Privacy Policy

TalentProof is a career acceleration and talent verification technology platform operated by Basmangimat Technologies Private Limited (“BTPL”, “we”, “us”, “our”), a company incorporated under the Companies Act, 2013.

TalentProof is a brand operated by Basmangimat Technologies Private Limited. References to “TalentProof” in this Policy mean Basmangimat Technologies Private Limited.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), BTPL is the Data Fiduciary in respect of the personal data described in this Policy. You are the Data Principal.

This Policy applies to personal data we process through:

• the TalentProof website at talentproof.in;
• the TalentProof web application at app.talentproof.in and its supporting backend services at api.talentproof.in;
• our WhatsApp Business messaging channel (see Clause 9); and
• email, telephone and other communications you have with us in connection with the Platform.

Together, these are the “Platform”.

This Policy does not cover:

• Internal BTPL systems used only by our own personnel, which are governed by our internal data protection and information security policies;
• Recruiter and Institution systems. Once we share your personal data with a Recruiter or an Institution in accordance with this Policy, that organisation processes it as an independent Data Fiduciary under its own privacy policy. We do not control what they do with it, and we cannot recall it. This is explained in Clause 7;
• WhatsApp and Meta. Your use of WhatsApp itself is governed by WhatsApp’s own terms and privacy policy, not ours;
• Third-party websites we may link to.

The Platform is not available to persons under the age of 18 years.

We require every user to confirm their date of birth at registration and we do not permit account creation by a person who is under 18. We do not knowingly collect or process the personal data of a child.

We do not carry out tracking, behavioural monitoring or targeted advertising directed at children.

If we become aware that a person under 18 has created an account or that we hold a child’s personal data, we will suspend the account and erase the data, except where we are required by law to retain it. If you believe we hold personal data relating to a person under 18, contact our Grievance Officer under Clause 12 and we will act on it.

Institutions must not upload, submit or provide to us the personal data of any student who is under 18. This obligation is also written into our Institution Partnership Agreement.

4.1 If you are a Student or Candidate

4.2 If you are an Institution user

Your name, designation, official email address and mobile number; the Institution you represent; your account credentials; your activity on the Platform, including student records you upload, job requests you review, approve or forward, and communications with us and with Recruiters.

4.3 If you are a Recruiter or Employer user

Your name, designation, official email address and mobile number; the organisation you represent; your account credentials; job postings and organisation information you publish; candidate shortlists, application decisions, feedback and interview records you create; and communications with us, with Institutions and with Candidates.

4.4 If you are a website visitor

Technical and usage data as described above, and anything you voluntarily submit through a contact, demo-request or enquiry form.

4.5 What we do NOT collect

We do not collect or ask for:

• Aadhaar numbers, Aadhaar-based authentication, or Aadhaar eKYC. We do not have statutory authorisation to do so and we do not do it.
• Bank account details, card details or UPI credentials from Students. Students are not charged for the Platform.
• Caste, religion, political opinion, sexual orientation or health information, except where you voluntarily disclose a disability in order to request a reasonable accommodation or to access a reservation or benefit lawfully available to you.
• Biometric data.
• Passwords in readable form. Passwords are stored in hashed form only.

Please do not submit any of the above to us. If you do, we may erase it.

We process personal data only for the purposes below. Where we rely on your consent, you gave it — or will give it — through a clear, unticked, affirmative action, and you can withdraw it at any time under Clause 10.

We do not:

• sell your personal data;
• share your personal data with advertisers or use it for third-party advertising;
• use your personal data to train artificial intelligence or machine learning models, except that we may use aggregated and de-identified data that cannot reasonably be linked back to you for improving matching and search on the Platform.

Our consent notice is presented separately from this Policy at the point of collection. It is itemised — you can see, purpose by purpose, what you are agreeing to.

We commit that:

• consent is obtained through a clear affirmative action. No pre-ticked boxes;
• optional purposes are genuinely optional. WhatsApp messaging is optional. Declining it does not prevent you from using the Platform;
• we do not use false urgency, confusing wording, or interface design that nudges you into consenting or that makes withdrawal harder than consenting;
• the consent notice is available in English, and we will make it available in other languages listed in the Eighth Schedule to the Constitution of India on request to the contact in Clause 12;
• withdrawing consent is as easy as giving it (Clause 10).

