Data processing addendum
Last updated: 2026-10-31
1. Roles
For candidate data, you are the Data Fiduciary and CraftMyResume Labs Pvt Ltd is your Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023. This addendum forms part of the business terms.
2. Your instructions
We process candidate data only to provide the service as you use it, and as the law requires. Your use of the workspace and API, and the settings you choose, are your instructions. We do not use it for our own marketing or sell it.
3. Your obligations
You are responsible for your lawful basis, for any notice to candidates, for handling their requests, and for the accuracy of what you upload. Do not upload more than is needed. Do not include data about anyone under 18.
4. Security
We encrypt temporary files, and candidate names, results and notes at rest. We limit access by role, require an authenticator for protected actions, isolate data between workspaces, and keep an activity log that excludes request contents.
5. Subprocessors
You authorize the providers on our subprocessor list. We will update that page before adding a provider that handles candidate data, and give workspace owners at least 14 days' notice by email. If you reasonably object, you may stop using the service and request a refund of unused credits.
6. Transfers
Some subprocessors process data outside India. Such transfers remain subject to any restriction the Government of India notifies under the Act.
7. Personal data breaches
If we become aware of a personal data breach affecting your candidate data, we will tell the workspace owner without undue delay, with what we know and the steps we are taking, so that you can meet your own duties.
8. Help with requests
You can view and delete candidate results in the workspace. If a candidate contacts us directly, we will direct them to you where we can identify you. We will give reasonable help with requests you cannot handle in the workspace.
9. Retention and deletion
Files and extracted text are deleted after assessment, within 24 hours at most. Results, shortlist decisions and notes are deleted after 90 days or when you delete them. Deleted data can remain in encrypted backups until those backups are replaced.
10. Information
On reasonable written request, we will give you information you need to show compliance with this addendum. Any audit is limited to what the law requires and to what does not expose other customers' data.