Privacy notice

TALPRO INDIA PRIVATE LIMITED ("Talpro India", "we", "us"), CIN U74999KA2020PTC135946, GSTIN 29AAHCT9485A1ZX, registered office 12th Main Road, 4th Floor, No. 0741/A, Manipal County Rd, opposite Star Market, B Block, AECS Layout, Singasandra, Bengaluru, Karnataka 560114, India, is the data fiduciary (DPDP Act 2023 §2(i)) and controller (GDPR Art 4(7)) for personal data collected through talproindia.com and the enquiries, reports, assessments and newsletter you request from it.

This notice is given under section 5 of the Digital Personal Data Protection Act, 2023 and Articles 13–14 of the GDPR for visitors from the EU/UK. It applies to the website only. Candidate, payroll and client-contract processing for staffing engagements is governed by the notice you receive when that engagement starts.

हिन्दी में पढ़ें — a summary of this notice in Hindi (Eighth Schedule, DPDP §5(3)).

Each category is collected for the purposes shown and nothing else. We do not sell personal data, and we do not use it for automated decisions with legal effect.

Where the basis is consent, you give it by ticking an unticked box on the form (or a switch in the cookie banner) after reading this notice, and you can withdraw it at any time (section 6). Where the basis is legitimate interest, it is limited to replying to a business contact who wrote to us; you can object at any time.

Inside Talpro, only the engagement and privacy team members who need to answer you see your data. Outside Talpro, these processors act on our instructions:

We also disclose data when a law, court order or regulator requires it, and to professional advisers under confidentiality. We never share your data with other clients or candidates, and we do not share candidate data with any employer without telling the candidate first.

Our servers and database are in Mumbai, India. Some processors listed above run in the United States. Personal data leaves India only to those processors, under their Standard Contractual Clauses and, for analytics tools, only after you switch them on in the cookie banner. Under section 16 of the DPDP Act 2023 transfers are permitted to any country the Central Government has not restricted by notification; none of the countries above are restricted at the date of this notice. For visitors in the EU/UK, the transfer basis is the Standard Contractual Clauses (GDPR Art 46(2)(c)).

These windows are enforced by an automated job that runs every night (03:40 UTC) and logs what it removed. The table is generated from the same configuration the job reads, so what we promise is what it does.

Backups. Nightly database dumps are kept for 14 days, pgBackRest keeps 2 full backup sets, and an offsite mirror is kept for 30 days. Data erased or anonymised in the live database leaves every backup on that cycle (at most 30 days).

Server access logs rotate after 7 days. Analytics events (only with your consent) are kept by the analytics processors for up to 12 months.

• Access — A copy of the personal data we hold about you, the purposes, and who we shared it with. (DPDP §11 · GDPR Art 15)
• Correction — Fix inaccurate, incomplete or out-of-date data. (DPDP §12 · GDPR Art 16)
• Erasure — Delete your data unless a law requires us to keep it. We anonymise the enquiry record and delete the rest. (DPDP §12 · GDPR Art 17)
• Withdraw consent — Stop any processing that rests on your consent, as easily as you gave it. Earlier processing stays lawful. (DPDP §6(4) · GDPR Art 7(3))
• Nominate — Name a person to exercise these rights for you if you die or become incapacitated. (DPDP §14)
• Portability — Receive the data you gave us in a machine-readable JSON export. (GDPR Art 20 (offered to everyone))
• Complain — Raise a grievance with the officer below first; if unresolved, complain to the Data Protection Board of India, or to your EU/UK supervisory authority. (DPDP §13 · GDPR Art 77)

How to use them. Use the privacy request form or email the Grievance Officer (section 8). We may ask you to confirm the email address the data was given from. We acknowledge within 48 hours, resolve within 30 days, free of charge. If we refuse a request we tell you why and how to complain.

How to withdraw consent. Newsletter and marketing: click "Unsubscribe" in any email, or use the unsubscribe page. Analytics cookies: open Cookie choices and switch off. Everything else: choose "Withdraw consent" on the request form. Withdrawal is as easy as consent and does not affect processing that already happened.

Essential cookies (session, CSRF token, your consent choice) are always on. Optional analytics — PostHog, Google Analytics 4, Microsoft Clarity — load only after you switch them on in the cookie banner; until then no analytics script, cookie or pixel is set. When on, they receive pseudonymous page views, clicks, web-vitals and device class, with the IP address dropped before storage, and they run in the United States under Standard Contractual Clauses.

We run no advertising or social pixels today. The "Marketing" switch exists so that, if that ever changes, nothing loads without your separate yes. You can change either switch any time from Cookie choices in the footer; your choice is kept on this device for 12 months or until this notice changes.

If you are not satisfied. Data Protection Board of India: Once the Board’s portal is live, complaints can be filed there under DPDP §18; until then, write to the Grievance Officer and we will escalate on your behalf. Your EU/UK supervisory authority: GDPR Art 77 — the authority in the member state where you live or work; the UK ICO for UK residents.

See also the grievance redressal mechanism for non-privacy complaints.

talproindia.com is a business-to-business service for adults (18+) acting for an employer or as a candidate for professional roles. We do not knowingly collect data from children, do not serve behavioural advertising, and do not track or profile anyone under 18 (DPDP §9). If you believe a child has given us data, write to the Grievance Officer and we will delete it.

• TLS 1.2+ everywhere with HSTS preload; TLS 1.0/1.1 refused.
• Database reachable only on localhost and the private management network of a Mumbai VPS; the application role has no superuser rights; nightly backups on the cycle in section 5.
• Access on a need-to-know basis with named accounts; admin endpoints require a bearer token and are never public.
• Emails and IPs in consent records are stored as SHA-256 hashes; server logs never contain form contents and mask addresses.
• Breach handling: the Grievance Officer notifies the Data Protection Board of India and affected individuals without delay (DPDP §8(6)) and EU/UK authorities within 72 hours (GDPR Art 33).

Each version carries a date and an identifier; the identifier is stored on every consent you give so we can show which text you saw. Material changes are posted here and, where we hold your email for a consented purpose, sent to you before they take effect. Earlier consent is re-requested by the cookie banner when the version changes.

Current version: 2026-09-18 · Last updated: 18 September 2026.