1. Who we are
Nauvi HR is provided by Nauvi HR. This policy explains how personal data is handled in the service.
2. Our role
For candidate and employee data, the company that invited the candidate (the "Client") is the data fiduciary and decides why and how the data is used. We process that data on the Client's behalf as a data processor. For the contact details of Client users (client admins and HR), we are the data fiduciary.
3. Data we process
- Candidates: name, contact details, date of birth, family and emergency contacts, addresses, identity numbers (PAN, Aadhaar, passport, UAN), bank details, education and employment history, references, uploaded documents, acknowledgements and signatures.
- Client users: name, work email, mobile number, login activity.
- Billing: company name, GSTIN, address and payment references. Card or bank details are handled by our payment partner, not stored by us.
4. Purpose
Candidate data is used only to complete onboarding, verification and joining formalities for the Client. Client user data is used to provide accounts, send service emails and issue invoices.
5. Consent and your rights
Candidates are shown a notice and give their consent before entering any details, and sign a declaration before submitting. Under the Digital Personal Data Protection Act, 2023, you may ask for a summary of your data, its correction or completion, its erasure, or withdraw your consent at any time; you may also nominate a person to exercise these rights for you. Candidates should make these requests to the company that invited them; we help that company respond. Client users may write to our grievance officer below.
6. Security
- Form data, uploaded documents and stored secrets are encrypted at rest; all traffic is encrypted in transit (HTTPS).
- Aadhaar and bank account numbers are masked for HR users; viewing the full number is recorded.
- Each Client's data is isolated and visible only to that Client's authorised users. Platform staff access is protected by two-step sign-in and logged.
- Access to candidate forms requires a one-time code sent to the candidate's email.
If a personal data breach occurs, we will inform the affected Clients and, where required, the Data Protection Board of India and the affected persons without delay and within the time the law sets.
7. Sharing and location
We do not sell personal data. Data is shared only with service providers needed to run the service (cloud hosting, email delivery, payment processing by Razorpay) under confidentiality obligations, or where required by law. Data is stored on servers in India.
8. Retention
Data is kept for as long as the Client's account is active and for the period the Client needs for its legal and employment records. Personal data of candidates who did not join (link expired, withdrawn or no-show) is erased after the period the Client decides. When a Client account is closed, its data is deleted after the notice period unless the law requires us to keep it. Invoices are kept for the period tax law requires.
9. Cookies
The app and candidate links use only essential cookies: to keep you signed in, protect forms and remember your cookie choice. On our public website, with your permission only, we may also use analytics cookies (Google Analytics) to understand how the website is used and marketing cookies (Meta Pixel) to measure our advertising. You can change your choice at any time from "Cookie settings" at the foot of the website. These cookies are never used inside the app or on candidate links.
10. Grievances and contact
Grievance officer: the support email shown in the application. We acknowledge grievances promptly and respond within the time required by the DPDP Rules. Candidates should first contact the company that invited them. If you are not satisfied with the response, you may approach the Data Protection Board of India.
11. Changes
We may update this policy. The current version is always available on this page.