#Candidate and Recruitment Privacy Notice

1.1 Who this Notice is from. Edsol Edtech Pvt. Ltd., a Private Limited Company incorporated in India and trading as Pensieve Labs, is the Data Fiduciary for the personal data described in this Notice. This Notice describes the personal data Pensieve collects about you when you express interest in a role, submit an application, or move through the recruitment process; what Pensieve does with it; the grounds on which it is processed; who it is shared with; how it is secured and retained; and the rights available to you.

1.2 The point-of-collection notice. At each point where Pensieve collects your personal data, the itemised notice required by Section 5 of the Digital Personal Data Protection Act, 2023 is shown next to the form or field. That notice, and the consent record kept with it, is the Notice to the Data Principal at the Point of Collection (NTC-GL-023). This Notice is the fuller account that the point-of-collection notice links to.

1.3 Defined terms. "Personal data", "Data Principal", "Data Fiduciary" and "Data Processor" carry the meanings given to them under the DPDP law. A short glossary is at 2.

1.4 Roles with system access. Because Pensieve serves hospitals and clinical environments, certain roles may involve access to sensitive systems or settings. Where this is relevant to a role, additional checks or confidentiality undertakings apply, and we tell you about them at the appropriate stage. What Pensieve verifies before granting access, and the consent it takes, are stated in the Background Verification Policy and Consent Form (POL-IN-304).

2.1 The following terms are used with the meanings given to them under the DPDP law.

• Data Principal. The individual to whom the personal data relates, which in this Notice means you, the candidate.
• Data Fiduciary. The person or entity that, alone or with others, determines the purposes and means of processing personal data. Edsol Edtech Pvt. Ltd. is the Data Fiduciary for the personal data described in this Notice.
• Data Processor. A person or entity that processes personal data on behalf of a Data Fiduciary, such as our recruitment-technology and verification providers.
• Personal data. Any data about an individual who is identifiable by or in relation to such data.
• Processing. Any operation performed on personal data, such as collection, recording, storage, use, sharing, disclosure or erasure.
• DPDP law. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, in each case as amended from time to time.

3.1 An itemised description. What we collect depends on the role, your application and the stage you have reached. We aim to collect only what is relevant and necessary. The table below is the itemised description of personal data required by Rule 3(b)(i) of the Digital Personal Data Protection Rules, 2025, with the purpose for each item required by Rule 3(b)(ii).

For the technical and usage data at row 13, where consent is required we seek it for non-essential cookies and explain the choices available to you.

3.2 Sensitive personal data or information. Certain categories of information may constitute "sensitive personal data or information" under the SPDI Rules, for example certain health or medical information. We do not seek such information as part of the ordinary application process. There are limited situations in which we may process it: to provide an adjustment you request during the process; to meet a legal obligation; or, where you volunteer it for diversity and inclusion purposes, on the basis of your consent and in aggregated or de-identified form wherever practicable. Where the law requires your explicit consent, we will ask for it, and you are always free to decline.

3.3 Children's data. We do not knowingly collect the personal data of children through our recruitment process. The DPDP law provides additional protections for children and for persons with disabilities, including a requirement for verifiable consent of a parent or lawful guardian where applicable.

4.1 We use your personal data for the following purposes:

• To receive and manage your application, and to communicate with you about it.
• To assess your suitability for the role, including reviewing your application, holding interviews and assessments, and checking references.
• To verify the information you have given us and, where relevant and lawful, to carry out background checks under POL-IN-304.
• To arrange interviews and, where applicable, to reimburse agreed expenses.
• To reach hiring decisions and, if you are successful, to prepare an offer and begin onboarding.
• To operate, secure and improve our recruitment systems, including maintaining audit and access logs and detecting, preventing and responding to fraud, misuse and security incidents.
• To consider you for other suitable roles, where you have joined our talent community, as described at 12.
• To comply with our legal, regulatory and internal-policy obligations, and to establish, exercise or defend legal claims.

5.1 We process your personal data on the following grounds recognised under Indian law.

• Your consent. For most of our recruitment processing, we rely on your consent, which you give when you submit your application or otherwise provide your information. Your consent is sought through the clear and itemised point-of-collection notice (NTC-GL-023), is limited to the purposes described, and may be withdrawn at any time as easily as it was given, as explained at 10. Withdrawal does not affect processing carried out before withdrawal.
• Certain legitimate uses. To the extent applicable, we may process personal data for certain legitimate uses recognised under Section 7 of the Digital Personal Data Protection Act, 2023, for example where you have voluntarily provided your personal data for a specified purpose and have not indicated that you object to its use for that purpose.
• Compliance with law. We process personal data where necessary to comply with applicable law, or to respond to lawful requests, notices and orders from courts, regulators or other authorities.
• Sensitive personal data or information. Where we process information that constitutes sensitive personal data or information under the SPDI Rules, we do so with the care and, where required, the consent that those rules and the DPDP law require.

