General Privacy Policy

1. Definitions and Interpretation

For the purposes of this Policy:

1. “User”, “you” & “your” means any natural or legal person who accesses or uses the Platform.
2. “Personal Data” means any information that relates to an identified or identifiable individual, who is identifiable by or in relation to such information.
3. “Processing” in relation to Personal Data, means a wholly or partly automated operation or set of operations performed on Personal Data, and includes operations such as but not limited to collection, storage, use, disclosure, transfer, and deletion.
4. “Third-Party” means any person or entity other than Cognavi and the User.
5. “Services” means the services offered by Cognavi through the Platform, including but not limited providing a Platform connecting the Students, Recruiters and Universities, through its Platform. Cognavi provides a marketplace to connect Recruiters (to hire suitable talent), Students (to find their dream jobs suited to their skill sets) and Universities (to optimize their placement process); and
6. “Applicable Laws” means all applicable data protection and privacy laws, rules, and regulations in force in the relevant jurisdiction governing the Processing of Personal Data, including, where applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India, Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR) wherever applicable, as may be amended from time to time.

Capitalized terms used but not defined in this Policy shall have the meaning ascribed to them in the Terms of Use and in case of any inconsistency found between the Policy and Terms of Use, the terms in this Policy shall prevail.

2. Collection, Purpose and Use of Personal Data

To provide its Services, Cognavi collects and uses the following categories of Personal Data for the purposes outlined in Table 1 below:

Please note that providing Personal Data is at the User's discretion. However, if necessary Personal Data is not provided to us, you may not be able to use certain Services or features of the Platform.

3. Categories of Personal Data Collected

The categories of Personal Data that we collect, and the data elements falling within each category, are set out in Table 2 below. Table 2 supplements the purpose-wise description in Table 1 above. Not every category applies to every User; the categories that apply to you depend on the capacity in which you deal with us, that is, whether you are a Student, a Recruiter or a University.

We collect this Personal Data directly from you when you register, complete your profile, upload documents, take an assessment or contact us; from your University or placement officer where it supplies your details to us; and from your device when you use the Platform. Where your Personal Data reaches us from a source other than you, this Policy is made available to you at or before our first contact with you.

4. Purpose for processing Personal Data/ Use of Personal Data

We use your Personal Data to provide our Services, communicate with you, troubleshoot issues, secure against fraud and abuse, improve and update our Services, analyse how people use our Services, and as required by law or necessary for safety and integrity. We may process your Personal Data for the following purposes:

• Verify your identity;
• To provide our Services;
• For internal data analysis, sending you information about our Services marketing purposes and promotions by Cognavi and its affiliates;
• For managing payments;
• Facilitate, provide and administer the Services provided by Cognavi to the Users;
• Process your requests and manage your account preferences;
• To communicate with the Users;
• Protecting our Users and providing you with customer support;
• Facilitate the Services’ technical functioning, including troubleshooting and resolving issues, securing the Services, and preventing fraud and abuse;
• For recommendations and personalization;
• Solicit feedback from Users;
• Improve the Platform and its content to provide better features and Services;
• Analyze trends, traffic and track usage data;
• Promote and market Cognavi's Services on third-party websites and applications to prospective Users;
• For preventing, detecting, investigating and taking action against crimes (including but not limited to fraud and other financial crimes), any other illegal activities, suspected fraud, or violations of Cognavi’s General Terms of Use or any other applicable terms of use, in any jurisdiction;
• For establishing, exercising or defending legal rights in connection with legal proceedings (including any prospective legal proceedings) and seeking professional or legal advice in relation to such legal proceedings;
• To display Student profiles (including but not limited to names, photos, and video resumes) on the Platform to enhance visibility to potential employers, facilitate outreach from prospective Recruiters, and support structured placement initiatives aimed at connecting Students with relevant employment opportunities.
• To comply with Applicable Laws, regulations, legal processes, or governmental requests, including responding to subpoenas, court orders, or regulatory authorities.
• To monitor, detect, and respond to security threats, breaches, unauthorized access, or fraudulent behavior; to conduct forensic investigations when needed.
• To analyze platform performance and User behavior to optimize functionality, inform feature improvements, and drive future product development.

