Privacy notice for applicants

Circuvent Technologies decides what is collected here and why, and is the data fiduciary for it under the Digital Personal Data Protection Act 2023.

A named Data Protection Officer and a grievance address have not yet been published. Until they are, write to the address in the footer of any email we send you and it will be answered.

When you apply, the form asks for your name, email address, phone number, a CV, and optionally a covering letter and links to your work. Applying does not require an account.

When you create an account, we store your name and email address, and a password if you choose one. Passwords are stored hashed, never in a form we can read.

When you complete the application register, we ask for a good deal more, because it is the form an offer letter and a first payroll run are built from: address, education, employment history, expected pay, notice period, two referees, and statutory identifiers — PAN, Aadhaar, UAN, PF, ESIC, passport, driving licence.

Every step of that register except the first is optional to leave for later, and the form saves one step at a time. Nothing there is required to apply for a job.

These are treated differently from everything else on the site, and the difference is enforced in code rather than promised in a policy.

• They are encrypted before they reach the database, with AES-256-GCM and a key held only in the deployment’s secrets. The database never holds them in the clear.
• They are never read back to you in full. Every screen shows the last four characters only, as XXXXXXXX9012.
• If the encryption key is not configured, the system refuses to store them at all rather than writing them unencrypted — the fields are disabled and say so.

A photograph and a scan of one photo-ID document are stored as files in private object storage. Neither is publicly reachable: each is served only to your own signed-in session.

For an application, because you asked us to consider you and we cannot do that without it. For the register, because the information is necessary to prepare an offer of employment and meet the statutory obligations that come with employing somebody in India — tax deduction, provident fund, employee state insurance.

We do not sell it, and we do not use it to advertise to you.

Our recruiters and the hiring managers for the role you applied for. Beyond that, only the services that make this work: our database and file storage host, and the service that sends our email. They act on our instructions and for no other purpose.

Job boards such as LinkedIn and Naukri receive our list of open vacancies. That feed contains job descriptions only — never anything about applicants.

Applications are kept for 3 years after a decision is made, then anonymised automatically. Anonymising is irreversible: the personal details are overwritten and only counts remain, so we can still answer questions about how fairly we hire without holding onto the people.

The clock starts when the decision was made, not when you applied — so a long process does not shorten the time your details are protected by it.

• See it. Most of it is already visible in your account, except the statutory identifiers, which nobody can read back including us.
• Correct it. The register is editable at any time.
• Withdraw an application. There is a button on each one.
• Have it erased. Ask, and we will remove what we are not required to keep. Where a law requires us to retain something, we will tell you which.
• Stop the email. Every job alert carries an unsubscribe link, and unsubscribing takes one click. Messages about an application you have actually made will still reach you, because those are not marketing.

One cookie, used to keep you signed in. It is set only when you sign in, it cannot be read by scripts, and it is not shared with anyone. There is no advertising or analytics tracking on this site, which is why you have not been asked to accept anything.

We never ask an applicant for money, at any stage. If you have been sent something claiming to be an offer from us, you can check whether it is genuine before acting on it.