Privacy Notice for Career Applicants

Vastoco Private Limited is the data fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This notice is for career applicants and is read together with our general Privacy Policy.

Vastoco Private Limited, CIN U63122UW2026PTC259452, registered office at 38, Lokendra Puri, Gari Bhadauriya, Agra, Uttar Pradesh 282002, India. General contact: info@vastoco.in. Grievances and privacy requests: grievance@vastoco.in.

• Candidate account: name, email, mobile number and password hash. If you use Google Sign-In, your name, email and Google ID.
• Application: your resume, work and education history, portfolio and LinkedIn links, and your answers to the role's questions.
• Hiring records: interview notes, assessment results, application status and our messages to you.
• Technical data: IP address, device and browser details and security logs.

Aadhaar, PAN, bank or card details, passwords, or details about your caste, religion, health or family. We do not need them to consider your application. If they appear in your resume, we may remove them.

• To assess your application, contact you, schedule interviews and make a hiring decision.
• To keep records of our hiring process and answer questions about it.
• To run checks you agreed to, such as education or employment verification.
• To keep the portal secure and prevent fraud and misuse.
• To keep you in a talent pool for future roles, only if you agree.

• Only authorised Vastoco reviewers and interviewers for the role can open your application.
• Our service providers for hosting, storage, database and email handle it for us, and may use it only to provide that service.
• A verification agency receives your details only if you have agreed to a background check.
• We do not sell your data and do not give it to other employers or recruiters. We may disclose it to courts or authorities when the law requires.

• If you are not hired, we keep your application for up to 12 months after the role is closed or the decision is made, and then delete or anonymise it.
• If you agree to join our talent pool, we keep your details for up to 12 months and then ask you again.
• If you are hired, your data moves to your employment records, which are covered by a separate notice given to you at joining.
• You may ask us to delete your application earlier.

We use your data to assess your application because you chose to apply. You may withdraw your consent at any time. If you do, we will stop considering your application and delete your data, except where the law requires us to keep something. Withdrawing does not affect what we did earlier.

• Ask for a summary of the personal data we hold about you.
• Ask us to correct or complete it, or to erase it where we have no legal reason to keep it.
• Withdraw your consent, and nominate a person to exercise your rights if you die or cannot act.
• Make a complaint about how your data was handled.

Write to grievance@vastoco.in from the email in your candidate account. We aim to reply within 30 days.

You must be 18 or over to apply. We do not knowingly collect data from children.

Your resume and application are stored in private, access-controlled storage and are open only to authorised reviewers. If a personal data breach happens, we will inform affected people and the Data Protection Board of India as the law requires.

We may update this notice when our services or the law change. The new effective date will be shown at the top. We will give reasonable notice of a material change, and where the law requires your fresh consent we will ask for it. A change does not reduce any right you already have under the law.

If you have a complaint about this document, your data or how you were treated on Vastoco, write to our Grievance Officer. You can also use the Grievance Redressal page to see the full process and where to escalate.