5. Personal Data Sharing and Disclosure to Third Parties

Cognavi does not disclose, transfer, or share Your Personal Data with any Third Party except for provision of Services and for the purposes as described below or as required under Applicable Laws. Personal Data may be disclosed or shared only in the following circumstances:

• Cloud storage: we use [MongoDB and Amazon Web Services] to host Personal Data and enable our Services and operation of the Platforms.
• Monitoring of Services: we use Amazon Web Services Crash Reporting to monitor infrastructure and performance of the Service, identify and resolve errors and crashes in our Service across different Platforms.
• With Consultants and Recruiters (engaged or onboarded via the Platform): We facilitate sharing of your Personal Data with Consultants and Recruiters, engaged or onboarded via the Platform for provision of Services to you.
• Affiliates and Group Companies: With our affiliates or group entities for legitimate business purposes, internal administration, Service optimization, and to ensure the effective provision of Services through the Platform.
• Service Providers and Partners: With trusted Third-Party service providers who perform Services on our behalf, including but not limited to IT and infrastructure management, data hosting and backup, communication facilitation, analytics, customer support/call-centre/BPD, communication and SMS/OTP/IVR gateways, analytics/ attribution, crash/error logging and performance monitoring, security and fraud prevention tools, marketing automation and WhatsApp business service providers, survey/feedback tools, content moderation providers and payment processing. Such entities are bound by contractual obligations to maintain the confidentiality and security of Personal Data and to use it solely for providing the requested Services. If any such Third-party qualifies as a Data Processor under applicable laws, we may engage, appoint, use or otherwise involve such Data Processor to process Personal Data on our behalf only under a valid contract.
• Professional Advisors: With legal advisors, auditors, or consultants engaged by Cognavi for professional or compliance-related purposes, subject to strict confidentiality obligations.
• Business Transfers: In the event of any merger, acquisition, restructuring, financing, sale of assets, or similar business transaction involving Cognavi, Personal Data may be transferred to relevant counterparties or their advisors as part of the transaction process, subject to appropriate confidentiality safeguards.
• Legal and Regulatory Requirements: Where such disclosure is required or permitted by law, regulation, legal process, or governmental request; or where such disclosure it is necessary to protect Cognavi’s rights, property, or safety, or that of its Users, employees, or the public.
• Marketing and Advertising Partners: With trusted campaign attribution partners to measure the effectiveness of Cognavi's promotional campaigns and marketing outreach, to the extent permitted by Applicable Laws and subject to User consent, where required.
• Payments: To facilitate payments using our Third-Party payment providers, billing, refunds, and to prevent unauthorised transactions, where applicable. These Third-Party payment providers do not share your financial data, like credit card number, with us, but may share limited data with us related to your purchase, like success or failure of a transaction.
• Anonymized or Aggregated Data: Cognavi may use and share anonymized or de-identified data for research, analytics, Service improvement, or other business purposes, provided that such data does not identify any individual.

