Introduction

This Privacy Policy explains how Infraveo Technologies Private Limited (trading as AxureOne) ("AxureOne", "we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you use axureone.com (the "Site") and our recruitment services. Our registered office is at Ahmedabad, Gujarat 382424, India.

We are a boutique recruitment firm serving two audiences: companies that want to hire, and candidates looking for a role. This policy applies to both, and to anyone who simply visits the Site.

This policy is written to align with India’s Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Information Technology Act, 2000 together with the rules made under it. In relation to the personal data we collect, we act as a "Data Fiduciary" — the entity that decides why and how your personal data is processed — and you are the "Data Principal".

By using the Site or submitting a form, you confirm you have read this policy. Where the law requires your consent, we ask for it at the point you provide your data.

Personal data we collect

We only collect personal data that you choose to give us, or that is generated automatically when you browse the Site. Specifically:

  • Contact / general enquiry form — your name, work email, phone number (optional), company name (optional), and the message you send us. Stored in our CRM as a lead/enquiry record.
  • "Post a role" form (for companies) — company name, contact name, work email, phone number (optional), the role title, and the role details you enter. Stored in our CRM as a lead.
  • "Submit your CV" form (for candidates) — your name, email, phone number (optional), current role (optional), years of experience (optional), LinkedIn URL (optional), any message you add, and the résumé/CV file you upload (PDF or Word). Stored in our applicant-tracking system as a candidate record. Your CV may itself contain further details you have chosen to include, such as work history, education, and references.
  • "Book a call" — when you use the embedded scheduling widget to book a call, you provide your name, email, and a chosen time slot.
  • Technical and usage data — collected automatically, this includes your IP address, approximate location derived from it, device and browser type, the pages you view, and referring links. This comes from our analytics and from our security/anti-abuse measures (see “Cookies and analytics” and “How we keep your data secure” below).

We do not ask for, and you should not send us, special-category or sensitive information (for example government ID numbers, financial account details, health, caste, religion, or biometric data). Please keep your CV to information relevant to your professional candidacy.

How and why we use your personal data

We use personal data only for the purposes you would reasonably expect from a recruitment firm:

  • To respond to enquiries and requests from companies about hiring with AxureOne.
  • To evaluate candidates against open roles, and — with your knowledge — to introduce suitable candidates to prospective employers.
  • To schedule and conduct calls and interviews, including through our scheduling tool.
  • To operate, maintain, secure, and improve the Site, including preventing spam, fraud, and abuse of our forms.
  • To communicate with you about your enquiry, application, or an engagement, and to send service-related messages.
  • To comply with applicable law and to establish, exercise, or defend legal claims.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.

Lawful basis and consent

Under the DPDP Act, we process personal data on one of two grounds:

  • Your consent — given freely, specifically, and unambiguously at the point you submit a form or otherwise provide your data for a stated purpose; and
  • Certain legitimate uses recognised by the Act — for example, where you voluntarily provide your personal data to us for a specified purpose and have not indicated that you object to its use for that purpose (such as submitting your CV to be considered for a role).

You can withdraw your consent at any time — as easily as you gave it — by emailing hello@axureone.com. Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it, and it may limit our ability to consider you for a role or respond to your enquiry. Where you withdraw consent, we will stop the relevant processing and delete or anonymise the data unless we are required by law to retain it.

Cookies and analytics

The Site uses a small number of cookies and similar technologies, in two categories:

  • Strictly necessary / functional — needed to serve the Site securely and to protect our forms from bots and abuse (for example, the Cloudflare Turnstile challenge and our hosting on Netlify). The Site cannot function properly without these.
  • Analytics — we use Google Analytics 4 to understand, in aggregate, how the Site is used (pages viewed, approximate location, device and browser type) so we can improve it. Google Analytics sets cookies such as _ga and _gid. In our configuration, IP addresses are handled by Google in a truncated/anonymised form and we do not use them to identify you individually.

We do not use advertising, marketing, or cross-site tracking cookies, and we do not run third-party ad networks. Analytics loads only on the live production site, not in development. You can block or delete cookies through your browser settings; disabling analytics cookies will not stop the Site from working. You can also install Google’s browser add-on to opt out of Google Analytics.

Who we share your data with (processors and sub-processors)

We run on established third-party services that process personal data on our behalf, under our instructions, as our data processors. We share your data with them only to the extent needed to provide our services:

  • Our data-platform provider — our CRM (company enquiries and “post a role” leads), our applicant-tracking system (candidate profiles, CVs, and the hiring pipeline), and our scheduling tool (call scheduling).
  • Google LLC — Google Analytics 4, for aggregate Site usage measurement.
  • Cloudflare, Inc. — Turnstile, our anti-bot / CAPTCHA challenge on the Site’s forms.
  • Netlify, Inc. — hosting and delivery of the Site.

