Privacy Policy
Last Updated: 3rd June 2026
1. Who We Are
Peepal Technology and Management Consulting Private Limited (“we,” “us,” “our,” “Peepal Consulting”) is a recruitment and staffing firm based in Bengaluru, specialising in RPO, contract hiring, executive search, contract staffing, and recruitment consulting.
For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Peepal Consulting acts as a Data Fiduciary – meaning we determine the purpose and means of processing your personal data.
Registered Address: 2C, Second Floor, C Wing, Mittal Tower, MG Road, Bengaluru, Karnataka – 560042
Contact: hr@peepalconsulting.com
2. What This Policy Covers
This policy applies to all personal data we collect and process in connection with our recruitment services, business development activities, marketing, website, and internal hiring. It applies to:
-
- Candidates we source, engage, or place on behalf of client companies
- Candidates who apply to work at Peepal Consulting directly
- Client companies and their representatives
- Inbound leads and enquiries received through our website or marketing channels
- Anyone we contact in the course of our business development activities
This policy is published on our website at peepalconsulting.com and is linked from our contact and registration forms. Peepal Consulting’s services are intended for working professionals and corporate entities. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete it.
3. What Data We Collect and How
We collect personal data through several distinct channels across our candidate-facing and client-facing operations.
3a. Candidates – External Sourcing
We actively source candidates through professional networks, job boards, AI-assisted sourcing tools, and our own historical database. Through these channels we may collect:
-
- Name, contact number, and email address
- Current and previous employer, designation, and work history
- Educational background and professional certifications
- Current CTC and expected CTC
- Location and availability
Candidates sourced from job boards such as Naukri.com have consented to being contacted by recruiters by virtue of their presence and active profile on those platforms. Candidates sourced from professional networks such as LinkedIn or third-party data platforms have not given prior consent to being contacted by Peepal Consulting specifically – please refer to Section 4 for how we handle the lawful basis in these cases.
3b. Candidates – Inbound Applications
When a candidate applies to a role through our website, a job posting, or directly contacts us, we collect the information they voluntarily provide – typically name, contact details, resume, work history, current and expected CTC, and any other information included in their application.
3c. Candidates – Internal Hiring at Peepal Consulting
When individuals apply to work at Peepal Consulting itself, we collect name, contact details, resume, educational and professional background, current and expected CTC, and any other information provided during the application and interview process.
3d. Client Companies
When we engage with a company as a recruitment client – whether through inbound enquiry or outbound outreach – we collect contact details of relevant individuals at that organisation, typically name, designation, work email, and phone number. We also collect information about the organisation’s hiring requirements, role specifications, budgets, and timelines as shared with us in the course of the engagement.
3e. Inbound Leads – Website & Marketing
When someone submits an enquiry through our website contact form, a marketing landing page, or responds to a campaign, we collect the information they provide – typically name, organisation, designation, email address, and the nature of their enquiry. Inbound leads may be candidates, potential clients, or individuals enquiring about Peepal Consulting’s own open roles.
3f. Business Development Outreach
We reach out to potential client companies through cold calls, email, phone, LinkedIn, and WhatsApp using contact data sourced from professional networks, third-party platforms, and our own historical CRM database. This includes reactivation outreach to companies we have previously worked with. Where outreach is made by phone or cold call, our team will verbally offer the individual the option to opt out of further contact at the start of the call, and opt-outs communicated verbally will be recorded and actioned in our CRM within a reasonable time. Where outreach is made via WhatsApp, every message will include a clear opt-out instruction such as ‘Reply STOP to opt out of further contact.’ All other outbound communications including email will include a clear written opt-out mechanism. Upon opting out through any channel, we will cease all further contact and remove the individual from our active outreach lists.
4. Why We Process Your Data and Our Lawful Basis
We process personal data only for specific, stated purposes. Under the DPDP Act, every processing activity must rest on either consent or a legitimate use under Section 7 of the Act.
4a. Candidate Data – Job Board Sourcing
Purpose:
To evaluate candidate suitability for open roles, initiate contact, and progress the recruitment process on behalf of client companies or for Peepal Consulting’s own hiring.
Lawful Basis:
Section 7(a) of the DPDP Act – candidates present on job boards have voluntarily provided their personal data and indicated willingness to be contacted by recruiters for employment purposes, and have not indicated otherwise. Processing is limited to recruitment purposes only.
4b. Candidate Data – LinkedIn and Third-Party Platform Sourcing
Purpose:
To evaluate candidate suitability for open roles and initiate contact.