6. User Account

1. Account usage - Users are advised to exercise caution when sharing Personal Data, particularly login credentials, with any person or Third Party. Cognavi shall not be liable for any loss, damage, or unauthorized access resulting from the Users’ voluntary disclosure or sharing of Personal Data with any Third Party. Your password serves as the gateway to your account/profile. You are entirely accountable for all activities conducted under your username, and it is your sole responsibility to ensure the security of your password. Refrain from sharing your password with others. Should you disclose your password or Personal Data, you bear sole responsibility for any actions carried out under your username. Consequently, if your password is compromised for any reason, it is imperative to promptly change it.
2. Content – Users are advised to and are responsible for all the content (including any Personal Data, Resume, Video Resume) they share over the Platform while availing any Services. Cognavi will not be responsible for any the content shared over the Platform.
3. Service:_The use of our Services is not intended to replace professional advice, mentoring or professional career counselling. Before making any decision or taking any action that may affect your career, please consult with a licensed or other qualified professional. Your use of our Services and any information, predictions, or suggestions provided while using the Services are at your sole risk.
4. Account Deactivation – If You wish to temporarily deactivate Your account on the Platform, You may do so through the account settings available within the Platform or by following the instructions provided therein. Account deactivation will restrict Your access to the Platform and its Services; however, deactivation of Your account does not result in the deletion of Your Personal Data. Personal Data associated with a deactivated account may continue to be retained and processed for the purposes set out in this Privacy Policy. Your account and access to the Services may be reactivated in accordance with the Platform’s procedures.
5. Account Deletion - If you wish to delete your account created on our Platform, including all associated Personal Data, you may do so by selecting the “Delete your account” option in your profile settings or by contacting us. Upon receiving your deletion request, we will permanently delete or anonymize your Personal Data and instruct our Data Processors to do the same. Please note that limited Personal Data may be retained following account deletion strictly where such retention is required for compliance with applicable statutory laws, tax and financial reporting obligations, regulatory investigations, or active legal holds.
6. Your choice: You always have an option to choose the Personal Data You provide while using the Platform, including the option to update or delete Your Personal Data. However, please note that lack of certain Personal Data may not allow You access to the Platform or any of its features, in part or in full. For example: information required for Your registration on the Platform. Further, You will also have the option to choose what kind of communication You would like to receive from Us. However, there may be certain communications that are required for legal or security purposes, including changes to various legal agreements, that you may not be able to limit.
7. Reject Cookies and other similar technology plug-ins embedded on the Platforms: You may accept, reject or withdraw consent to non-essential cookies at any time through the cookie consent tool on the Platform. You may reject or remove cookies from Your web browser or other technologies embedded on Our Application; You will always have the option to change the default settings on Your web browser or via Application settings. However, please note that some of the Services or your use of our Platform may be impacted if you reject or disable such technological plug-ins.
8. Updating of Personal Data: Users can access and edit their Personal Data by logging into the Platform. We do not alter the data you provide, but we advise you to promptly update your Personal Data when changes are required.

7.User interactions

The Platform facilitates consultations and related Services between the Users. The User may manage the Personal Data received along with other information received during conversation or interaction with other Users. Cognavi does not manages or controls the User’s independent processing of Personal Data. Any information, communications, or Personal Data that you choose to share directly with another User, through your account or during any such communication with them, are at your sole discretion and risk. Cognavi acts solely as an intermediary platform enabling such interactions between the Users and shall not be responsible or liable for any Personal Data you share with another User at your own discretion.

8. Cookies

We may also collect Personal Data, such as your IP address and device and cookie identifiers, from cookies when you visit the Platform. Cookies are text files placed on your computer to recognize your internet browser, store your preferences, and improve your web experience. Only strictly necessary cookies are placed by default; all other cookies are placed only with your consent, as described under “Cookies and Similar Technologies” in Part C.

We use cookies to improve the Services we offer you. Please note that some of the cookies we use are necessary for certain Services to work, while others are used to collect information about Platform usage to make the Platform more convenient and useful.

Additionally, we may use Third-Party cookies provided by trusted partners. These cookies allow us to enhance your experience by providing personalized content, and analyzing our Platform traffic. The information including Personal Data collected through Third-Party cookies is governed by the respective privacy policies of these Third-Party providers.

9. Your Rights

You have certain rights in relation to your Personal Data, which include:

Your Rights under the Digital Personal Data Protection Act, 2023

Where the Digital Personal Data Protection Act, 2023 read with the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Act”) applies to the Processing of your Personal Data, you have the following rights as a Data Principal. “Data Principal” means the individual to whom the Personal Data relates and, where that individual is a child, the parent or lawful guardian, and where that individual is a person with disability, her lawful guardian. Cognavi is the Data Fiduciary in respect of the Processing described in this Policy.

Duties of a Data Principal. Section 15 of the DPDP Act also places duties on you: to comply with the provisions of all applicable laws while exercising your rights; not to impersonate another person while providing Personal Data for a specified purpose; not to suppress any material information while providing Personal Data for any document, unique identifier, proof of identity or proof of address issued by the State; not to register a false or frivolous grievance or complaint with us or with the Data Protection Board of India; and to furnish only such information as is verifiably authentic while exercising the right to correction or erasure.

To exercise your rights and for raising any grievances, please contact us in accordance with the “Grievance Redressal and Contact Us”. We try to respond to all legitimate requests at the earliest and within one (1) month and will contact you if we need additional information from you in order to honour your request.

