Privacy & Cookie Policy

At a glance

1. Who we are

Exalans & Hunar Corporate Solutions Pvt. Ltd. ("Exalans & Hunar", "we", "us") is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU/UK General Data Protection Regulation ("GDPR") for personal data collected through exalansandhunar.com and its subdomains.

Client employee data. When we provide HR services to a client company, we usually process its employees' and candidates' data on that client's behalf (as a Data Processor). That processing is governed by our agreement with the client and the client's own privacy notice. This policy covers our website, enquiries and our own recruitment activities.

2. What we collect and why

Please don't send us sensitive personal data (health, financial account numbers, government IDs, etc.) through the website or chat unless we specifically ask for it as part of a service.

3. Avani AI assistant

• It's an AI. Avani is an automated assistant, not a person. Its answers may be inaccurate. Please confirm anything important with our team.
• Contact details are optional. You can tap "skip for now" and chat without giving your name or number. If you share them and agree, we receive them (with your first question) so our team can follow up on WhatsApp or by phone.
• How chats are processed. Your messages are sent through our server to our AI model provider (Anthropic) to generate replies. Replies may be converted to speech using Google Cloud Text-to-Speech. Our providers process this data on our behalf to provide the service.
• Voice input. If you use the microphone, speech-to-text is performed by your web browser's built-in speech service (for example Google in Chrome, or Apple in Safari) under that provider's privacy terms. We receive only the resulting text.
• No sensitive data, please. Don't share health, financial or identity-document details in the chat.

4. Legal basis for processing

India (DPDP Act, 2023)

We process personal data on the basis of your consent (for example, when you tick the consent box on a form or accept analytics cookies), or for legitimate uses permitted by Section 7 of the Act, such as where you voluntarily provide data for a specific purpose (like requesting a quote) or where processing is needed to comply with law. Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawal doesn't affect processing already done.

EU / UK (GDPR)

• Consent (Art. 6(1)(a)): analytics cookies; marketing follow-up; sharing your details from the chatbot.
• Contract / pre-contract steps (Art. 6(1)(b)): answering your enquiry, quotes, delivering services, payments.
• Legal obligation (Art. 6(1)(c)): tax, accounting and statutory records.
• Legitimate interests (Art. 6(1)(f)): website security, fraud prevention, and handling job applications. You may object to this at any time.

5. Who we share data with

We do not sell or rent personal data, and we don't share it for cross-context behavioural advertising. We share it only with service providers who help us run our business, under contracts requiring them to protect it, and only as needed:

6. International transfers

We are based in India, and some of our providers process data in other countries (including the United States). For transfers out of India we follow the DPDP Act and any restrictions notified by the Government of India. For personal data from the EU/UK, we rely on adequacy decisions where available or on Standard Contractual Clauses (and the UK Addendum) with our providers. You can contact us for more information about these safeguards.

7. How long we keep data

• Enquiries and chatbot leads that don't become clients: up to 12 months from our last contact with you, then deleted.
• Client and contract records, invoices: for the duration of the relationship and up to 8 years afterwards, as required by Indian tax and company law.
• Job seeker profiles: up to 24 months from your last activity, or until you ask us to delete them.
• Analytics data: 14 months in Google Analytics.
• Server security logs: at least 1 year, as required under the DPDP Rules, 2025 and CERT-In directions.

Once the purpose is served and no law requires us to keep it, we delete or anonymise the data.

8. Cookies and similar technologies

We use only the cookies and browser storage listed below. Non-essential ones are off by default and only set if you click "Accept all" or turn them on in Cookie settings. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a "reject".

Google Signals and ad personalisation are disabled on our analytics. Fonts are served from our own site, so loading a page doesn't send your data to a font provider.

Change cookie settings

9. Your rights

Everyone

Whatever your location, you can ask us to tell you what data we hold about you, correct it, delete it, or stop contacting you. You can also withdraw any consent you've given.

India (DPDP Act)

• Get a summary of your personal data we process and the processing activities, and the identities of others we've shared it with
• Correct, complete, update or erase your personal data
• Withdraw consent at any time
• Use our grievance redressal process, and then complain to the Data Protection Board of India if you're not satisfied
• Nominate another person to exercise your rights in case of your death or incapacity

EU / UK (GDPR)

• Access, rectification, erasure, restriction of processing and data portability
• Object to processing based on legitimate interests or for direct marketing
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority (in the UK, the ICO)

California and other US states

You can request to know, correct or delete your personal information. We do not sell or "share" personal information as those terms are defined under the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

How to make a request

Email support@exalansandhunar.com with the subject "Data rights request". We may need to verify your identity. We aim to respond within 30 days, and in any case within the time required by law (for DPDP grievances, within 90 days).

10. Children

Our website and services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we'll delete it.

11. Security and breaches

We use reasonable security safeguards, including encrypted connections (HTTPS), access controls limited to staff who need the data, and contracts with our providers. No system is 100% secure. If a personal data breach affects you, we will inform you and the relevant authorities (including the Data Protection Board of India and CERT-In) as required by law.

12. Grievance Officer and contact

For any questions, requests, or complaints about how we handle your personal data, contact our Grievance Officer:

If you're not satisfied with our response, you may complain to the Data Protection Board of India, or, if you're in the EU/UK, to your local data protection authority.

13. Changes to this policy

We may update this policy from time to time. We'll change the "Effective" date at the top, and where changes are significant we'll tell you more prominently (for example, by asking for your consent again).