6.1 We treat your information as confidential and share it only where there is a proper reason to do so. We may share it with:

• Members of our group, meaning entities affiliated with Edsol Edtech Pvt. Ltd. that take part in recruiting, evaluating or deciding on your application.
• Data Processors who act on our behalf, under our instructions and appropriate contractual safeguards, such as providers of applicant tracking, interview scheduling, assessment, background verification, cloud hosting, and information-technology and security services. The Data Processors we use, their roles and their countries of processing are in the Subprocessor Register (DIS-GL-009), which is published, dated and maintained.
• Our professional advisers, such as legal, tax and audit advisers, where reasonably necessary.
• Authorities, including courts, regulators and law enforcement, where we are required or permitted by law to disclose information.
• A buyer or successor, and their advisers, in connection with a merger, acquisition, financing, reorganisation or other corporate transaction, subject to appropriate protections.

6.2 We require our Data Processors to protect your information, to process it only for the purposes we specify and on our instructions, and to implement reasonable security safeguards. We do not sell your personal data, and we do not disclose it for unrelated advertising purposes.

7.1 We are registered and primarily operate in India, and we seek to store and process your personal data in India wherever practicable.

7.2 Where personal data is transferred to, or accessed from, a location outside India, for example by a Data Processor, we do so in accordance with Section 16 of the Digital Personal Data Protection Act, 2023, which permits the transfer of personal data outside India other than to any country or territory that the Central Government may restrict by notification. This is a negative-list model: transfer is lawful unless the destination is a notified country. We apply contractual and technical safeguards to protect information that is transferred, and we require recipients to maintain appropriate protection. The systems that process this data, and the countries in which they do so, are listed in the Subprocessor Register (DIS-GL-009).

8.1 The principle. We retain personal data only for as long as necessary to fulfil the purposes described in this Notice, or as required or permitted under applicable law. Consistent with the erasure principle under the DPDP law, we erase or de-identify personal data once the purpose for which it was collected is no longer being served and its retention is not required by law, for example where you withdraw your consent, or after a defined period of inactivity following an unsuccessful application.

8.2 Retention at a glance.

8.3 If your application is not successful, we generally retain your information for a limited period so that we can consider you for other suitable roles, respond to your queries and meet our record-keeping obligations, after which we securely erase or de-identify it. When we determine retention periods, we consider the nature and sensitivity of the information, the purposes for which we hold it, and any applicable legal or regulatory requirement. The master retention matrix for recruitment records is in the Privacy Policy (POL-GL-053).

9.1 We take the security and safety of your personal data seriously and maintain reasonable security practices and procedures, as required under Section 8 of the Digital Personal Data Protection Act, 2023 and the SPDI Rules, that are designed to protect it against loss, misuse and unauthorised access, alteration, disclosure or destruction. Depending on the sensitivity and context, our safeguards may include:

• Encryption of personal data in transit using transport-layer security, and encryption at rest where appropriate.
• Role-based access controls that limit access to those who need it for the purposes described in this Notice, applied on a least-privilege basis.
• Authentication controls, network and application security controls, and secure configuration of our systems.
• Logging, monitoring and alerting to help us detect and respond to anomalous or unauthorised activity.
• Secure software-development practices, and periodic review and testing of our controls.
• Due diligence on our Data Processors and contractual security obligations, together with confidentiality obligations and training for our personnel.

The controls Pensieve applies to its own systems, and the disclosures that evidence them, are stated in the Privacy Policy (POL-GL-053) and the documents it references; they are not restated here.

9.2 If there is a breach. In the event of a personal data breach, we will take steps to contain and remediate it, and we will notify the Data Protection Board of India and affected Data Principals in accordance with the timelines and requirements prescribed under the DPDP law. The breach-notification commitments Pensieve operates to are those set out in the Privacy Policy (POL-GL-053).

9.3 No absolute claim. No method of transmission or electronic storage is completely secure, and we do not represent that your information cannot be compromised. We nonetheless work to protect your information and to respond appropriately if an issue arises. You also play a part: please keep any account or application credentials confidential, and stay alert to the fraudulent communications described at 13.

10.1 The rights. As a Data Principal under the DPDP law, you have the following rights in relation to your personal data.