Once the Consent Manager framework under the DPDP Rules becomes operational, you may also be able to give, manage, review and withdraw consent through a registered Consent Manager. We will update this Policy if and when we integrate with one.

7.1 With Recruiters and Employers

This is the most important disclosure in this Policy. Please read it.

• We share your profile, education data, resume, assessment results and application details with a Recruiter when you apply to that Recruiter’s opportunity, or when you take an affirmative step to make your profile visible to Recruiters.
• Once shared, the Recruiter processes your personal data as an independent Data Fiduciary under its own privacy policy and under its agreement with us. We require Recruiters to use it only for evaluating you for the relevant role, to keep it confidential and secure, and not to sell it or use it for unrelated purposes.
• We cannot recall data already shared. If you want a Recruiter to erase your data, you must ask that Recruiter. We will tell you which Recruiters received your data if you ask us.

7.2 With Institutions

• If you registered through an Institution, or linked your account to it, we share with that Institution your registration status, verification status, profile completeness, applications made, assessment participation and placement outcomes — so that it can carry out its placement function.
• We share this with authorised Institution personnel only.
• Your Institution processes this as an independent Data Fiduciary.

7.3 With our service providers (Data Processors)

We use third parties to run the Platform. They process personal data only on our instructions, under written contract, only for the purpose we specify, and are required to maintain reasonable security safeguards and to erase or return data at the end of the engagement.

Categories used:

A current list of our named service providers is published at https://talentproof.in/sub-processors and is kept up to date. We may add or replace a provider within these categories; material changes will be reflected in that list.

7.4 Legal and other disclosures

We may disclose personal data where we are required or permitted to do so by law — to a court, tribunal, regulator, the Data Protection Board of India, or a law enforcement agency acting under lawful authority; to enforce our terms; to protect the rights, safety or property of BTPL, our users or the public; or in connection with a merger, acquisition, restructuring or transfer of business, in which case the recipient will be bound by obligations no less protective than this Policy and you will be notified.

7.5 With your Institution’s or Recruiter’s other users

Where an Institution or Recruiter has multiple authorised users on the Platform, those users may see data shared with that organisation, subject to the access controls the organisation configures.

All personal data we process is stored and processed on servers located in India.

We do not currently transfer personal data outside India. If this changes, we will update this Policy before any transfer begins, and will comply with the restrictions applicable under the DPDP Act and the DPDP Rules, including any restriction the Central Government notifies in respect of a particular country or territory.

We use the WhatsApp Business Platform to send you service-related messages. This clause explains exactly how.

9.1 It is opt-in. We will send you WhatsApp messages only if you have given us your mobile number and separately opted in to WhatsApp communication. Opting in is optional. If you do not opt in, we will communicate with you by email and in-app notification instead, and you can use the Platform normally.

9.2 What we send. Service and transactional messages only, such as:

• one-time passwords and account verification codes;
• application status updates and interview or assessment invitations;
• reminders about an assessment, interview or placement drive;
• announcements from your Institution about a placement drive;
• responses to your support queries.

9.3 What we do not send. We do not send you promotional or marketing messages on WhatsApp unless you have given a separate, specific opt-in for that purpose. We do not send WhatsApp messages to any person under 18. We do not share your WhatsApp number with Recruiters or advertisers.

9.4 What data is involved. Your mobile number, your name, and the content of the message — which may include your application, assessment or interview details. Our WhatsApp Business Solution Provider processes this as our Data Processor.

9.5 How to stop. Reply STOP to any WhatsApp message from us, change the setting in your account, or write to the contact in Clause 12. We will act on it promptly and, in any event, within the timeline in Clause 10.

9.6 WhatsApp itself. WhatsApp is operated by Meta, not by us. Your use of WhatsApp, and Meta’s processing of your data as a WhatsApp user, is governed by WhatsApp’s and Meta’s own terms and privacy policies. We do not control them.

As a Data Principal under the DPDP Act, you have the following rights. To exercise any of them, contact us as set out in Clause 12, or use the controls in your account settings where available. Step-by-step instructions to close your account and erase your data are at https://talentproof.in/delete-my-data.

