Candidate Privacy Notice
In short. If you send us your CV or apply through our careers page, we use your details to assess you for roles, contact you, and, for the specific role you are considered for, share your profile with the hiring organisation. We do not sell your data. We keep it for a limited period, and you can ask us to access, correct or delete it, or withdraw your consent, at any time by writing to privacy@secureminds.pro.
1. Who we are
Secure Minds Private Limited (“Secure Minds”, “we”, “us”), CIN U72900DL2020PTC367845, is the Data Fiduciary for the personal data described in this notice. We provide governance, risk, compliance and cybersecurity advisory services and recruit talent, including on a contract-to-hire basis, for client organisations.
Registered office: A-163, G No. 16, Pratap Nagar, Mayur Vihar Phase-1, East Delhi, Delhi 110091.
Operating address: 02-007, 2nd Floor, Emaar The Palm Square, Sector-66, Gurugram, Haryana 122102.
Website: www.secureminds.pro
2. Who this notice applies to
This notice applies to individuals who (a) email their CV or other details to hiring@secureminds.pro, (b) apply for a role through secureminds.pro/career, (c) are referred to us by a recruitment partner or a colleague, or (d) are contacted by us about a role on the basis of a professional profile you have made public (for example, on LinkedIn). It does not cover our employees, our clients’ staff, or visitors to our website, which are covered by separate notices.
3. Personal data we collect
| Category | What this includes |
|---|---|
| Identity and contact | Name, email address, phone number, current city or location |
| Professional profile | Contents of your CV: employment history, employers, designations, education, skills, certifications, total experience, notice period, current and expected compensation, availability, and referees if you provide them |
| Interaction records | Our emails and messages with you, interview schedules, interviewer feedback and notes, assessment results, and the status of your candidature |
| Technical data | Basic technical metadata generated when you email us or use our careers page form (for example, timestamp and email headers) |
| Optional details in your CV | Photograph, date of birth, gender, marital status, nationality or similar items, if you choose to include them. We do not need these to assess you, and you may remove them before sending |
Please do not send Aadhaar, PAN, passport or bank account numbers, health information, or copies of identity documents when you apply. We do not need them at this stage. If you are selected, any identity or verification documents are collected later, under a separate notice, for that specific purpose.
4. Why we use your personal data
| Purpose | Data used |
|---|---|
| Assess your suitability, shortlist you, and contact you about roles you may fit | Identity and contact; professional profile |
| Share your profile with the client organisation hiring for a specific role you are being considered for, and coordinate interviews and offers with that organisation | Identity and contact; professional profile; interaction records |
| Schedule and run interviews and assessments, record feedback, and manage your candidature | Identity and contact; professional profile; interaction records |
| Comply with law, respond to lawful requests, and establish or defend legal claims | All categories, as needed |
| Protect our systems and prevent fraud or misuse (for example, verifying that a submission is genuine) | Identity and contact; technical data |
| Optional: keep you in our talent pool to contact you about future roles, if you agree (see section 6) | Identity and contact; professional profile |
We do not use your CV to market our advisory services to you, and we do not make hiring decisions solely by automated means.
5. Who we share your data with
- Client organisations that have asked us to recruit for a role, limited to the profile relevant to that role. They receive it under confidentiality obligations.
- Service providers acting on our behalf, such as email and collaboration, cloud storage, scheduling and video-interview, and IT support providers, under written contracts that require them to protect your data and use it only on our instructions.
- Background-verification providers, only after you have been selected and only under the separate notice referred to in section 3.
- Professional advisers, auditors and authorities, where required by law or to establish or defend legal claims.
We do not sell your personal data. Some client organisations or service providers may be located, or may store data, outside India. We transfer data outside India only where the DPDP Act permits it, that is, not to any country or territory the Central Government has restricted by notification.
6. How we obtain your consent
By emailing your CV to hiring@secureminds.pro or submitting an application after reading this notice, you consent to the purposes listed in section 4, other than the optional talent-pool purpose. That consent is your free, specific and informed choice made by that action, and you may withdraw it at any time (section 9).
Talent pool (optional). We ask separately whether we may keep your details for future roles. We treat this as given only if you reply “YES” to our request or tick the option on the application form. If you do not agree, your application is considered only for the role or roles you applied for.
Referrals and recruitment partners. If a recruitment partner or another person submits your CV, we rely on them having your consent and having given you this notice. We may contact you to confirm your interest and consent before taking your candidature forward.
7. How long we keep your data
| Data | Retention |
|---|---|
| CVs and interaction records of applicants who are not selected, and unsolicited CVs | 12 months from our last meaningful interaction with you, then erased |
| Talent-pool records (only where you agreed) | Until you withdraw consent, or 24 months from our last interaction with you, whichever is earlier. We may ask you to reconfirm before then |
| Selected candidates | Your records move to the engagement or employment record, which is governed by a separate notice |
| Records we must keep by law, or need to establish or defend a legal claim | For the period the law requires, or until the claim is resolved |
If you withdraw consent or ask for erasure, we erase your data within 30 days unless the law requires us to keep it. Copies in routine backups are overwritten within 90 days.
8. How we protect your data
We apply reasonable security safeguards to prevent personal data breaches, including role-based access limited to people involved in hiring, multi-factor authentication on email and storage accounts, encryption of data in transit, confidentiality obligations on our staff, written data-protection terms with service providers, and monitoring of access logs. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.
9. Your rights and how to use them
Under the DPDP Act you have the right to:
- Withdraw consent at any time. It will be as easy to withdraw as it was to give. Withdrawal does not affect processing done before you withdraw, and we will stop considering your candidature and erase your data unless the law requires us to keep it.
- Access a summary of your personal data we process, the processing activities, and the identities of the other Data Fiduciaries and processors we have shared it with.
- Correction, completion and updating of inaccurate or incomplete data.
- Erasure of your data, unless retention is necessary for the specified purpose or required by law.
- Grievance redressal from us, before approaching the Data Protection Board of India.
- Nominate another person to exercise your rights if you die or become incapacitated.
To exercise any right, email privacy@secureminds.pro from the email address you used to apply, stating your request in the subject line. We may ask you to confirm your identity. We acknowledge requests within 7 days and resolve them within 30 days, and in any case within the maximum period prescribed by the DPDP Rules (not exceeding 90 days).
10. Your duties
As a Data Principal you must comply with applicable law, not impersonate another person, not suppress any material information when providing data for a proof of identity or address issued by the State, not file a false or frivolous grievance or complaint, and furnish only information that is verifiably authentic when you exercise a right of correction or erasure.
11. Children
Our recruitment activities are for individuals aged 18 and over. We do not knowingly process the personal data of children. If we find that we hold such data without the verifiable consent of a parent or lawful guardian, we will erase it.
12. Grievance Officer and contact
Bharti Chadha, Director, Secure Minds Private Limited (Grievance Officer)
Email: privacy@secureminds.pro | Phone: (+91) 99535-65539
Address: 02-007, 2nd Floor, Emaar The Palm Square, Sector-66, Gurugram, Haryana 122102
If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India in the manner prescribed under the DPDP Act and Rules.
13. Language and changes to this notice
This notice is available in English, and on request in any language specified in the Eighth Schedule to the Constitution of India. We may update it from time to time. The current version, with its effective date, is always on this page. If a change materially affects how we use your data, we will notify candidates whose applications are active.
Version 1.0 — effective 19 September 2026. Governed by the laws of India.
