Enterprise Privacy & Data Processing Policy

1. Regulatory Stance & Data Roles (DPDP Act 2023 & GDPR)

VOUCHIR Technologies ("VOUCHIR", "we", "us", or "our") provides verified employee referral distribution and attribution software to enterprise customers. In providing our platform:

• Data Fiduciary / Data Controller: The enterprise hiring organization subscribing to VOUCHIR is the Data Fiduciary under the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) and the Data Controller under the General Data Protection Regulation (EU GDPR) and UK GDPR.
• Data Processor: VOUCHIR operates strictly as a Data Processor under standard enterprise Data Processing Addenda (DPA), processing personal data solely in accordance with explicit customer instructions and configured integration webhooks.

2. Candidate Information Processed

When a candidate applies through a VOUCHIR verified referral link (e.g., at /apply), we collect and process only the minimal information required to verify attribution and route the candidate to the corporate Applicant Tracking System (ATS):

3. Data Retention & Auto-Purge Cycles

Candidate resumes and raw submission files are ephemeral in VOUCHIR's distribution pipeline. Once ingested by the customer's ATS (e.g., Workday, Greenhouse, Lever, SAP SuccessFactors), raw binary payloads are marked for automatic deletion.

Attribution ledger logs (containing referral verification timestamps, advocate IDs, and requisition IDs) are preserved for 90 days to resolve duplicate referral conflicts, after which tenant configurations determine archival or crypto-shredding.

4. Zero Tracking Cookies & No Cross-Site Beacons

VOUCHIR believes in zero surveillance analytics. We do not use third-party advertising pixels, behavioral trackers, or marketing analytics trackers (such as Facebook Pixel, Google AdServices, or data aggregator SDKs) on our candidate intake or dashboard interfaces.

Only strictly essential session cookies and anti-CSRF authentication tokens required for operational integrity are stored.

5. Candidate Rights (Access, Correction & Erasure)

Under the DPDP Act 2023 and GDPR, candidate data subjects retain rights to:

• Right to Confirmation & Access: Review personal data processed through our referral gateway.
• Right to Correction & Erasure: Request immediate rectification or deletion of candidate profiles and uploaded resumes.
• Right to Withdraw Consent: Withdraw candidate consent at any stage of the recruitment screening lifecycle.
• Right to Grievance Redressal: Direct compliance inquiries to our certified Data Protection Officer.

Because the hiring employer is the Data Controller, requests submitted to VOUCHIR will be processed in coordination with the respective employer's recruiting operations.

6. Technical & Organizational Security Controls