Privacy Policy

Last Updated: 11-Sep-2026 | Effective Date: 01-Jan-2026

Prufens Advisory Private Limited (hereinafter referred to as “Prufens”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy is issued in accordance with the Digital Personal Data Protection Act 2023 and the rules made thereunder and sets out our practices relating to the personal data submitted by our clients, and their applicants and employees, that we collect, process, use, store, share, and protect in the course of providing our services.

This Policy also applies to other personal data that we collect from third parties and other sources in connection with our background verification and credential-screening services. All personal data is collected, processed, shared, and stored in compliance with applicable law.

The provisions of this Privacy Policy apply to all personal data collected by or made available to Prufens as part of its business processes, and form part of the terms and conditions for use of our website.

1. About Us

Prufens provides employee background verification, digitization, and HR advisory services to businesses. We release information collected only to the individual(s) or business(es) that originally requested the service. We are committed to protecting the security of, and the right to privacy over, each individual’s personal data collected via a customer website/portal, the Prufens internal portal, or any other source.

2. Data Fiduciary Details

Under the DPDP Act 2023, Prufens acts as the Data Fiduciary in respect of personal data processed for its own business purposes, and may act as a Data Processor where it processes personal data on behalf of, and under instructions from, a client (Data Fiduciary).

3. Scope

This Policy applies to all personal data collected, processed, shared, and maintained by Prufens — from customers, their applicants and employees, to subcontractors and related third parties.

4. Notice: Personal Data We Collect, and Why

In accordance with the notice requirements under the DPDP Act 2023, we set out below the personal data we collect and the purpose for which it is processed.

We currently collect the following personal data, including without limitation:

1. Name
2. Date of birth
3. Gender
4. Email address
5. Postal address
6. Telephone/mobile number
7. Educational qualification records
8. Employment history records

We also collect or access either/all of the following categories of personal data that require an elevated standard of care, including without limitation:

1. Photograph
2. PAN
3. Aadhaar
4. Voter ID
5. Passport
6. Driving licence
7. Bank statement (where required)
8. Credit information (where required)
9. Medical records and history (where required)
10. Employment documents of a Data Principal such as payslip(s), offer letter(s), relieving letter(s), and any other document relevant to the nature of services provided
11. Legal documents relevant to the nature of services provided
12. Birth certificate and other Personally Identifiable Information (PII)-related documents of a Data Principal

The personal data we collect, process, and share is used as part of our business process to conduct credential verification, background screening, digitization, and related HR advisory services requested by our clients.

In general, you may visit this website without disclosing your identity or personal data. We do not use analytics tools to track or collect personal data of website visitors, and we do not link, or seek to link, an IP address with the identity of a computer user.

5. Consent and Legitimate Uses

By accessing our website, or by providing data directly to Prufens through a customer website/portal, the Prufens internal portal, or any other source, you agree and consent to the collection and processing of your personal data for the specific verification and screening purposes described in this Policy.

We process your personal data on the basis of your free, specific, informed, unconditional, and unambiguous consent, given through a clear affirmative action, for the specified purposes set out in this Policy — or, where applicable, on the basis of the “legitimate uses” permitted under the DPDP Act 2023 (for example, compliance with a legal obligation, or for purposes for which you have voluntarily provided your personal data and have not indicated that you do not consent to its use).

Where consent is obtained through a Consent Manager registered with the Data Protection Board of India, you may manage, review, or withdraw your consent through that Consent Manager in accordance with the DPDP Act 2023.

6. Withdrawal of Consent

You have the right to withdraw your consent at any time, with the withdrawal being as easy as giving consent. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to provide services that depend on that data (for example, we may be unable to complete or continue a verification check).

Process: To withdraw your consent, write to us at privacy@prufens.com with the subject line “Withdrawal of Consent,” specifying your identity details and the specific consent you wish to withdraw.

Timeline: Prufens shall process and give effect to a consent withdrawal request within 30 (thirty) days of receipt of a valid request.

7. Security Safeguards

Our security management standards are aligned with ISO 27001:2013 and ISO 9001:2015, internationally recognised standards specifying security management best practices and comprehensive security controls, through which we also meet the requirements of reasonable security practices under the Information Technology Act, 2000 and the DPDP Act 2023.

We maintain physical, technical, and procedural safeguards appropriate to protect your personal data against loss, misuse, copying, damage, modification, and unauthorized access or disclosure. Access to personal data is restricted to employees and related third parties who require such access to carry out verification and screening activities.

8. Personal Data Breach: Notification and Reporting Process

In the event of a personal data breach, Prufens will comply with its notification obligations under the DPDP Act 2023, including intimation to the Data Protection Board of India and to affected Data Principals, as applicable and within the timelines prescribed under the applicable rules.

How to report a suspected breach: If you become aware of, or suspect, any unauthorized access, disclosure, loss, or misuse of your personal data held by Prufens, please report it immediately to privacy@prufens.com with the subject line “Data Breach Report,” including a description of the incident and your contact details.

Our process on receiving a report:

1. Acknowledge receipt of the report and log the incident;
2. Investigate and assess the nature, scope, and severity of the suspected breach;
3. Take immediate containment and remedial measures to limit further exposure;
4. Where the incident is confirmed as a personal data breach, intimate the Data Protection Board of India within the timeline prescribed under the DPDP Act 2023 and applicable rules;
5. Notify affected Data Principals without undue delay, describing the nature of the breach, its likely consequences, and the measures taken or proposed to address it;
6. Document the incident and remedial actions taken as part of our internal compliance records.