• Right to access information. To obtain a summary of the personal data we process about you and the associated processing activities, together with the identities of the Data Processors and other parties with whom your personal data has been shared and a description of the personal data so shared, in accordance with the DPDP law.
• Right to correction and erasure. To seek the correction, completion or updating of inaccurate or incomplete personal data, and the erasure of personal data that is no longer necessary for the purpose for which it was processed, unless its retention is required by law.
• Right to grievance redressal. To have a readily available means of registering a grievance in respect of any act or omission regarding your personal data, as described at 16.
• Right to nominate. To nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent. To withdraw your consent at any time, as easily as it was given. On withdrawal, we will cease the relevant processing unless another lawful ground applies, without affecting processing carried out before withdrawal.

10.2 How to exercise a right. Use the Data Principal Rights Request Form (FRM-GL-505), or write to us using the details at 16. We will respond on the timelines in the Grievance Redressal Policy (POL-GL-066) and within the outer limits prescribed under Indian law. We may need to verify your identity before acting on a request, and we will not ask for more identity information than the request needs. You will not be treated unfairly for exercising any of these rights.

10.3 Consent Managers. Where available, you may give, manage, review or withdraw your consent through a Consent Manager registered with the Data Protection Board of India.

11.1 We value human judgement in hiring. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without appropriate safeguards. Where technology is used to help organise, screen or review applications, a member of our team remains responsible for decisions about your candidacy. If this position changes for a particular process, we will provide the information required under applicable law.

12.1 If we are not able to offer you a role now, we would often like to stay in touch about future opportunities that may suit you. Where your consent is required, we will ask before adding you to our talent community, and you may ask us to remove you at any time by contacting us or using the unsubscribe option in our communications.

13.1 We are aware that individuals and entities sometimes make fraudulent offers of employment, or otherwise misrepresent themselves, in the name of reputable organisations. Please read the following carefully.

• We never charge candidates. Neither Pensieve Labs nor Edsol Edtech Pvt. Ltd. asks candidates to pay any fee, deposit or other payment at any stage of recruitment, whether for applications, interviews, training, equipment, background checks, onboarding or any other reason.
• Official channels only. Genuine recruitment communications come only from official Pensieve Labs channels. Our recruitment correspondence is sent from, and should be directed to, info@pensievelabs.org and other official Pensieve email addresses. We do not conduct recruitment through unofficial email domains, or through offers of guaranteed employment in exchange for payment.
• We never ask for financial credentials. We will not ask you for bank passwords, one-time passwords, card details or similar financial credentials as part of recruitment.
• Warning signs. Be cautious of offers that seem too good to be true, requests for money or financial information, communications from unofficial domains or accounts, pressure to act urgently, and offers made without any genuine interview or assessment.
• If in doubt, do not respond. If you receive a suspicious communication that claims to be from Pensieve Labs, Pensieve or Edsol Edtech Pvt. Ltd., do not respond, do not make any payment, and do not share personal or financial information. Please report it to info@pensievelabs.org so that we can investigate.

13.2 The offences involved. Impersonating Pensieve Labs or Edsol Edtech Pvt. Ltd., or making fraudulent offers or representations in our name, may constitute offences under the Bharatiya Nyaya Sanhita, 2023, including cheating by personation under Section 319 and, where a document such as an offer letter is fabricated in our name, forgery under Section 336 and use of a forged document under Section 340; and under the Information Technology Act, 2000, including identity theft under Section 66C and cheating by personation using a computer resource under Section 66D. Impersonation of Pensieve in a recruitment context is the same conduct addressed in the Social Media, Online Conduct and Misinformation Policy (POL-GL-073). We reserve the right to report such conduct to the appropriate authorities and to pursue the remedies available to us under law. Pensieve Labs and Edsol Edtech Pvt. Ltd. accept no liability for any loss or harm arising from dealings with fraudulent parties who misuse our name.

14.1 We want our process to be open to everyone. If you need this Notice in an alternative format, or if you need any adjustments or accommodations during the recruitment process, please let us know using the details at 16 and we will do our best to help.

15.1 We may update this Notice from time to time to reflect changes in our practices or in the law. When we make material changes, we will update the version and the Last Modified On date shown in the document control line and, where appropriate, provide additional notice. We encourage you to review this Notice when you apply.

16.1 How to reach us. If you have questions about this Notice or about how we handle your personal data, or if you would like to exercise your rights or raise a grievance, please contact us.

Please mark any grievance clearly so that we can direct it appropriately.

16.2 The Grievance Officer and the timelines. The named Grievance Officer, the full grievance mechanism, the acknowledgement and response timelines, and the escalation ladder are in the Grievance Redressal Policy and Grievance Officer Notice (POL-GL-066). We will acknowledge and respond to your request or grievance within the timelines stated there and within the outer limits prescribed under Indian law.

16.3 Escalation to the Board. If you are not satisfied with our response, or your grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India in accordance with the DPDP law.