Privacy Policy

This Privacy Notice applies to individuals who visit the Website, submit forms (enquiry, careers, contact), apply for roles, or otherwise interact with public Agratas digital services. It does not apply to employee HR records (which are covered by a separate Employee Privacy Notice). For the data collected and processed by third-party websites, please read those third parties’ privacy notices.

We process your personal data only for lawful purposes and in accordance with applicable data protection laws, including the DPDPA (India), GDPR/UK GDPR (EU/UK), CPRA (California), PIPL (China), and PIPA (South Korea). The purposes for which we process your data, along with the lawful bases permitted under these laws, are described below.

a.       Purposes of Processing

We process personal data for the following purposes:

b.        Processing Based on Consent

Where we rely on consent (e.g., marketing communications, optional cookies, certain recruitment-related data, or processing of sensitive data where applicable), you may withdraw your consent at any time by contacting us at dpo@agratas.com. Withdrawal will not affect the lawfulness of processing conducted before the withdrawal.

c.       Special Circumstances

We may process personal data without consent where required:

·       to comply with legal obligations under applicable jurisdictions

·       to protect our rights or respond to law enforcement requests

·       to ensure network and information security

·       to protect the vital interests of any individual during emergencies

These grounds are used strictly in accordance with applicable laws and only where necessary.

For the purposes set out in the ‘The purpose for which we collect your Personal Data’ section above, subject to your consent, we may share your personal information with our third-party providers:

These may include for example:

• Those we engage to host and maintain the website and IT systems.
• During our recruitment process, Agratas may engage with third-party service providers and partners to facilitate various aspects of our hiring procedures.
• Analytics and search engine service providers that assist us in the improvement and optimisation of this website.
• Legal advisers
• Those who assist us with or partner with us in marketing campaigns.
• Our clients.
• Our suppliers and sub-contractors, the suppliers and subcontractors of our clients where required.
• Other companies in the Agratas group.

Additionally, we will disclose your personal information to the relevant third party:

• If we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets.
• To third parties when it is necessary for the establishment, exercise, or defence of legal claims.
• If we are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
• If we choose to exercise a legal power to do so.
• If we are under a duty to disclose or share your personal data to comply with any legal obligation, or to enforce or apply contractual terms or other agreements; or to protect the rights, property, or safety of ourselves our customers, our regulator, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

• As part of our recruitment process, Agratas uses an automated CV screening tool to assist in evaluating job applications. This section explains how this tool operates and what it means for you as an applicant.
  
  
• When you submit a job application through our website, your CV and application details are first stored in our applicant tracking system (SuccessFactors). Your CV is then processed through an automated screening tool, which scores your application against the Job Description for the role you have applied for. This score is used to assist our recruitment team in the shortlisting process. This process constitutes profiling as defined under applicable data protection law, as it involves the automated evaluation of personal data to assess your suitability for the role.
  
  
• Your CV will receive a score based on how it matches the requirements of the Job Description for the role applied for. [A member of our recruitment team reviews all scored applications before any shortlisting decision is made.] No candidate is shortlisted or rejected solely on the basis of the automated score without human review.
  
  
• The CV screening tool is hosted on Agratas infrastructure at our Bangalore office. Your CV data does not leave Agratas systems at any point during this process.
• We process your CV data through this tool on the basis of [legitimate interests (UK GDPR) / consent (DPDPA)] in connection with our recruitment activities. [Where we rely on legitimate interests, Agratas has a legitimate interest in efficiently and consistently assessing candidates against role requirements. This interest is balanced against your right to meaningful human review of your application, which is preserved as described below.]
  
  
• If your application is successful, your CV and application data will be retained for the duration of your employment plus 3 years. If your application is unsuccessful, your CV and application data will be retained for a maximum duration of 12 months.
  
  
• In connection with the automated processing described in this section, you have the following rights:
  • To request that a member of our recruitment team personally reviews your application without reliance on the automated score;
  • To express your point of view regarding any automated assessment of your application; and
  • To contest any decision made in connection with your application where you believe the automated assessment has not accurately reflected your suitability for the role.

• As part of our recruitment process, Agratas may invite you to participate in a voluntary feedback survey following your interview. This survey is designed to help us improve our recruitment process and candidate experience.
  
  
• Participation in the survey is entirely voluntary and has no bearing on your application or its outcome. You may decline to participate without consequence.
  
  
• Survey responses are collected and processed through an internal Agratas tool. Your data does not leave Agratas infrastructure at any point during this process.
  