Lawful Basis:
Section 7(i) of the DPDP Act – processing for employment-related purposes. We acknowledge that candidates sourced from LinkedIn or third-party platforms such as Apollo.io have not given prior consent to being contacted by Peepal Consulting specifically. Accordingly, every first outreach will include a clear opt-out, and upon opt-out we will cease all further contact and remove the individual from our active lists. This basis represents our reasonable interpretation of the Act pending further regulatory guidance on recruitment sourcing practices.
4c. Candidate Data – Inbound Applications
Purpose:
To evaluate the candidate for the role applied for, manage the recruitment process, and where relevant, consider the candidate for other suitable roles.
Lawful Basis:
Your consent, given by submitting your application.
4d. Candidate Data – Sharing with Client Companies
Purpose:
When a candidate is being considered for a role at a client company, we share their profile – including resume, professional history, and CTC details – with that client. Candidates are informed of the specific client company before their profile is shared.
Lawful Basis:
Your consent, given in the context of actively pursuing a specific role with a specific client. CTC information is shared only to the extent necessary for the client to assess the role and will not be shared beyond the relevant hiring team.
4e. Internal Hiring at Peepal Consulting
Purpose:
To evaluate applicants for roles at Peepal Consulting, manage the interview and selection process, and maintain records of hiring decisions.
Lawful Basis:
Your consent, given by submitting your application, and Section 7(i) of the DPDP Act – processing necessary for employment purposes.
4f. Client Company Data
Purpose:
To manage client relationships, deliver recruitment services, coordinate hiring workflows, and maintain records of engagements.
Lawful Basis:
Section 7(i) of the DPDP Act – processing necessary for the performance of professional and contractual obligations between organisations, and Section 7(a) – processing for purposes for which the individual has voluntarily shared their contact details in a professional capacity.
4g. Business Development Outreach
Purpose:
To introduce Peepal Consulting’s services to potential client companies, follow up on prior engagements, and reactivate dormant client relationships.
Lawful Basis:
Section 7(i) of the DPDP Act — processing for purposes related to business development and professional engagement. We acknowledge that individuals contacted through outbound BD outreach — including cold calls, emails, LinkedIn messages, and WhatsApp messages — have not given prior consent. Accordingly, every outbound communication will include a clear and easy opt-out mechanism appropriate to the channel, and upon opt-out we will cease all further contact and remove the individual from active outreach lists. This basis represents our reasonable interpretation of the Act pending further regulatory guidance.
4h. Inbound Leads
Purpose:
To respond to the enquiry and, where relevant, follow up on a potential client or candidate relationship.
Lawful Basis:
Your consent, given by submitting the enquiry form or contacting us directly.
4i. Website Analytics & Marketing
Purpose:
To understand how our website is used, measure the performance of marketing campaigns, and improve our digital presence.
Lawful Basis:
Your consent, where required, given through cookie acceptance on our website. Aggregated or anonymised analytics data that cannot identify you is not subject to this policy.
5. How Long We Keep Your Data
We do not retain personal data longer than necessary. We erase personal data once the purpose for which it was collected is no longer being served, or upon a valid erasure request, whichever is earlier – unless retention is required by applicable law.
Where we are legally required to retain records – for example financial or contractual records related to client engagements – we retain only the minimum data necessary for that obligation and for no longer than the law requires.
When data is due for deletion, we will erase it from our active systems and instruct any Data Processors handling data on our behalf to do the same.
The table below summarises our approach by data type:
| Data Type | Basis for Retention | Trigger for Deletion |
|---|---|---|
| Sourced candidate profiles (job boards) | Section 7(a) – voluntary platform presence | Purpose served, opt-out, or erasure request |
| Sourced candidate profiles (LinkedIn / Apollo) | Section 7(i) – employment purposes | Purpose served, opt-out, or erasure request |
| Inbound candidate applications | Consent | Purpose served or erasure request |
| Active placement records | Consent + contractual obligation | Purpose served or legal retention period expires |
| Internal hiring applications | Consent + Section 7(i) | Purpose served or erasure request |
| Client contact & engagement data | Section 7(i) + contractual obligation | End of relationship + legal obligations served |
| BD outreach records | Section 7(i) | Opt-out – actioned within reasonable time |
| Inbound leads | Consent | Purpose served or erasure request |
| Website analytics data | Consent / anonymised | Anonymised on collection or erasure request |
6. Who Else Has Access to Your Data
6a. Client Companies
As described in Section 4d, candidate profiles are shared with client companies for the specific role the candidate is being considered for. Client companies act as independent Data Fiduciaries once they receive candidate data and are responsible for their own compliance with applicable law. Clients are contractually bound to use candidate data solely for the purpose of evaluating the relevant hire and in compliance with applicable data protection laws.
