Privacy Policy

1. Who We Are

Data Fiduciary: GA Design Consultants LLP, operating the platform AEC Job For ME ("we", "our", "Platform"), a job portal exclusively for the Architecture, Engineering, and Construction (AEC) industry in India.

Registered Office: Mumbai, Maharashtra, India.

Platform URL: aecjobforme.in

This Privacy Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and applicable rules thereunder. By using our Platform you acknowledge having read this Policy and consent where required by law.

2. Personal Data We Collect

2.1 Job Seekers

• Identity: Full name, email address, mobile number
• Professional: AEC discipline, experience level, current location/city, skills, portfolio URLs
• Application data: Cover letters submitted with job applications
• Account: Profile picture (optional), account status, subscription plan
• Usage data: Jobs viewed, saved, applied to; salary queries; login timestamps
• Technical: IP address, browser type and version, device type, cookies

2.2 Employers

• Identity: Company name, contact email, mobile number
• Business: GSTIN (optional), company website, office address, company description, company logo
• Listing data: Job postings created, applications received
• Account: Subscription plan, payment history
• Technical: IP address, browser type, device type, cookies

2.3 Data We Do NOT Collect

We do not collect Aadhaar numbers, PAN numbers, biometric data, caste, religion, political opinions, health data, or sexual orientation. We do not knowingly collect data of individuals under 18 years without verifiable parental consent.

3. Purposes of Processing

Purpose	Data used
Account registration and authentication	Name, email, phone, password
OTP-based email verification	Email, OTP code
Matching job seekers to relevant jobs	Discipline, experience, location, skills
Processing job applications	Seeker profile, cover letter shared with employer
Salary insights	Discipline, experience level, location
Payment processing	Subscription details, shared with Razorpay
Transactional emails (OTP, application updates)	Email address
Marketing emails (with consent only)	Email address, job preferences
Platform security and fraud prevention	IP address, login history
Legal compliance and dispute resolution	All data as required

4. Legal Basis for Processing (DPDPA §6 & §7)

• Consent (§6): Explicit, free, specific, informed consent obtained at registration for account creation and data processing. You may withdraw consent at any time via your dashboard.
• Legitimate use (§7): Processing for compliance with Indian law, court orders, or to respond to medical or national security emergencies.
• Contractual necessity: Processing necessary to provide the services you have signed up for (job matching, applications, salary insights).

We do not rely on legitimate interests as a basis to override your rights under the DPDPA.

5. Who We Share Your Data With

• Employers (when you apply): Your name, discipline, experience, location, skills, and cover letter are shared with the employer whose job you apply to. The employer agrees to our Terms of Service and is bound by applicable data protection law.
• Razorpay India Pvt. Ltd.: Payment processor. Your payment details are processed directly by Razorpay under their own Privacy Policy. We do not store card/UPI numbers.
• Email service provider: We use a third-party SMTP service to send transactional and marketing emails. Only your email address and name are shared.
• Government/Law enforcement: We may disclose data where required by Indian law, court order, or to protect legal rights.

We do not sell, rent, or trade your personal data to third parties for commercial purposes.

6. Data Retention

Data type	Retention period
Account data (active)	Duration of account + 30-day cooling period after deletion request
Job applications	2 years after job closure
Payment records	7 years (Income Tax Act, 1961 requirement)
Consent logs	7 years from consent date
Support / grievance records	3 years from resolution
Server logs / IP data	90 days
Inactive accounts (no login)	Notified at 18 months; deleted at 24 months of inactivity

After the applicable retention period, personal data is permanently deleted or anonymised such that it can no longer be linked to an individual.

7. Children's Data (DPDPA §9)

Our Platform is intended for working professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If a child has registered, a parent or guardian may contact our Grievance Officer to request deletion of that data. We will delete it within 48 hours of verification.

We do not conduct behavioural tracking or targeted advertising directed at children.

8. Cross-Border Data Transfers

Your personal data is stored on servers located within India. If we need to transfer data internationally (e.g., third-party services with servers outside India), we will do so only to countries notified as permissible by the Government of India under the DPDPA. We will ensure appropriate contractual safeguards are in place.

9. Security Measures (DPDPA §8)

• Passwords are hashed using bcrypt — we never store plaintext passwords
• All data transmission over HTTPS/TLS
• Role-based access control for internal staff
• CSRF protection on all forms
• Rate limiting on login and OTP endpoints
• Regular security audits
• Personal data access logs maintained

In the event of a personal data breach, we will notify the Data Protection Board of India within 72 hours and affected data principals without undue delay, as required by DPDPA §8(6).

10. Your Rights Under the DPDPA, 2023

Right	Section	What it means
Right to access	§11	Obtain a summary of personal data we hold about you and know who it has been shared with
Right to correction	§12	Correct inaccurate or misleading personal data
Right to erasure	§12	Request deletion of your personal data (subject to legal retention obligations)
Right to grievance redressal	§13	File a grievance with our Grievance Officer; response within 48 hours
Right to nominate	§14	Nominate another individual to exercise these rights on your behalf in case of death or incapacity
Right to withdraw consent	§17	Withdraw any consent previously given; withdrawal is as easy as giving consent

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. However, it may mean we can no longer provide certain services to you.

11. How to Exercise Your Rights

You can exercise all rights listed above through:

1. Dashboard (fastest): Log in → navigate to Privacy & Data Rights → select your request type. We process requests within 48 hours.
2. Email: Write to grievance@aecjobforme.in with subject "DPDPA Rights Request — [Request Type]"
3. Escalation: If your grievance is not resolved, you may approach the Data Protection Board of India at dpboard.gov.in

12. Grievance Officer (DPDPA §13)

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email at least 15 days before the changes take effect and update the "Effective date" at the top. Continued use of the Platform after that date constitutes acceptance of the revised Policy.

Past versions of this Policy are available on request from our Grievance Officer.

14. Contact Us

For any questions about this Privacy Policy or your personal data:

• Email: privacy@aecjobforme.in
• Grievance: Grievance Policy & Officer details
• Dashboard Rights Portal: Log in → Privacy & Data Rights