At Retail Career, ensuring the safeguarding of your privacy is of utmost importance. We prioritize the establishment of trust by handling your personal data with caution and transparency, while also respecting your privacy rights. When handling your personal data, we comply with the Digital Personal Data Protection, India and General Data Protection Regulation and other data protection laws, and we consistently adhere to the highest standards of privacy.

Retail Career, a division of Evoxel Career Management Private Limited, utilizes this Data Protection Notice to outline the methods by which we gather, handle, and safeguard personal data during the recruitment and onboarding processes for employees, as well as in collaboration with our employment partners around the country.

Two objectives of data processing and types of data that have been processed. We exclusively gather and handle personal data solely for explicitly defined objectives. Displayed below is a comprehensive list of the many categories of personal data that we handle for each specific purpose.

Some of the personal data that has been processed may fall under the category of special categories of personal data.

• The processing of job applications and the assessment of candidates
• The candidate's name and contact information
• The candidate's email address
• Details of the candidate's Pan Card and Aadhar Card at the time of onboarding
• Information provided in the candidate's job application or CV
• Language skills, education, and other relevant information regarding the candidate's abilities and qualifications
• Information gathered during the recruitment process, such as video interviews, interview notes, and references
• Possible assessments of suitability and personality
• Possible credit and security reports

Recruitment communication

• Contact details, including permanent and current address, email address, phone number, WhatsApp number, and social media mobile number.

Data protection legislation mandates that the processing of personal data must be grounded on the legal principles outlined in the Digital Personal Data Policy 2023. We handle your personal data in accordance with the following legal grounds:

Legitimate interest

The concept of legitimate interest serves as a lawful justification for the processing of employment applications and the assessment of candidates. When we rely on legitimate interest, we assess and take into account the importance of the interest in accordance with data privacy laws, making sure that it does not provide an unjustified risk or obstacle to you.

Consent

Under some circumstances, we only handle your personal data if you have provided explicit approval in advance. Personal data processing, such as that relating to the talent community and email newsletter, is always contingent upon your explicit consent. Furthermore, during the onboarding process for employment with any organization where you have been selected, there is a requirement to collect documentation for background checks and references.

Legal Obligation

There are four primary sources from which personal data can be obtained. Personal data is primarily obtained directly from individuals. Under some circumstances mandated by laws, we may also gather personal information from external sources, such as official registries. For instance, if your job tasks involve carrying out a security or credit investigation, data is gathered from authorized databases with your explicit permission. Prior notice is given if personal data is obtained from official registries. We may also obtain personal data from other entities within our group, as explained in the section titled "Transfers of personal data".

We handle personal data with strict confidentiality and never engage in the unnecessary sale, rental, or disclosure of your personal data to external entities.

5.1 Personal data transfers

A data transfer occurs when the data controller (referred to as Evoxel in this case) provides personal data to a third party for their independent use. Evoxel has the ability to transmit data to the entities listed below:

(1) Personal data is given to the client company only to the amount required for the assignment.

(2) The customer firm must belong to either the Retail Career or Evoxel Career Management private limited companies. If you, for example, desire to apply for a different position within the group, your personal information can be transmitted to the new firm within the group.

5.2 Personal data disclosures

Personal data disclosure occurs when a data controller shares personal data with a third party who does not treat the data for their own purposes. For instance, when a specific business procedure, such the assessment of suitability, is delegated to an external entity, the personal information associated with the business activity mig0ht be revealed to the third party.

A portion of the personal data is processed and stored outside of India, such as when service providers are situated outside of India. The service providers have made a contractual commitment to ensure a sufficient level of data protection in all their processing activities. At Retail Career, your data is securely stored and safeguarded on the Godaddy server.

We ensure the security of your personal data by implementing suitable technical and organizational measures to prevent loss, unauthorized access, and any other kind of misuse. Some examples of such precautions include the implementation of firewalls, utilization of encryption techniques, creation of backup copies, and establishment of secure data rooms.

Internal measures, including technological and physical access control, limited access credentials, and monitoring rules, are used to control access to your personal data. Only authorized personnel, such as workers and employers, have access to and process your personal data in accordance with their designated roles.

It refers to the process of using computer algorithms and artificial intelligence to make decisions without human intervention. It is the process of making decisions without any human involvement, just relying on algorithms. Automated decision-making is not involved in the processing of your personal data at Retail career or Evoxel.

We retain your personal data for the duration necessary for the data processing purposes, unless a legal need mandates a longer retention period.
Once the retention period is finished, your personal data is either overwritten in the backup copies and system background or transformed into an unrecognizable form that prevents the identification of an individual. The candidate profile, job application, and CV are automatically removed from the system three years after the individual's most recent update.

9.1 The entitlement to receive information

You are entitled to receive information regarding the handling of your personal data in a brief, clear, understandable, and easily available manner, expressed in straightforward and simple language. The objective of this privacy notice is to elucidate the right to be informed and facilitate your comprehension of our procedures for handling your personal data. If you have any additional questions after reading this notice, please contact us using the information provided in the "Contact information" section.

9.2 Access rights

You are entitled to receive confirmation of the personal data we process about you. Thus, you may assess and verify that the data is being treated in accordance with the law. Furthermore, you are entitled to request and obtain a duplicate of the personal information that we handle. The next section, under "Exercising data subject rights," contains instructions on how to seek a copy of your data.