6b. Data Processors
We use the following third-party platforms to process and store data on our behalf. These platforms act as Data Processors under our instructions:
-
- Zoho CRM – Client and candidate relationship management
- Apollo.io – Business development prospecting
- LinkedIn Recruiter – Candidate and client sourcing
- Naukri.com and similar job boards – Candidate sourcing
- Google Workspace – Internal communications and document management
- AI-assisted sourcing tools – Candidate identification and outreach support
The specific tools in use may change over time. If you have questions about which platforms currently process your data, write to us at hr@peepalconsulting.com.
6c. Legal & Regulatory Disclosure
We may disclose personal data to a court, tribunal, regulatory authority, or government body where required by law or a lawful order, in accordance with Sections 7(c), 7(d), and 7(e) of the DPDP Act.
6d. No Sale of Data
We do not sell personal data to any third party under any circumstances.
7. Cross-Border Data Transfers
Some platforms we use – including LinkedIn, Apollo.io, and Google Workspace – are operated by entities headquartered outside India and may process or store data on servers located outside the territory of India. Such transfers are subject to Section 16 of the DPDP Act and the data protection frameworks of the respective platforms.
We ensure that all Data Processors are engaged under legally binding contracts that require them to protect personal data with standards consistent with the DPDP Act. If you have concerns about cross-border processing, please contact us at hr@peepalconsulting.com.
8. Data Security
We implement reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. This includes access controls on our CRM and data platforms, limited internal access on a need-to-know basis, and secure handling of candidate profiles and CTC data.
In the event of a personal data breach that is likely to affect your rights or interests, we will notify the Data Protection Board of India and inform affected individuals in the manner and form prescribed under the DPDP Act, without undue delay.
9. Your Rights
Under the DPDP Act, 2023, you have the following rights in relation to personal data we hold about you. These apply whether you are a candidate, a client contact, an inbound lead, or someone we have reached out to.
9a. Right to Access
You may request a summary of the personal data we hold about you, the purposes for which we are processing it, and the identities of any third parties – including client companies – with whom we have shared it.
9b. Right to Correction
You may request that we correct any inaccurate or incomplete personal data we hold about you.
9c. Right to Erasure
You may request deletion of your personal data. Upon receiving a valid request, we will erase your data from our active systems and instruct our Data Processors to do the same, unless retention is required by law. Please note that data already shared with client companies prior to your request cannot be recalled by us – client companies are independent Data Fiduciaries responsible for their own compliance.
9d. Right to Withdraw Consent
Where we process your data on the basis of your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that occurred before withdrawal. We will cease processing your data for the relevant purpose within a reasonable time following withdrawal.
9e. Right to Grievance Redressal
If you believe we have handled your personal data in a manner inconsistent with this policy or the DPDP Act, you may raise a grievance with us using the contact details in Section 11. We will respond within the timeframe prescribed under the DPDP Act. If you are not satisfied with our response, you have the right to escalate to the Data Protection Board of India.
9f. Right to Nominate
You have the right to nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity, in accordance with Section 14 of the DPDP Act. To register a nomination, write to us at hr@peepalconsulting.com.
9g. Language Options
In accordance with Section 5(3) of the DPDP Act, you have the option to access this policy and any consent request in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India. To request a translated version, write to us at hr@peepalconsulting.com.
To exercise any of the above rights, write to us at hr@peepalconsulting.com with the subject line “Data Rights Request.” We will acknowledge your request within 72 hours and resolve it within the period prescribed under applicable law.
10. Cookies & Website Tracking
We use cookies and similar technologies on our website for essential functionality, website analytics, and marketing purposes including LinkedIn Ads, Google Analytics, and remarketing campaigns.
You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. Where cookies process personal data, we rely on your consent given through your browser or cookie settings.
11. Grievance Contact
For any questions, concerns, or requests related to your personal data, contact:
Name: Renjith K
Email: hr@peepalconsulting.com
Address: 2C, Second Floor, C Wing, Mittal Tower, MG Road, Bengaluru, Karnataka – 560042
If your concern is not resolved to your satisfaction, you may approach the Data Protection Board of India at the contact details published on their official website.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, the platforms we use, or applicable law. When we make material changes, we will notify affected individuals via email or a notice on our website. Where a material change affects how we process data in a way that requires fresh consent, we will seek that consent before proceeding. The date at the top of this policy reflects when it was last updated.
© 2026 Peepal Consulting. All rights reserved.
