with a merger, acquisition, or transfer of business assets, including the future separate incorporation of Gapso described in Section 2

We do not sell your personal information to third parties.

7. Cross-Border Data Transfer

Some of the cloud service providers we use to operate the Platform — including email delivery, file storage, and identity verification — may process data on servers located outside India. Where this occurs, we take reasonable steps to ensure your data continues to be protected consistently with this Policy and applicable Indian law. We do not transfer personal data to any country the Central Government has restricted under the DPDP Act.

8. Data Retention

Applications: we retain application materials for twelve (12) months from the date of submission or final decision (whichever is later), after which they are deleted or anonymised, unless a longer period is required for a legal or regulatory purpose.

Employees: if you are hired, we retain your employment record for the duration of your employment and for seven (7) years after it ends, to meet statutory record-keeping obligations under applicable Indian labour, tax, and social security laws.

You may request earlier deletion at any time, subject to these legal retention requirements.

9. Security

We implement reasonable security practices and procedures, as required under the SPDI Rules, to protect your personal information against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Cookies and Tracking Technologies

The Platform uses cookies necessary for core functionality (such as keeping an admin session signed in) and may use limited analytics cookies. You can control cookies through your browser settings; disabling them may limit some functionality.

11. Your Rights

Under the DPDP Act, as a Data Principal you have the right to:

• Access a summary of the personal data we hold about you and how it is processed
• Correction and completion of inaccurate or incomplete personal data
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations (Section 8)
• Withdraw consent at any time, as described in Section 4
• Grievance redressal, as described in Section 12
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity

To exercise any of these rights, contact us at it@hellcraft.in.

12. Grievance Redressal

In accordance with the SPDI Rules and the DPDP Act, we have appointed a Grievance Officer to address complaints or grievances regarding the processing of your personal data. The Grievance Officer will acknowledge and address grievances as expeditiously as possible, and in any event within one (1) month of receipt.

If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India, once its grievance-handling mechanism is operational under the DPDP Act.

13. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies before providing information to them.

14. Children's Privacy

The Platform is intended only for individuals aged 18 and above, consistent with applicable minimum employment age requirements in India. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete it promptly and, where required, notify the individual's parent or lawful guardian.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above. Your continued use of the Platform after a revised Policy is posted constitutes your acceptance of the changes.

16. Governing Law

This Policy is governed by the laws of India. See our Terms of Service for the applicable jurisdiction clause.

17. Contact Us

For any questions about this Policy or our data practices, contact us at: