Privacy policy

1. About this policy

1.1 StaffCloud Services Private Limited (“StaffCloud”, “we”, “us”, “our”) respects the privacy of the people whose personal data it handles. This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, transfer, secure and retain it, and the rights available to you.

1.2 This policy applies to:

1. visitors to our website staffcloud.net and anyone who contacts us through it;
2. our clients and prospective clients, and the individuals who represent them;
3. candidates and applicants who apply to us or are presented by us to a client;
4. vendors, suppliers, subcontractors and business partners; and
5. personal data that we process on behalf of our clients while delivering services to them, to the limited extent described in Clause 5.

1.3 This policy does not apply to our employees and contractors in their employment capacity; they receive a separate internal privacy notice. It also does not apply to third-party websites and platforms that we link to, which have their own policies.

1.4 This policy should be read together with our Terms and Conditions and our Cookie Policy, which are published on the Website.

2. Who we are and how to contact us

2.1 For personal data described in Clauses 4.1 to 4.4, StaffCloud is the data fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the controller under the EU and UK General Data Protection Regulation (“GDPR”) where that regulation applies.

2.2 Shailesh Agrawal is our Grievance Officer for the purposes of the DPDP Act and is the point of contact for all privacy queries, rights requests and complaints. Contact details are in the table above.

2.3 We have not appointed a representative in the European Union or the United Kingdom. If our activities come within the territorial scope of the GDPR in a way that requires one, we will appoint a representative and publish the details in this policy.

3. The personal data we collect

3.1 Website visitors and enquirers

1. Contact and enquiry data you submit through a form, email or telephone call: name, business email address, telephone number, company name, job title, country, and the content of your message or requirement.
2. Technical and usage data collected automatically: IP address, approximate location derived from it, browser type and version, device type, operating system, referring URL, pages viewed, time spent, links clicked, and the dates and times of your visit.
3. Cookie and analytics data, as described in our Cookie Policy.

3.2 Clients, prospective clients and business partners

1. Business contact data for the individuals we deal with: name, job title, work email, work telephone, office location.
2. Engagement and commercial data: proposals, statements of work, correspondence, meeting notes, service records, timesheets, support tickets, and records of instructions and approvals.
3. Billing and payment data: billing name and address, GSTIN or tax registration number, purchase-order references, invoices, remittance advice, bank account details used for payment, and TDS certificates.
4. Compliance and due-diligence data: vendor-onboarding forms, certificates of incorporation, tax registrations and sanctions or adverse-media screening results where a client or partner requires them.

3.3 Candidates and applicants

1. Application data: name, contact details, curriculum vitae, education and employment history, skills, certifications, current and expected compensation, notice period, work-authorisation status, and references.
2. Assessment data: interview notes, test and assessment results, and feedback.
3. Verification data, where the role or a client contract requires it and to the extent permitted by law: previous-employment verification, education verification and address verification. We collect government identifiers only where they are required by law or by a client’s mandatory verification process, and only for as long as that purpose requires.

3.4 Vendors, suppliers and subcontractors

Name and business contact details of your personnel, contract and service records, bank and tax details necessary for payment, and confidentiality and compliance undertakings.

3.5 Sensitive personal data

We do not seek to collect sensitive personal data — such as data concerning health, religion, caste, sexual orientation, political opinions, trade-union membership, biometric or genetic data — and you should not send it to us unless we have specifically asked for it for a lawful purpose. Where a client contract or a statutory obligation requires such data, we collect only what is necessary, and handle it with additional access restrictions.

3.6 Children’s data

The Website and our services are directed at businesses and are not intended for children. We do not knowingly collect personal data of a child, meaning a person below eighteen (18) years of age, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child’s personal data has been provided to us, contact the Grievance Officer and we will delete it. Where the DPDP Act requires verifiable parental consent for processing a child’s data, we will obtain it before processing.

4. How we collect personal data

4.1 Directly from you — when you complete a form on the Website, email or call us, meet us at an event or trade show, apply for a role, sign a contract, or correspond with us in the course of an engagement.

4.2 Automatically — through cookies, server logs and analytics when you use the Website, as described in our Cookie Policy.

4.3 From third parties and public sources — job boards and recruitment platforms where a candidate has made a profile available for that purpose; professional networks such as LinkedIn; client referrals and introductions; publicly available company registries and websites; your employer where it nominates you as a point of contact; and background-verification agencies engaged with the relevant individual’s knowledge.

4.4 From our clients — where a client provides data to us so that we can deliver the services, including data about its own personnel, customers or end users. That data is handled as described in Clause 5.

5. Data we process on behalf of our clients

5.1 Many of our services involve handling data that belongs to a client — for example customer-support records, e-commerce order data, brand-monitoring records, test data, or the client’s own employee or candidate data.

5.2 In relation to that data, the client is the data fiduciary or controller, and StaffCloud acts as a data processor. We process it only on the client’s documented instructions and only to deliver the agreed services. We do not use it for our own purposes, do not sell it, and do not disclose it except as the client instructs or as the law requires.