To manage your consent preferences, you can access your privacy settings.

10.Consent and Withdrawal of Consent

Standard of consent. Where we rely on your consent to Process your Personal Data, that consent will be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and it will signify your agreement to the Processing of your Personal Data for the specified purpose and be limited to such Personal Data as is necessary for that purpose. Your consent is sought separately for each purpose in itemised form, is not bundled with your acceptance of the General Terms of Use, and is not made a condition of using any functionality that does not require it. The request for consent is presented in clear and plain language, and you may access it in English or in any language specified in the Eighth Schedule to the Constitution of India.

How to withdraw your consent. You may withdraw your consent at any time, and withdrawing it is as easy as giving it. You may do so from the privacy or consent settings available within your account on the relevant portal, by using the unsubscribe option contained in our marketing communications, or by writing to us at the address given in the “Grievance Redressal and Contact Us”. We do not require you to give a reason for the withdrawal.

Effect of withdrawal. On receiving your withdrawal, we will, within a reasonable time, cease the Processing that depended on that consent and cause our Data Processors to cease that Processing, and we will erase the Personal Data concerned unless its retention is necessary for compliance with any law for the time being in force. The lawfulness of any Processing carried out on the basis of your consent before its withdrawal is not affected. Where any Personal Data is retained after withdrawal, we will tell you which Personal Data has been retained and the legal obligation on the basis of which it has been retained.

Consequences of withdrawal. Withdrawing your consent may mean that a feature or a Service is no longer available to you, and any consequences of the withdrawal are to be borne by you. For example, if you withdraw your consent to the sharing of your contact details with Recruiters, Recruiters will no longer be able to contact you through the Platform; and if you withdraw your consent to assessment Processing, the output of your assessment will no longer be used to match you to opportunities. We will inform you of the relevant consequence before you confirm the withdrawal.

Consent Managers. Once the Consent Manager framework under Section 6(7) of the DPDP Act read with Rule 4 of the DPDP Rules, 2025 becomes operational, you may give, manage, review and withdraw your consent through a Consent Manager registered with the Data Protection Board of India, in an accessible, transparent and interoperable manner. We will act upon a consent or a withdrawal of consent received through a registered Consent Manager in the same manner as one communicated to us directly and will maintain such records as the DPDP Rules require.

Communication preferences. Every marketing or promotional communication we send to you carries an unsubscribe option, and you may also set your preferences from your account. Unsubscribing operates as a withdrawal of your consent to marketing communications and takes effect promptly, although it may take a short period to process. We will continue to send you transactional and Service-related messages, such as verification and security messages, one-time passwords, password reset messages, application and placement updates and account notices, for so long as you hold an account with us, as these are necessary to provide the Services you have asked for and do not constitute marketing.

11.Verification Process for Exercising Rights

To protect your privacy, we verify privacy rights requests to ensure that only You (or your authorized representative) can exercise rights pertaining to your Personal Data. As part of our verification process, we may request you to submit additional information including Personal Data.

If you are an authorized representative wishing to exercise rights on behalf of a User, please contact us using the details in the “Grievance Redressal and Contact Us” section of this Policy and provide us with a copy of the Users’ written authorization designating you as their representative. We may need to verify your identity and place of residence before completing your rights request.

12.Cross Border Transfer of Personal Data

The Personal Data we hold about you may be transferred to other countries outside your residential country for any of the purposes described in this Policy subject to any restrictions notified by the Central Government under Section 16 of the DPDP Act and, where Part B applies, the safeguards described in Part B.

The Personal Data we obtain from or about you may be processed and stored in India and our other various servers located across the globe, which may provide for different data protection rules than the country in which you reside. We comply with generally accepted industry standard regulations regarding the collection, use, and retention of Personal Data. If you have any questions relating to transfer of your Personal Data, please write to us on support@cognavi.com.

13.Security of Your Personal Data

We are committed to protecting your Personal Data in our custody. We take reasonable steps to ensure appropriate physical, organizational, technical and managerial safeguards are in place to protect your Personal Data from unauthorized use, access, alteration, transmission and deletion. We work to protect the security of your Personal Data during transmission by using encryption protocols. We use multi-layered controls to help protect our infrastructure, constantly monitoring and improving our applications, systems, and processes to meet the growing demands and challenges of security.