  
• We process your survey responses on the basis of your consent. You may withdraw your consent at any time by contacting us at dpo@agratas.com, though withdrawal will not affect the lawfulness of processing carried out before withdrawal.
  
  
• Survey responses are not retained in identifiable form and are not stored beyond initial processing.

Agratas may transfer your personal data to a jurisdiction different from the one in which you reside, in accordance with applicable data‑protection laws. Agratas will ensure that any international transfer of your personal data is conducted through appropriate and lawful transfer mechanisms and will not transfer personal data to any country that is restricted or prohibited under applicable regulations. Where personal data is transferred within our group entities across jurisdictions, we take reasonable steps to ensure that such transfers are protected and comply with applicable data protection requirements.

Our websites may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites, are not responsible for their privacy statements or their security practices or their content. When you leave our website, we encourage you to read the privacy notice of every website you visit.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider your consent to this Privacy Notice or its withdrawal thereof, the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

To ensure clarity across jurisdictions, the following describes each right in simple terms:

1. Right to Be Informed: You have the right to receive clear information about how we collect, use, share, store, and protect your personal data. This Privacy Notice fulfils that obligation.
   
   
2. Right of Access: You may request a copy or summary of the personal data we hold about you, along with information on how and why it is processed.
   
   
3. Right to Correction (Rectification): You may ask us to correct or update any inaccurate, incomplete, or outdated personal data.
   
   
4. Right to Erasure / Deletion: You may request that we delete your personal data where it is no longer necessary, where you withdraw consent, or where deletion is required by law. (Deletion may not apply when we are legally required to retain data.)
   
   
5. Right to Withdraw Consent: Where processing is based on consent (e.g., marketing), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
   
   
6. Right to Restrict Processing: In certain cases (e.g., dispute on accuracy), you may request that we temporarily restrict the use of your personal data.
   
   
7. Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format, or that we transfer it to another organization.
   
   
8. Right to Object: You may object to certain types of processing, such as processing based on legitimate interests or direct marketing.
   
   
9. Rights Related to Automated Decision-Making: You have the right to request human intervention, express your viewpoint, or contest decisions that are made solely through automated means and have legal or significant effects on you.
   
   
10. Right to Explanation (China – PIPL): You may request an explanation about how your personal information is being processed, especially when automated decision-making is involved.
    
    
11. Right to Limit Use of Sensitive Personal Information (California): You may direct us to limit the use of your sensitive personal information to purposes allowed strictly under CPRA.
    
    
12. Right to Opt-Out of Sale or Sharing of Personal Information (California): You may request that we stop selling or sharing your personal information for cross-context behavioural advertising. Agratas does not sell personal data, but this right is provided where required.
    
    
13. Right to Be Notified of Third-Country Transfers (Korea – PIPA): You may request to be informed when your data is transferred outside South Korea and to whom.
    
    
14. Right to Nominate (India – DPDPA): You may designate another individual to exercise your rights in the event of your death or incapacity.
    
    
15. Right to Grievance Redressal (India – DPDPA): You may raise a complaint with our Grievance Officer and escalate to the Data Protection Board of India if unsatisfied.

You have rights depending on your jurisdiction. Agratas honours the strictest applicable rights.

To exercise any of the rights described above, please complete and submit our Data Subject Request Form, available at Data Subject Request Form – Fill out form. Upon submission, you will receive an acknowledgment. Alternatively, you may exercise your rights by contacting our Data Protection Office (DPO) at dpo@agratas.com.

We will respond to your request within 30 days of receipt, or within such shorter period as required under applicable law.

Response Timelines

We will respond to your request within thirty (30) days, or within any shorter period required under applicable law. Where the law permits an extension for complex or high‑volume requests, Agratas may extend the response period as allowed, and we will notify you of the extension and the reasons for it.

When We May Decline a Request

• We may decline a request only where permitted by law, such as:
• When disclosure affects the rights of others
• When data must be retained for legal, regulatory, or contractual purposes
• When identity cannot be verified
• When the request is manifestly unfounded, excessive, or repetitive

We will always provide a clear explanation if we decline your request.

Where Agratas relies on your consent as the lawful basis for processing your personal data, we will present you with a clear, specific, and unbundled consent request. By providing your consent through an affirmative action (such as selecting “I Agree,” ticking a checkbox, signing a form, or submitting a consent option), you acknowledge that you have been informed of the purpose of processing, the type of data collected, your rights, and your ability to withdraw consent at any time.