How we process data for our customers.

This agreement is between the customer that owns a CandiLyt workspace ("Customer") and BizHues Private Limited ("CandiLyt").

For Customer Personal Data, the Customer is the data fiduciary and CandiLyt is its data processor under section 8(2) of the Digital Personal Data Protection Act, 2023 (DPDP Act). A signed copy is available on request from [email protected].

• Customer Personal Data: personal data that the Customer, its users or its candidates put into the workspace, and personal data CandiLyt produces from it (such as CV matches, interview kits and reports).
• Service Provider: a third party CandiLyt uses to process Customer Personal Data (a sub-processor).
• Breach: a personal data breach as defined in the DPDP Act.
• Other terms have the meaning given in the DPDP Act and the DPDP Rules, 2025.

CandiLyt processes Customer Personal Data only to provide the service and only on the Customer's instructions. The Customer's instructions are this agreement, the Terms, and what the Customer's users do in the workspace: opening jobs, adding CVs, running interviews, recording decisions, setting retention, and deleting or exporting data.

CandiLyt tells the Customer if it believes an instruction breaks the law, and does not have to follow it. CandiLyt may also process data where Indian law requires it, and tells the Customer first unless the law forbids that.

• Sell Customer Personal Data or use it for advertising.
• Use it to train AI models, its own or a Service Provider's.
• Use it for its own purposes, except to secure, support and bill the service.
• Make hiring decisions. Matches, ratings and reports are suggestions; a person at the Customer decides.

• Have a lawful basis, including consent where needed, for every candidate's data it adds. Candidates who apply through the CandiLyt apply page give consent there, and each record keeps the exact wording they saw.
• Give candidates notice of how their data is used, and answer their requests as data fiduciary.
• Use job-related criteria, review every suggestion before acting on it, and keep workspace access to authorised people.

Only CandiLyt staff who need access to run or support the service can reach Customer Personal Data. They are bound by confidentiality. Support staff open a workspace only to answer the Customer's request or to keep the service secure.

CandiLyt keeps reasonable security safeguards, as section 8(5) of the DPDP Act and rule 6 of the DPDP Rules require, including:

• encryption in transit and at rest;
• workspace isolation, and role-based access inside each workspace;
• a record of sign-ins and changes, kept for at least one year;
• error reports that leave out form content and personal details;
• daily database backups;
• a written process for detecting and handling breaches.

The Customer authorises the Service Providers listed below and on the Service Providers page. CandiLyt binds each by contract to protect the data at least as well as this agreement does, and stays responsible for them.

Before adding or replacing a Service Provider, CandiLyt emails workspace owners at least 30 days ahead. The Customer can object within that time on reasonable data protection grounds. If the parties cannot resolve it, the Customer can close its workspace and receive a refund of unused purchased jobs.

Customer Personal Data is stored in India (Mumbai). Some Service Providers process it outside India for their part of the service, as listed on the Service Providers page. CandiLyt follows any restriction the Government of India places on transfers to a country under section 16 of the DPDP Act.

The workspace lets the Customer find, correct, export and delete a candidate's data. If a candidate or other person writes to CandiLyt about Customer Personal Data, CandiLyt passes the request to the Customer within 5 working days and does not answer it itself unless the Customer asks. CandiLyt helps the Customer respond where the workspace tools are not enough.

CandiLyt tells the Customer about a Breach affecting Customer Personal Data without delay, and aims to do so within 24 hours of becoming aware. The notice says, as far as known: what happened and when, the data and people affected, the likely consequences, what CandiLyt has done and will do, and a contact person.

CandiLyt updates the Customer as it learns more, and gives what the Customer needs to inform the Data Protection Board and the people affected, including the detailed report due within 72 hours under rule 7 of the DPDP Rules. CandiLyt also reports cyber security incidents to CERT-In within 6 hours.

• Candidate data is kept for the retention period the Customer sets (three months to three years, one year by default) and then anonymised, as described in the privacy policy.
• The Customer can export its workspace at any time. Export files are deleted after 7 days.
• When a workspace is closed, CandiLyt deletes Customer Personal Data 30 days later, so the Customer can export first. Copies leave backups as those backups expire.
• CandiLyt keeps only what the law requires it to keep, such as billing records and security logs, and only for as long as required.

CandiLyt answers the Customer's reasonable written questions about how it protects Customer Personal Data, once a year, or more often after a Breach or when a regulator asks. If those answers are not enough, the Customer may audit, at its own cost, with 30 days' notice, during business hours, through an auditor bound by confidentiality, without access to other customers' data.

Each party's total liability under this agreement is limited to the fees the Customer paid CandiLyt in the 12 months before the claim, except where the law does not allow such a limit.

• This agreement lasts as long as CandiLyt processes Customer Personal Data.
• On data protection, this agreement prevails over the Terms.
• CandiLyt emails workspace owners at least 30 days before a material change. A change that reduces the Customer's protection needs the Customer's agreement; until then the previous version continues to apply to that Customer.

This agreement is governed by the laws of India. The courts at Gautam Buddh Nagar (Noida), Uttar Pradesh, have exclusive jurisdiction.