We ensure that the Third Parties who provide Services to us under appropriate contracts, take appropriate security measures to protect your Personal Data in line with our policies and as required by Applicable Laws. These Third Parties are further obligated to maintain reasonable level of security practices and procedures in accordance with applicable law to ensure security of the Personal Data.

Additionally, all Personal Data obtained and held by the Company will:

• be processed fairly, lawfully and in a transparent manner;
• be collected for specific, explicit, and legitimate purposes;
• be adequate, relevant and limited to what is necessary for the purposes of Processing;
• not be kept for longer than is necessary for its given purpose;
• be processed in a manner that ensures appropriate security of Personal Data including protection against unauthorised or unlawful Processing, accidental loss, destruction or damage by using appropriate technical or organisation measures;
• comply with the relevant laws and procedures for international transferring of Personal Data applicable to us.

We follow generally accepted industry standards to protect the Personal Data you submit to us. However, no method of transmission over the Internet or via mobile device, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

In the event of a breach affecting your Personal Data, we will notify you and the relevant authorities in the manner and within the timelines required under Applicable Laws, including the DPDP Act and, where applicable, the GDPR.

14.Links To Other Sites

The Platform may provide Third-Party advertisements and links to other websites.

Links to other websites are provided by Third Parties not controlled by us or affiliated with us unless otherwise stated on the Platform. Therefore, we make no claims about the privacy or rights of Third Parties or the terms of use of the sites, and we do not control, guarantee or endorse the accuracy, completeness or content of the goods/articles/services found on these websites. Any information including Personal Data you provide to Third-Party sites must be governed by their privacy policies, and it is recommended that you review each site’s privacy policies before using these sites.

15.Our Policy Concerning Children

We do not knowingly solicit or collect Personal Data from children under the age of 18 years (“Children/Child”) without the verifiable consent of their parent or lawful guardian. We do not knowingly permit Children to create an account or access the Services without the prior verifiable consent of a parent or legal guardian. If we become aware that Personal Data of a Child has been collected without such verifiable consent of a parent or legal guardian, we will take appropriate steps to pause/deactivate/delete the account and any related Personal Data as soon as possible. If you believe we might have any information from or about a Child, please contact us at support@cognavi.com.

16.Methods for Providing Parental Consent

Parents or legal guardians may provide consent through either of the following secure methods:

Clicking a verification link sent to their registered email address and affirmatively confirming consent; or

Providing an OTP-based confirmation sent to their registered mobile number.

Before treating such consent as valid, we will check that the individual identifying themselves as the parent or legal guardian is an identifiable adult, by reference to (i) reliable details of identity and age already available with us; or (ii) details of identity and age voluntarily provided by that individual, in accordance with Rule 10 of the DPDP Rules, 2025.

Until verifiable parental consent is received and confirmed, the Child’s account will not be functional and no Children Data will be processed beyond what is required to initiate the consent request. By providing consent, the parent or legal guardian acknowledges responsibility for the Child’s use of the Platform and agrees that this Policy and the General Terms of Use apply to such use.

In compliance with the applicable privacy laws, we will not process Personal Data of Children in any manner that is likely to cause a detrimental effect on their well-being. Further, we do not undertake tracking, behavioural monitoring, or targeted advertising directed at Children.

17.Data Retention

The Platform will retain the Personal Data only for as long as only for as long as is necessary to fulfil the purposes expressly set out in this Policy and is necessary for the purposes of providing Services, but in no event longer than a maximum retention period of 5(Five) years from the date of your last use of the Services, unless a longer retention period is mandated by applicable law. The Platform will retain and use your Personal Data to the extent necessary to comply with the legal obligations (for example, if required to retain Personal Data to comply with Applicable Laws), resolve disputes, and enforce legal agreements and policies. At the expiry of such periods, your Personal Data will be deleted or archived in compliance with Applicable Laws.