Timelines. We will acknowledge a request or grievance within 24 hours and respond substantively within 15 days of receipt. Where a request is complex, we will tell you within that period why more time is needed and when you can expect a response.

Verification. We may ask you to verify your identity before we act, to make sure we do not disclose your data to someone else. We will not use that verification information for any other purpose.

Your responsibilities. Please give accurate information and do not impersonate anyone. Making a false or frivolous complaint, or furnishing false particulars, may have consequences under the DPDP Act.

Consequences of withdrawal or erasure. If you withdraw consent for the core purposes in Clause 5 or ask us to erase your data, we will not be able to keep your account or profile active, and pending applications may not proceed.

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as law requires.

Backups are purged on a rolling cycle; data deleted from the live Platform may persist in backups for up to 30 days before being overwritten.

We have appointed a Grievance Officer, who is also the person to contact with any question about our processing of your personal data.

We will acknowledge your complaint within 24 hours and dispose of it within 15 days of receipt.

If you are not satisfied. If we do not respond within the applicable period, or you are not satisfied with our response, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and the DPDP Rules. Nothing in this Policy limits your rights under the Consumer Protection Act, 2019 or any other law.

We maintain reasonable security safeguards appropriate to the nature of the data and the risk involved, including:

• encryption of data in transit (HTTPS/TLS) and of personal data at rest;
• passwords stored only in hashed form; multi-factor authentication available on accounts;
• role-based access control, so our personnel and Institution and Recruiter users see only what their role requires;
• access logging and monitoring, retained so that unauthorised access can be detected and investigated;
• regular backups and tested restoration;
• written confidentiality and data protection obligations on our personnel and on every service provider;
• separation of production data from development and testing environments, and use of masked or synthetic data in non-production environments;
• periodic review of access rights, and prompt revocation on role change or exit.

No system is completely secure. If you believe your account has been compromised, tell us immediately using Clause 12.

If a personal data breach occurs, we will:

• notify the Data Protection Board of India without delay on becoming aware of it, and provide the further detailed information the DPDP Rules require within the prescribed period;
• notify each affected Data Principal without delay, in a concise and plain-language description of the nature and extent of the breach, its likely consequences, the measures we have taken and are taking to mitigate risk, and what you can do to protect yourself; and
• maintain a record of the breach and our response.

We use cookies and similar technologies that are strictly necessary to run the Platform — keeping you signed in, maintaining session security, and remembering your preferences. We also use limited analytics to understand how the Platform is used and where it fails.

We do not use cookies for third-party advertising or cross-site tracking.

Where we use non-essential cookies, we ask for your consent first, through a banner that lets you accept or decline with equal ease. Declining is not made harder than accepting, and nothing is set before you choose other than what is strictly necessary. You can also control cookies through your browser settings, though disabling essential cookies will stop parts of the Platform working.

Full detail is in our Cookie Policy at https://talentproof.in/cookie-policy.

The Platform uses automated processing to match Candidates to opportunities — for example, ranking or shortlisting profiles against a job’s stated requirements, or surfacing opportunities that fit your stated preferences.

• These are recommendations and rankings, not hiring decisions. Every hiring decision, including rejection, is made by the Recruiter, not by us.
• Matching does not use caste, religion, gender, marital status or disability as a criterion.
• If you believe a matching or ranking outcome is based on inaccurate data about you, use your correction right under Clause 10.
• We do not carry out profiling for advertising purposes.

We may update this Policy. When we do:

• we will change the version number and the “Last Updated” date at the top;
• we will publish the updated Policy at https://talentproof.in/privacy-policy;
• for any change that materially affects how we use your personal data or your rights, we will notify you by email and in-app notice at least 15 days before it takes effect, and where the change requires your consent, we will ask for it afresh rather than deeming it given;
• previous versions will be available on request from the contact in Clause 12.

Continued use of the Platform after a non-material change takes effect indicates acceptance of the updated Policy.

This Policy is governed by the laws of India. Subject to your statutory rights, including your right to complain to the Data Protection Board of India and your rights under the Consumer Protection Act, 2019, the courts at Bengaluru, Karnataka have exclusive jurisdiction.

This Policy should be read with our Terms of Use, our Cookie Policy, and How to delete your data.