9. Retention and Erasure

Prufens retains personal data for a minimum period of one (1) year, and for a maximum period as required by applicable legal, regulatory, and statutory requirements, in line with Prufens’ internal Data Classification and Retention Policy.

Once the purpose for which personal data was collected is no longer being served, and retention is not otherwise required to comply with a legal obligation, contractual requirement, or Prufens’ Data Classification and Retention Policy, we will erase such personal data in accordance with the DPDP Act 2023 and the applicable rules. This may mean personal data is retained beyond the completion or termination of an employment or application process, where necessary to comply with a legal, regulatory, or statutory obligation.

When we dispose of personal data, we use procedures such as shredding of documents and secure erasure of electronic media so that the data cannot practicably be read or reconstructed. We store personal data in our secured workflow management tool and on servers located in India.

10. Contact Details of Grievance Officer

In accordance with the DPDP Act 2023, Prufens has appointed a Grievance Officer, whose contact details are published below to address your concerns and queries regarding the processing of your personal data.

We will endeavor to acknowledge and resolve your grievance within the timelines prescribed under the DPDP Act 2023 and the applicable rules. If you are not satisfied with our response, you may approach the Data Protection Board of India.

11. Processing of Children’s Personal Data

Prufens does not knowingly collect personal data of individuals below 18 years of age without verifiable consent of their parent or lawful guardian, as required under the DPDP Act 2023. Where we become aware that personal data of a child has been inadvertently collected without appropriate consent, we will take steps to erase such data.

12. Processing of Personal Data of Persons with Disabilities

Where a Data Principal is a person with disability who has a lawful guardian appointed under applicable law, Prufens shall obtain consent for the processing of such Data Principal’s personal data from the lawful guardian, on behalf of and in the interest of the Data Principal, in the manner required under the DPDP Act 2023 and the applicable rules.

Prior to relying on such consent, Prufens will take reasonable steps to verify (a) the identity of the lawful guardian, and (b) the validity of the guardianship, using reliable proof of appointment as lawful guardian (such as an order of a jurisdictional court, Local Level Committee, District Court, or Legal Guardianship Certificate issued under applicable disability or mental-health legislation). Where a person with disability does not have a lawful guardian and possesses the legal capacity to consent, such person’s own consent shall be obtained in the same manner as for any other Data Principal under this Policy.

13. Rights of Data Principals

Under the DPDP Act 2023, you have the right to:

1. Access information about the personal data we hold about you and how it is being processed, including a summary of such personal data and the processing activities carried out;
2. Request correction, completion, and updation of your personal data;
3. Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to our retention obligations described in Section 9 above;
4. Have your grievances addressed in a timely manner;
5. Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
6. Withdraw your consent at any time, as described in Section 6 above.

To exercise any of these rights, please contact our Grievance Officer using the details in Section 10 above.

14. Cross-Border Transfer and Disclosure of Personal Data

Prufens may disclose your personal data to third parties in the manner specified below:

1. We may use personal data shared by you or by our client for credential verification and screening purposes, when requested. You and the client agree and permit Prufens to share such personal data with third parties solely for credential verification and screening purposes.
2. We may share your personal data with third parties (including, without limitation, our affiliates, your employers, educational institutions, and statutory authorities) who support Prufens in the delivery of its services, acting as our data processors under contractual obligations to protect your personal data.
3. We may disclose personal data to related third parties outside India for verification purposes where the subject is a foreign national, or is employed or being employed outside India. Such cross-border transfers will be made in compliance with the DPDP Act 2023 and any country-specific restrictions notified by the Central Government of India from time to time.
4. We may disclose personal data where required by law, to government authorities or a court of law, on the basis of a written notice or order. Third parties receiving personal data under this clause shall not disclose it further except for the stated business purpose or as required by a court of law.
5. Prufens may disclose and transfer personal data to a third party who acquires any or all of Prufens’s business units, whether by way of merger, consolidation, or purchase of assets, or by any other permitted method. A prominent notice will be posted on our website to inform you of any such change in ownership or control.

We do not sell, rent, or trade your personal data with third parties for their promotional or business purposes.

15. How We Collect Personal Data

Personal data is provided to Prufens via a customer website/portal, through the Prufens internal portal, or through any other source disclosed to you at the point of collection.

16. Confidentiality of Collected Data

We will not use analytics tools to track or collect personal data of visitors to our site, and we will not link, or seek to link, an IP address with the identity of a computer user. Prufens shall not publish personal data provided by you without your consent, except as stated in this Policy or as required by applicable law.

17. Changes to This Policy

We reserve the right to revise this Privacy Policy from time to time, at our discretion. Any changes will be posted on our website with a revised effective date. We encourage you to review this Policy periodically to stay informed of our current practices.

By accessing or using our website, or by providing personal data directly to Prufens, you acknowledge that you have read, understood, and agree to this Privacy Policy.

18. Severability

Each clause of this Privacy Policy is separate, independent, and severable from every other clause, except where expressly indicated otherwise or where the context requires. A determination that one or more clauses are invalid or unenforceable shall not affect the validity of the remaining clauses.

19. Contact Us

If you have any queries regarding this Privacy Policy or our data practices, please contact us at privacy@prufens.com. We will make all reasonable efforts to address your query.

Note: Paid amount for the services will be non-refundable under any circumstances.

This Privacy Policy is governed by the Digital Personal Data Protection Act 2023 and applicable rules made thereunder.