5.3 The client is responsible for establishing a lawful basis for that processing, for issuing the required notices to the individuals concerned, and for responding to their rights requests. Where we receive a request that relates to a client’s data, we will refer the individual to the client and assist the client in responding.

5.4 The detailed terms governing this processing — including security measures, breach notification, sub-processing, audit rights, cross-border transfer mechanisms and deletion on termination — are set out in the applicable service agreement or data-processing addendum. Those terms prevail over this policy in respect of client data.

6. Why we use personal data, and our legal grounds

6.1 The table below sets out our purposes and, for each purpose, the “certain legitimate use” or consent ground we rely on under the DPDP Act and the corresponding lawful basis under the GDPR where it applies.

6.2 Where we rely on consent, you may withdraw it at any time, with effect for the future, by contacting the Grievance Officer or by using the unsubscribe or cookie-preference controls provided. Withdrawal does not affect processing already carried out, and may mean we can no longer provide a service that depends on that data.

6.3 Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms. You may ask us for information about that assessment.

6.4 We will not use your personal data for a materially different purpose without first informing you and, where required, obtaining your consent.

7. Artificial intelligence and automated processing

7.1 We use software tools, including artificial-intelligence and automation tools, to support our work — for example to draft and review documents, summarise records, assist with code and support responses, and to triage enquiries.

7.2 We do not make decisions that produce legal effects concerning you, or otherwise significantly affect you, based solely on automated processing without human involvement. Candidate shortlisting, hiring recommendations and service decisions are reviewed by a person before they take effect.

7.3 We do not use client Confidential Information or personal data received from clients to train publicly available artificial-intelligence models, and we require the same of our subcontractors.

8. Who we share personal data with

8.1 We share personal data only as necessary, and with the following categories of recipient:

1. our Personnel, on a need-to-know basis, bound by confidentiality obligations and access controls;
2. our clients, where you are a candidate we present, or where you are a point of contact for a client engagement;
3. service providers and sub-processors who support our operations, such as cloud hosting and infrastructure providers, email and productivity platforms, project-management and helpdesk tools, communication tools, website hosting, analytics providers, payroll and accounting providers, and background-verification agencies — each engaged under written terms requiring confidentiality and appropriate security;
4. subcontractors engaged to deliver part of a service, on the terms set out in Clause 25.3 of our Terms and Conditions;
5. professional advisers — auditors, chartered accountants, lawyers, insurers and bankers — where necessary for their professional services;
6. authorities, including tax, regulatory, law-enforcement and judicial authorities, where disclosure is required by law or necessary to establish or defend legal claims; and
7. an acquirer or successor, in connection with a merger, acquisition, reorganisation or sale of all or part of our business, subject to confidentiality and to this policy continuing to apply.

8.2 We do not sell personal data, and we do not share it for cross-context behavioural advertising or for any third party’s independent marketing purposes.

8.3 A current list of the material sub-processors used for a client engagement is available to that client on request.

9. International transfers

9.1 We are based in India and our services are delivered from India. If you are located outside India, the personal data you provide will be transferred to, stored in, and processed in India, and may be accessed by our Personnel there.

9.2 Some of the service providers listed in Clause 8.1(c) are located outside India, including in the United States and the European Union, so personal data may be transferred to and stored in those countries.

9.3 We make these transfers subject to appropriate safeguards:

1. transfers out of India are made in accordance with Section 16 of the DPDP Act and any restrictions notified by the Central Government;
2. where personal data protected by the GDPR is transferred to India or to another country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Agreement or Addendum, together with transfer-impact assessments and supplementary technical and organisational measures where appropriate; and
3. where a client requires a specific transfer mechanism, it is recorded in the service agreement or data-processing addendum.

9.4 You may request a copy of the relevant safeguards by writing to the Grievance Officer.

10. How long we keep personal data

10.1 We keep personal data only as long as necessary for the purpose for which it was collected, and then for any further period required by law or needed to establish or defend legal claims.

10.2 Where data no longer needs to be identifiable, we may anonymise or aggregate it instead of deleting it, and may keep and use the anonymised data indefinitely.

10.3 Backups are retained on a rolling cycle and are overwritten in the ordinary course. Data may persist in a backup for a short period after deletion from live systems.

11. How we protect personal data

11.1 We maintain reasonable technical and organisational security measures appropriate to the risk, including:

1. role-based access control and the principle of least privilege, with access reviewed periodically;
2. individual named accounts, strong password requirements and multi-factor authentication on business-critical systems;
3. encryption of data in transit using TLS, and encryption at rest where the platform supports it;
4. network and endpoint protection, patching and anti-malware controls on company devices;
5. confidentiality undertakings from all Personnel, and privacy and security awareness training;
6. restrictions on the use of removable media and personal devices for client data;
7. written security and confidentiality obligations imposed on service providers and subcontractors;
8. logging and monitoring of access to systems holding client data; and
9. documented procedures for identifying, escalating and responding to security incidents.

11.2 No system can be guaranteed secure. We do not warrant absolute security, and transmission of information over the internet is at your own risk.

