Privacy Policy
How we handle personal data in legal recruitment - what we hold, why, on what legal basis, and what you can ask us to do about it.
Last updated: [to confirm - insert the date this page goes live]
1. Who we are
Xpress Recruiters is a recruitment agency based at 191/558, Maidangarhi, New Delhi - 110068, India. We specialise in legal recruitment, executive search and headhunting for law firms, in-house legal teams and companies across Delhi NCR.
Under the Digital Personal Data Protection Act 2023 ("DPDP Act") we are a Data Fiduciary for the personal data described below. Under the UK/EU GDPR, where it applies to a particular person, we act as a controller.
Questions, requests and complaints: connect@xpressservices.in or +91 97114 33229. Our Grievance Officer is named in section 13.
[to confirm - the registered legal entity name, its constitution (proprietorship / LLP / private limited) and CIN or registration number should replace the trading name above once confirmed.]
2. Which law applies to you
The DPDP Act applies to the personal data of individuals in India, and to processing outside India where it relates to offering goods or services to individuals in India. Substantially all of our work is Delhi NCR based, so for most candidates and clients the DPDP Act is the operative law.
The GDPR applies additionally to a person in the UK or EEA where we offer services to them or monitor their behaviour there. This can arise where a candidate is currently based in the UK or EEA and is considering a move to India, or where a client company is established there. Where both apply we give you the higher of the two standards.
[to confirm - whether the business actively targets candidates or clients in the UK/EEA. If it does not, the GDPR sections can be reduced to the incidental case above. If it does, an Article 27 EU representative may be required.]
3. Whose data we hold, and what
Candidates and prospective candidates
Name; contact details; CV; qualifications and bar enrolment; post-qualification experience; practice area; current and previous employers; role history; notice period; current and expected compensation; location and relocation preferences; interview availability and feedback; references where you provide them; and our own notes on suitability for a brief.
Client contacts
Name, job title, work email, work telephone and the content of your instructions to us. This is business contact data, but it is still personal data about an individual.
Referees
Name, job title, employer and contact details, provided to us by a candidate, plus the substance of any reference given.
Website visitors
Standard server log data (IP address, browser type, pages requested, timestamps) held by our hosting provider, and anything you type into our enquiry form. Our website does not currently run analytics or advertising trackers - see our Cookie Policy.
4. Where we get it
- Directly from you - a CV you email us, an enquiry form, a phone call or a meeting.
- From your employer or our client - where a company asks us to fill a role, or where a referee responds to us.
- From public professional sources - this one matters in our line of work. A large part of legal search is approaching people who are not applying for anything. Where we identify you from a public professional profile, a firm website, a directory or a public announcement, we record only your name, employer, role and public professional history, and we tell you where we found you at the point of first contact. You can ask us to delete that record immediately and we will.
5. Why we use it, and on what legal basis
The DPDP Act allows processing on consent, or on one of the certain legitimate uses in section 7 - it does not contain a general "legitimate interests" balancing test in the way the GDPR does. Where both laws apply we identify a basis under each.
| What we do | DPDP Act basis | GDPR basis |
|---|---|---|
| Reply to an enquiry you send us | Voluntarily provided for that purpose, s.7(a) | Art 6(1)(b) - steps prior to a contract |
| Assess you for a specific live role and present you to that employer | Consent | Art 6(1)(b), and Art 6(1)(a) for the disclosure |
| Keep your CV on file for future roles | Consent - withdrawable at any time | Art 6(1)(a) - consent |
| Approach you about a role after identifying you from a public professional profile | Consent, sought at first contact | Art 6(1)(f) - legitimate interests, with the Art 14 notice given at first contact |
| Take and give references | Consent | Art 6(1)(f) |
| Manage the client relationship and our contract with the employer | Voluntarily provided for that purpose, s.7(a) | Art 6(1)(b) / 6(1)(f) |
| Keep invoices, tax and statutory records | Compliance with law, s.7(b) | Art 6(1)(c) - legal obligation |
| Secure and operate this website | Voluntarily provided for that purpose, s.7(a) | Art 6(1)(f) |
6. Sensitive information - please do not send it
We do not ask for, and do not want, information about your health, religion, caste, sexual life, political views, trade union membership, biometric or genetic data, or financial account details.