18.Changes in Privacy Policy

We reserve the right to change this Policy at any time, if we make a material change to this Policy, we will provide you with notice in accordance with the Applicable Laws to inform you of such material changes or updates. The revised Policy supersedes all previous policies.

19.Email Policies and Opt-out

You can choose the type of email you want to receive from us. If at any time you decide that you no longer wish to receive communications from us, please follow the unsubscribe instructions in such communications. Please note that after receiving your request, it may take some time for your un-subscription/ opt out from our communications to be processed.

20. Disclaimer

We assume no liability or responsibility for the disclosure of your Personal Data due to causes beyond our control. You play an important role in keeping your Personal Data secure. You should not share your username, password, or other security information for your account with anyone. If we receive instructions using your username and password, we will consider that you have authorized such instructions. Further, notwithstanding anything contained in this Policy or elsewhere, we shall not be held responsible for any loss, damage, or misuse of your Personal Data, if such loss, damage, or misuse is attributable to any event that is due to a Force Majeure Event or beyond our reasonable control or is directly attributable to you.

A "Force Majeure Event" shall mean any event that is beyond our reasonable control and shall include, without limitation, fire, flood, explosion, acts of God, civil commotion, strikes, insurrection, war, acts of government, accidents, natural disaster, pandemics, war, terrorism, civil unrest, strikes, lock-outs, or other industrial disputes (whether involving the workforce of Cognavi or any other party), power or internet outages, failure of utility or telecommunications networks, or compliance with any law, regulation, or governmental order, rule, regulation or direction, etc.

If you have any questions regarding this Policy or the protection of your Personal Data, please contact Cognavi’s Data Protection Officer.

21. Indemnity

You agree and undertake to indemnify and hold harmless Cognavi from Third-Party claims and liabilities arising from Personal Data you voluntarily disclose to independent Third Parties (including Recruiters, Universities, Students, external websites, apps, or services not acting on Cognavi’s behalf) through or outside the Platform, and from your use and access of such Third-Party resources, to the extent permitted by Applicable Law. We assume no liability for any actions of such Third Parties with regard to Your Personal Data which You may have disclosed to such third parties.

1. When Part B Applies to You

Part B applies to you if you are located in the European Economic Area (EEA)or the United Kingdom and your personal data is processed by Cognavi in connection with the offering of services to you, or the monitoring of your behaviour within that territory. In that case, Regulation (EU) 2016/679 (the “GDPR”), and the United Kingdom GDPR as applicable, governs the processing, and the terminology, lawful bases and rights described in this Part apply in place of those in Part A.

If you are a user located in India whose profile is disclosed to a Recruiter located in the EEA or UK, Cognavi processes your Personal Data as a Data Fiduciary under Part A (DPDPA 2023), based on your consent. Upon receiving your Personal Data, the EU/UK-based Recruiter acts as an independent Data Controller for its own recruitment processes under the GDPR.

Our third-party service providers (as detailed in the Personal Data Sharing and Disclosure of Part A) act as processors on our behalf. Where you are in the EEA or the United Kingdom, Cognavi appoints a representative under Article 27, whose contact details are provided in the Grievance Redressal and Contact Us of this Policy.

The categories of personal data we process, the channels through which we collect them, and the recipients to whom we disclose them are the same as those described in the Categories of Personal Data Collected, Personal Data Sharing and Disclosure, and User Account of Part A. What differs, and what this Part sets out, is the lawful basis for the processing, the treatment of special categories of data, the position on automated decision-making, the mechanism for international transfers, and the rights available to you.

2. Lawful Bases under Article 6

Cognavi does not rely on the legitimate uses in Section 7 of the DPDPA in respect of personal data governed by the GDPR. That provision has no equivalent under the GDPR, and each purpose is instead mapped to an Article 6 basis as set out below.

Where a user profile or personal data is disclosed or made available to an EU/UK-based Recruiter or prospective employer through the Platform, that recruiting organisation acts as an independent Data Controller for its own recruitment, interviewing, talent evaluation, and hiring processes under the GDPR.

2.1 Special categories of personal data (Article 9)

Cognavi does not seek special category data from candidates or users. Where special category data is processed, it is on the following conditions:

• any special category data that appears in a video resume or a free-text field — not sought by us, not used as an evaluation criterion, and processed only to the extent unavoidable in operating the feature.