9.3 The entitlement to data portability

Under some circumstances, you are entitled to obtain the personal information you have shared with us in a manner that is organized, widely accepted, and can be read by machines. Additionally, you have the option to transfer this data to another entity if you so choose. This right is applicable when we handle your personal data with your consent or as part of a contractual agreement, and the data processing is conducted electronically.

9.4 The entitlement to rectification

Our objective is to ensure that personal data is kept up-to-date and accurate, and to promptly remove any false, inadequate, or incorrect personal data. You are entitled to request the correction of any inaccurate personal data pertaining to you and the addition of any insufficient personal data.

9.5 The entitlement to limit the handling of personal data

The limitation on processing implies that the personal data, which is subject to the restriction, can only be processed under specific circumstances. These circumstances include:

• obtaining your consent,
• processing for the purpose of legal claims
• protecting the rights of another individual or entity, or
• for reasons of significant public interest of the Indian Government.

The right to question the correctness of personal data exists in the following conditions.

• In these instances, the processing of personal data will be limited for a specific duration to allow the controller to verify its accuracy.
• The processing is deemed illegal, but the data subject objects to the deletion of the personal data and instead requests that its use be restricted.
• The data controller no longer requires the personal data for processing, but it is necessary for the data controller to have it for the purpose of establishing, exercising, or defending legal claims.
• The individual whose data is being processed has expressed their objection to the processing of their personal data for purposes other than direct marketing, and is currently awaiting confirmation on whether the legitimate reasons of the data controller outweigh those of the individual

9.6 The entitlement to oppose the processing of data

Under specific circumstances, you possess the entitlement to raise an objection to the processing of your data by formally requesting that your data be completely exempt from any form of processing.

(i) If the data is being processed for the purpose of performing a task that is carried out for reasons of public interest, in the exercise of official authority, or for the compelling legitimate interests pursued by us or a third party, you have the right to object to the processing based on reasons related to your specific situation.

(ii) If these situations arise, the processing should be halted unless the controller can provide strong and valid reasons for continuing the processing that outweigh the interests, rights, and freedoms of the individual whose data is being processed. Alternatively, the processing may be essential for the purpose of initiating, carrying out, or defending legal claims.

(iii) If your personal data is being used for direct marketing, you have the right to object to this processing without needing to provide any specific reasons. Once you object, the data cannot be used for direct marketing purposes anymore.

9.7 The entitlement to have personal data erased and forgotten

Under specific circumstances, individuals possess the entitlement to exercise the right to be forgotten, which entails the complete erasure of their personal data. This entitlement arises in situations such as when the personal information is no longer required for the original objectives it was gathered or processed, when the processing was dependent on consent and you revoke your consent, or where the personal data has been unlawfully treated.

9.8 Withdrawal of consent

If your personal data is being processed with your consent, you have the right to revoke your consent at any given moment. If you revoke your consent, the processing of personal data will cease unless there is another legal justification, such as a legal requirement, that necessitates the continuation of data processing.

9.9 The entitlement to submit a grievance to a regulatory body

Furthermore, you possess the entitlement to lodge a formal grievance with a regulatory body if you perceive that our privacy protocols are not in compliance with the General Data Protection Regulation. An individual may submit a complaint if the rights outlined in this notice are not adequately enforced. The Office of the Data Protection Ombudsman serves as the supervisory authority in India.

9.10 Engaging in the exercise of data subject rights

If you have any inquiries regarding the aforementioned rights or if you would want to review your personal data or exercise your rights in any other way, please contact us. The contact details of our data protection officer are located at the conclusion of this notice.

9.11 Payment for providing data

Exercising your rights typically does not need any payment. Under some circumstances as outlined by legislation, such as when you ask for multiple duplicates of your personal information, we may need a fee that corresponds to the expenses incurred in fulfilling your request in advance.

9.12 Timelines

We promptly address all requests, ensuring a maximum response time of one month from the date of receipt. We will provide you with information regarding the actions we have implemented to fulfill your request. In the event that we need to reject your request, we will notify you of the refusal and provide the reasons for it within one month of receiving the request.

If there are several requests or if they are complex, we may need an additional period of up to 3 months to implement the request. We would like to notify you that there is a requirement for an extension of two months in order to provide a thorough explanation for the delay.

To make a complaint with the supervisory authority, please refer to the website of the Office of the Data Protection Ombudsman at https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf for additional information.
The entity responsible for managing and processing data, as well as the contact details associated with it.

Appoint of Data Controller

The data controller is the entity responsible for determining the methods and purposes of processing personal data. Evoxel, as a retail company, establishes the objectives and criteria for handling the personal data of its workers, including yours. Evoxel is the entity responsible for processing personal data, acting as the data controller.

Internal Data Protection Expert

Retail Career and Evoxel have designated an internal data protection expert as their data protection officer. The data protection officer oversees the handling of personal data, provides guidance to employees on data protection issues, and serves as a point of contact for inquiries and concerns related to data subject rights.

The contact information of the data controller, specifically the Data Protection Unit, can be reached at info@retailcareer.org.

Our privacy practices are always being enhanced, and as a result, this privacy notice will be periodically updated. Updates may result from modifications in legislation. We advise you to revisit this page in order to stay updated on any potential alterations. If necessary, we may also notify you directly regarding any modifications to our privacy protocols.