11.3 If a personal-data breach occurs, we will act promptly to contain and investigate it, will notify the Data Protection Board of India and affected individuals where the DPDP Act requires, will notify the relevant supervisory authority and individuals where the GDPR requires, and will notify affected clients without undue delay in accordance with the applicable service agreement.

11.4 We will never ask you for your password, a full card number or a one-time password by email or telephone. We will never notify a change in our bank details by email or telephone alone — verify any such message with the Grievance Officer on the number in Clause 2 before acting on it.

12. Your rights

12.1 If you are in India — Digital Personal Data Protection Act, 2023

As a Data Principal, you have the right to:

1. obtain confirmation of whether we process your personal data, and a summary of that data and of our processing activities;
2. obtain the identities of other data fiduciaries and processors with whom your personal data has been shared, and a description of the data shared;
3. have inaccurate or misleading personal data corrected, incomplete data completed, and data updated;
4. have your personal data erased, unless retention is necessary for a specified purpose or for compliance with law;
5. withdraw consent previously given, at any time, with the same ease with which it was given;
6. nominate another individual to exercise your rights in the event of your death or incapacity; and
7. have a readily available means of grievance redressal, and to escalate to the Data Protection Board of India if you are not satisfied with our response.

You also have a duty under the DPDP Act not to furnish false particulars, impersonate another person, or file a frivolous or false complaint.

12.2 If you are in the EU or the UK — GDPR

You have the right to request access to your personal data, rectification, erasure, restriction of processing, and data portability; to object to processing based on legitimate interests and to direct marketing; to withdraw consent; not to be subject to a decision based solely on automated processing with legal or similarly significant effects; and to lodge a complaint with your national supervisory authority or, in the United Kingdom, the Information Commissioner’s Office.

12.3 If you are in California — CCPA as amended by the CPRA

You have the right to know the categories and specific pieces of personal information we have collected, the sources, our purposes and the categories of recipients; to request deletion; to request correction; to opt out of the sale or sharing of personal information and of the use of sensitive personal information beyond permitted purposes; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising. You may use an authorised agent, with proof of authorisation.

12.4 Where you are a candidate or client contact

If the data relates to an engagement, some rights may be limited where we are required to retain records for statutory, contractual, audit or legal-claim purposes. We will explain any limitation when we respond.

13. How to exercise your rights

13.1 Send your request to the Grievance Officer at shailesh@staffcloud.net, or by post to the registered office in Clause 2. Please state the right you wish to exercise and enough detail for us to identify your records.

13.2 We may ask for information to verify your identity before acting on a request, so that we do not disclose personal data to the wrong person. We will not use that information for any other purpose.

13.3 We aim to acknowledge requests within seven (7) days and to respond substantively within thirty (30) days. Where the GDPR applies, we will respond within one month, extendable by two further months for complex or numerous requests, with notice to you. There is no fee, unless a request is manifestly unfounded or excessive, in which case we will tell you before proceeding.

13.4 Where we are a processor acting for a client, we will forward your request to that client and assist it in responding.

13.5 If you are not satisfied with our response, you may complain to the Data Protection Board of India, to your supervisory authority in the EU, to the Information Commissioner’s Office in the UK, or to the California Privacy Protection Agency, as applicable to you. We would appreciate the opportunity to address your concern first.

14. Cookies and similar technologies

Our use of cookies, analytics and similar technologies on the Website, the specific cookies set, their durations and how to control them, is described in our Cookie Policy, which forms part of this policy.

15. Third-party websites and platforms

The Website may link to third-party sites, and our services may operate on third-party platforms. Those third parties control their own data practices, and this policy does not apply to them. Review their privacy policies before providing personal data to them.

16. Marketing communications

16.1 We may send business-development and marketing communications to business contacts about our services, capabilities, events and publications.

16.2 Every marketing email includes a means to unsubscribe. You may also opt out at any time by writing to the Grievance Officer. Opting out of marketing does not stop service-related, contractual, security or statutory communications.

16.3 We do not use automated dialling or send commercial communications in breach of applicable telecom and anti-spam regulations, and we honour do-not-disturb registrations where they apply.

17. Changes to this policy

17.1 We may update this policy to reflect changes in law, in our services or in our practices. The current version is always published on the Website with the “Last updated” date shown at the top.

17.2 Where a change materially affects how we use your personal data, we will provide prominent notice on the Website and, where required, seek your consent before the change applies to data already collected.

18. Governing law

This policy is governed by the laws of India. Disputes arising out of it are subject to the dispute-resolution and jurisdiction provisions of our Terms and Conditions, without prejudice to any statutory right you have to complain to a supervisory or regulatory authority in your own jurisdiction.

19. Contact us

Shailesh Agrawal
Managing Director and Grievance Officer
StaffCloud Services Private Limited
C/o Shri Shailesh Purushottam Agrawal, Balaghat Road, Gondia, District Gondiya, Maharashtra 441601, India
Telephone: +91 93268 11779
Email: shailesh@staffcloud.net