2.2 Personal data obtained indirectly (Article 14)

Where we obtain your personal data from a source other than you — for example from an institution, a referrer, a professional network or a business contact data provider — we inform you of the matters required by Article 14, including the source, within one month of obtaining the data and, in any event, at or before our first communication with you.

2.3 Children (Article 8)

Where an information society service is offered directly to a child, Cognavi will process the child’s personal data only with the consent or authorisation of the holder of parental responsibility, in accordance with Article 8 and the age threshold applicable in the relevant Member State. Our services are not directed at children and we operate an age check on registration.

2.4 International transfers (Chapter V)

Cognavi is established in India, and personal data subject to the GDPR or the UK GDPR will be processed in India and may be transferred to our service providers and to Recruiters located in other countries. Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on the Standard Contractual Clauses adopted by the European Commission (and, for personal data subject to the UK GDPR, the UK International Data Transfer Addendum or the International Data Transfer Agreement), together with supplementary measures where required. You may request a copy of the relevant safeguards by contacting us using the details in the Grievance Redressal and Contact Us section of this Policy.

3. Your Rights under the GDPR

Where the GDPR applies to the processing of your personal data, you have the following rights. They are additional to, and distinct from, the rights described in Part A.

We respond to a request within one month of receipt. That period may be extended by a further two months where the request is complex or where we have received a number of requests, in which case we will tell you within the first month and explain why. We do not charge a fee for responding, unless a request is manifestly unfounded or excessive.

4. Automated Decision-Making and Profiling

Cognavi uses psychometric assessment, video assessment and AI-assisted matching to produce a personality profile, a set of scores, a user ranking and a written justification of why a user fits a role. This constitutes profiling, and it is capable of significantly affecting a user because it informs whether a recruiter shortlists that user.

Our position is as follows:

• the output of the assessment and matching tools is made available to the recruiting organisation to inform a human decision, and is not itself the decision;
• the hiring decision is taken by the recruiting organisation and involves meaningful human assessment;
• we disclose to you, before you take an assessment, that the assessment is being carried out, what it measures, the logic involved in producing the output and the consequences of that output for you;
• you may obtain human intervention, express your point of view, request an explanation and contest the output;
• you may withdraw your consent to assessment processing at any time, and we will then cease using the output; and
• we do not apply behavioural profiling or targeted advertising to any individual who is a child.

1. Grievance Redressal and Contact Us

The entity responsible for the processing and protection of your personal data is Cognavi India Private Limited.

If you have a question about this Policy, about how your personal data is processed, or if you wish to exercise a right or raise a grievance, please contact our Data Protection Officer.

Please do not send confidential content, identity documents or financial particulars by unsecured email. Where we need such information to verify your identity, we will tell you how to provide it securely.

If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDPA, or, where Part B applies to you, to the supervisory authority in your Member State under Article 77 of the GDPR.

2. Cookies and Similar Technologies

Our website may use cookies and similar technologies including analytics identifiers, session and interaction measurement, and marketing campaign performance and conversion attribution identifiers. A cookie notice, containing an itemised inventory naming each cookie or identifier, its purpose, its provider and its duration, is published alongside this Policy.

Only strictly necessary cookies are set by default. All other cookies and identifiers are placed or read only after you have given consent through the cookie consent tool presented to you on your first visit. You may change or withdraw your cookie preferences at any time through that tool, and you may also control cookies through your browser settings.

3. Links to Other Websites

Our Platforms may contain links, buttons or embedded tools that take you to services operated by other organisations. Those services operate under their own privacy Policies and notices. We encourage you to read them. Cognavi is not responsible for the privacy practices of any external site or service.

4. Changes to this Privacy Policy

This Policy is reviewed at least annually and whenever there is a change in our processing purposes, technology, service providers, collection channels or applicable law. Where we amend it, the revised Policy will be published on this website with a new version number and effective date, and the superseded version will be retained as a record of what was disclosed and when.

Where a change materially affects the processing of your personal data, we will notify you by email or through another available channel, and, where the change alters the purpose or the recipients of processing for which you gave consent, we will seek your consent afresh.