We raise this specifically because CV conventions in India often include a photograph, date of birth, marital status, father's or spouse's name, and sometimes religion or caste. None of that is relevant to how we assess a candidate, and under the GDPR several of those items are special category data attracting extra protection. Please remove them before sending your CV. If we receive them anyway we will not use them in assessing you, and we will redact or delete them where we reasonably can.
7. Who we share it with
- Client employers - we share your CV and our assessment with a prospective employer only for a role we have discussed with you, and only once you have agreed to that specific submission. We do not circulate CVs speculatively.
- Referees - only those you nominate, and only after you tell us to approach them.
- Service providers - our website host, email provider and any document storage we use, acting on our instructions. [to confirm - list the actual providers here; a named list is expected under both laws.]
- Professional advisers and authorities - where we are required by law to disclose, or need advice on a legal claim.
We do not sell personal data, and we do not use it for advertising.
8. Transfers outside India
The DPDP Act permits transfer of personal data outside India except to territories the Central Government restricts by notification. Where we use a provider that stores data outside India, we check the destination against that restriction list.
Where GDPR applies, India has no European Commission adequacy decision. Transfers from the UK/EEA to us therefore rely on Standard Contractual Clauses together with a transfer risk assessment. [to confirm - whether SCCs are in place with any UK/EEA client, and where each service provider actually stores data.]
9. How long we keep it
Under the DPDP Act we must erase personal data once the purpose is served and retention is no longer needed for a legal purpose, and we must do so when you withdraw consent.
| Record | Retention |
|---|---|
| Candidate on file for future roles | [to confirm - a common period is 24 months from your last engagement with us, after which we ask you to renew consent or we delete] |
| Candidate placed with a client | [to confirm - typically the length of any guarantee or replacement period, plus the limitation period for a dispute] |
| Unsuccessful candidate for a specific role | [to confirm - deleted, or moved to the talent pool only with consent] |
| Person identified from a public profile who did not respond or declined | Deleted on request; otherwise [to confirm - a short period such as 6 months] |
| Client contract, invoices and tax records | As required by Indian tax and company law |
| Website server logs | As retained by our host - [to confirm] |
10. Security
The DPDP Act requires reasonable security safeguards to prevent a personal data breach. We restrict access to candidate records to the consultants who need them, use access-controlled accounts on our email and storage systems, and require our providers to maintain their own safeguards.
If a personal data breach occurs, the DPDP Act requires us to notify the Data Protection Board of India and each affected Data Principal. Where GDPR applies we must notify the relevant supervisory authority within 72 hours where the breach is likely to result in a risk to individuals.
[to confirm - the business should document an internal breach response procedure naming who decides, who notifies, and within what time.]
11. Your rights
You can ask us to give you a copy of what we hold, correct or complete it, erase it, or stop processing it. Under the DPDP Act you can also nominate someone to exercise your rights if you die or become incapacitated, and you can withdraw consent at any time - and withdrawing must be as easy as giving it was.
These are set out in full, with the request form, on our Your data rights page.
12. Children
Our services are directed at qualified legal professionals and at employers. We do not knowingly process the personal data of anyone under 18. The DPDP Act requires verifiable parental consent before processing a child's data and prohibits tracking or behavioural advertising directed at children; we do neither.
13. Complaints and escalation
Come to us first. Our Grievance Officer is [to confirm - name and direct email], contactable at connect@xpressservices.in. We will acknowledge your complaint and respond within [to confirm - a stated period; the DPDP Rules prescribe a maximum, and the business should commit to something at or inside it].
India. If you are not satisfied, you may complain to the Data Protection Board of India. Note that the DPDP Act also places duties on Data Principals, including not raising false or frivolous grievances.
UK/EEA. If GDPR applies to you, you may complain to your local supervisory authority - in the UK, the Information Commissioner's Office.
14. Changes
If we change how we use personal data we will update this page and, where the change is significant, tell affected candidates and clients directly. The date at the top shows the current version.