Your data rights

See it, correct it, erase it, or tell us to stop. No charge, and no reason required.

Draft for legal review. This document was prepared to reflect how Xpress Recruiters actually handles personal data, and to follow the Digital Personal Data Protection Act 2023 and, where it applies, the UK/EU GDPR. It has not been reviewed by a practising data protection lawyer. Items marked [to confirm] need a decision from the business before this page is published.

You control the personal data we hold about you. This page explains each right and gives you one place to ask.

What you can ask for

See what we hold

A summary of the personal data we hold about you, what we are doing with it, and who we have shared it with. DPDP Act s.11 · GDPR Art 15

Correct, complete or update it

If your PQE, practice area, current role, notice period or contact details are wrong or out of date, tell us and we will fix it. This matters practically as well as legally - we present you to employers on the strength of this record. DPDP Act s.12 · GDPR Art 16

Erase it

Ask us to delete your record. We will, unless a law requires us to keep part of it. DPDP Act s.12 · GDPR Art 17

Withdraw your consent

If you asked us to keep you on file, you can tell us to stop at any time, and it will be as easy as it was to agree in the first place. We will cease processing and instruct our processors to erase your data. DPDP Act s.6(4)-(6) · GDPR Art 7(3)

Nominate someone

You can nominate another individual to exercise these rights on your behalf if you die or become incapacitated. This right is specific to Indian law and has no GDPR equivalent. DPDP Act s.14

Raise a grievance

If you think we have got something wrong, tell us. You do not have to go to the regulator first. DPDP Act s.13

If the GDPR applies to you

You additionally have the right to restrict processing (Art 18), to data portability (Art 20), and to object to processing based on legitimate interests (Art 21) - which includes objecting to us holding a record created from your public professional profile.

Make a request

Data rights request

We use what you enter here only to find your record and answer your request. If you would rather email us, connect@xpressservices.in reaches the same place. [to confirm - connect this form to a real endpoint; the action attribute is a placeholder and the form will not send until it is set.]

What happens next

  1. We acknowledge your request.
  2. We verify who you are - see the FAQ below on how.
  3. We act on it and confirm in writing what we did. If we cannot do part of it, we tell you which part and why.

[to confirm - state the response time the business commits to, at or inside the period prescribed by the DPDP Rules. Where GDPR applies the outer limit is one month, extendable by two further months for complex requests.]

Frequently asked questions

Do I have to give a reason?

No. You do not need to give a reason to withdraw consent or to ask us to erase your data.

Will you charge me?

No. Requests are free.

How will you check it is really me?

We will ask you to confirm the request from the email address we hold for you, or to answer a question only you would know. We ask for identity documents only if we genuinely cannot verify you otherwise, and we delete them once we have.

What if I withdraw consent while you are presenting me for a role?

We stop. We will tell you what has already been shared with which employer, and we will ask them to delete it, though the employer becomes responsible for its own copy at that point.

Can you refuse?

Rarely. We may keep a minimal record where a law requires it - tax and statutory records, for example - or where we need it to establish or defend a legal claim. We will tell you if that applies and what we have kept.

What if I am not happy with your response?

Escalate to our Grievance Officer, then to the Data Protection Board of India. If the GDPR applies to you, you may also complain to your local supervisory authority.

Prefer to just tell us to stop? Email us and say so - that is enough.

Withdraw consent →
CallEnquire