Where we introduce a candidate to a prospective employer, we share the relevant parts of your candidate profile and CV with that employer so they can evaluate you — this is the core purpose for which candidates provide their details to us. We do not otherwise sell, rent, or trade your personal data. We may disclose personal data if required to do so by law, court order, or a lawful request from a public authority, or to protect our rights, safety, or property.

International data transfers

Some of the processors above are headquartered outside India (for example, Google, Cloudflare, and Netlify are US-based; our CRM/applicant-tracking platform provider is headquartered in India but operates global data centres). As a result, your personal data may be processed or stored on servers located outside India. Where this happens, we transfer data only to the extent permitted under the DPDP Act and other applicable law, and we rely on these providers’ own security and data-protection commitments to keep your data protected to a comparable standard.

How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes described in this policy, or for as long as the law requires. Our default retention periods are:

  • Candidate data (your profile and CV in our applicant-tracking system) — retained for up to 24 months from your last meaningful interaction with us, so we can consider you for suitable roles, unless you ask us to erase it sooner or withdraw your consent.
  • Company enquiry and “post a role” data (in our CRM) — retained for up to 12 months from our last contact, unless it leads to an active client engagement, in which case it is kept for the duration of that engagement and any period we are required to retain records for.
  • Call-scheduling data (in our scheduling tool) — retained only as long as needed to arrange and follow up on the call, after which it is deleted or folded into the relevant CRM/applicant-tracking record.
  • Analytics data (Google Analytics) — retained in line with Google Analytics’ configured retention window; aggregated and anonymised statistics that no longer identify you may be kept for longer.

When a retention period ends, or when data is no longer needed for the purpose it was collected for, we delete or anonymise it. We may retain limited information for longer where we are legally required to, or to resolve disputes and enforce our agreements.

How we keep your data secure

We take reasonable technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or misuse, in line with the requirements of the DPDP Act and the Information Technology Act, 2000. These include:

  • Encryption of data in transit using HTTPS/TLS across the Site.
  • Relying on the enterprise-grade security controls of our established processors (our CRM/ATS provider, Google, Cloudflare, Netlify) for the systems that store your data.
  • Access controls that limit internal access to personal data to authorised personnel who need it to do their job.
  • Anti-abuse measures on our forms — a Cloudflare Turnstile CAPTCHA, rate limiting by IP address, and hidden anti-spam fields — to prevent automated misuse.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to affect you, we will take the steps required of us under the DPDP Act, including notifying the Data Protection Board of India and affected individuals as applicable.

Your rights as a Data Principal

Subject to the conditions and exemptions in the DPDP Act, you have the right to:

  • Access — obtain a summary of the personal data we hold about you, how we are processing it, and the identities of the processors and other parties with whom it has been shared.
  • Correction and completion — have inaccurate or misleading data corrected, and incomplete data completed or updated.
  • Erasure — request that we delete personal data that is no longer necessary for the purpose it was collected for, unless we are required by law to keep it.
  • Withdraw consent — withdraw your consent at any time, as easily as you gave it.
  • Grievance redressal — raise a grievance with us about how we handle your data, with a right to escalate to the Data Protection Board of India if it remains unresolved.
  • Nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email hello@axureone.com with your name and details of your request. We may need to verify your identity before acting. We will respond within a reasonable time and in any case within the timelines required by applicable law. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

Grievance Officer

If you have any question, concern, or grievance about how we handle your personal data, you can contact our Grievance Officer, who is responsible for addressing data-protection requests and complaints:

  • Name: Anand Sharma
  • Designation: Grievance Officer
  • Email: hello@axureone.com
  • Address: Infraveo Technologies Private Limited, Ahmedabad, Gujarat 382424, India

We aim to acknowledge and address grievances promptly. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.

Children’s data

The Site and our services are intended for working professionals and companies, and are not directed at children. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we have collected personal data from a child without the verifiable consent of a parent or lawful guardian, we will delete it. If you believe a child has provided us with personal data, please contact us so we can remove it.

Third-party links

The Site may link to third-party websites or services (for example, an employer’s site or a social profile). We are not responsible for the privacy practices or content of those third parties. We encourage you to read their privacy policies before providing them with your personal data.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date at the top of this page reflects the most recent revision. Where a change is significant, we will take reasonable steps to bring it to your attention.

Contact us

Questions about this policy or how we handle your personal data? Email hello@axureone.com, or write to us at Infraveo Technologies Private Limited (trading as AxureOne), Ahmedabad, Gujarat 382424, India.