Your rights under the DPDP Act 2023

India's Digital Personal Data Protection Act 2023 gives you rights over your personal data. This page says what those rights are, who to ask, and what we can and cannot do ourselves.

Who is responsible for your data

The Act calls the organisation that decides why data is processed the Data Fiduciary, and the person the data is about the Data Principal. That is you.

• If you are an employee or a candidate, the company using Kaziyo is the Data Fiduciary. Kaziyo is their processor. Your rights are exercised against them, and we will help you reach them.
• If you asked for access on our website, Kaziyo is the Data Fiduciary and you can exercise your rights directly with us.

Consent and purpose limitation

We use personal data only for the purpose it was given for. In practice that means:

• A CV given to apply for a job is used to assess that application. It is not used to market to you, and it is not shared with any other company using Kaziyo.
• A policy acknowledgement is used to record that you were shown a specific document. It is not performance data.
• An access request from our website is used to reply to you. There is no mailing list.

Where an employer relies on your consent, the Act requires that notice to be clear and available in English and in the languages in the Eighth Schedule of the Constitution. [CONFIRM WHICH LANGUAGES THE CANDIDATE NOTICE MUST BE OFFERED IN, AND ARRANGE TRANSLATION. The notice is currently English only.]

Your rights

The right to know what is held about you

You can ask for a summary of the personal data being processed about you and what it is being used for, and who it has been shared with.

The right to correction and erasure

You can ask for data that is wrong, misleading or incomplete to be corrected, and for data no longer needed for its purpose to be erased. Two honest limits: an employer may be required by other law to keep parts of an employment record, and a policy acknowledgement cannot be edited without destroying the only thing it is for.

The right to nominate

You may nominate somebody to exercise these rights on your behalf if you die or become incapacitated. Kaziyo does not currently have a screen for recording a nomination. Contact the Data Fiduciary directly, or us at privacy@kaziyo.com, and we will record it manually.

The right to grievance redressal

You can complain to the Data Fiduciary and have your complaint dealt with. Ask the company first. If they do not respond, or you are not satisfied, you may complain to the Data Protection Board of India.

How to exercise a right

Email privacy@kaziyo.com, saying which company you are asking about and the email address they hold for you.

• We acknowledge within [ACKNOWLEDGEMENT TIME, e.g. 3 working days].
• If Kaziyo is the Data Fiduciary, we answer within [RESPONSE TIME, e.g. 30 days], which is [CONFIRM AGAINST THE PERIOD PRESCRIBED BY THE DPDP RULES].
• If a customer is the Data Fiduciary, we pass it to them and confirm to you that we have, within [FORWARDING TIME].

Named contact

[NAME AND TITLE OF THE PERSON RESPONSIBLE FOR ANSWERING DATA PROTECTION QUESTIONS], reachable at privacy@kaziyo.com.

We are not currently a Significant Data Fiduciary and so are not required to appoint a Data Protection Officer. If we are notified as one, a DPO will be named here.

Children

Kaziyo is workplace software and is not intended for anybody under 18. We do not knowingly process children's data. [CONFIRM THE POSITION ON APPRENTICES AND INTERNS UNDER 18, WHERE SECTION 9 VERIFIABLE PARENTAL CONSENT WOULD APPLY.]