Data Processing Agreement

This agreement is between Kirnova Systems, Office at Plot 08, Eden Complex, Gangapur Road, Nashik, Maharashtra 422222, India (“Kirnova”, “we”) and the business that uses Kirnova for its candidates or employees (“you”). It forms part of our Terms and Conditions and any written agreement we have with you. If they conflict on personal data, this agreement applies.

The words below have the meaning given in the Digital Personal Data Protection Act, 2023 and the rules made under it.

• You are the Data Fiduciary for the candidates and employees you invite. You decide why their data is processed.
• Kirnova is your Data Processor. We process their data only on your behalf.
• Each candidate or employee is a Data Principal.

Where a person uses Kirnova for themselves, outside your invitation, we are the Data Fiduciary for that use. Our Privacy Policy covers it.

• People: candidates and employees you invite, and your own staff who use the platform.
• Data: name, email address, phone number where given, assessment answers, results, and records of who opened what.
• Purpose: to run the assessments you ask for, produce the reports, and deliver them to you.
• Duration: while we provide the service to you, and until data is deleted under section 10.

We process personal data only to provide the service, and only as this agreement, the Terms and your written instructions say. We do not use it for our own marketing. We do not sell it. If we think an instruction breaks the law, we tell you.

• Give each person the notice the DPDP Act requires, and have a lawful basis or valid consent.
• Invite only people who are at least 18 years old.
• Use results only within section 4 of our Terms. A result is never the sole basis of a decision.
• Keep your account and any API keys secure.
• Send us only the personal data the assessment needs.

We keep reasonable security safeguards to protect personal data against a breach, as section 8(5) of the DPDP Act requires. Only staff who need access have it, and they are bound to keep the data confidential. Our Trust page describes how we protect data.

If we become aware of a personal data breach that affects your data, we tell you without undue delay. We tell you what happened, what data is affected, and what we are doing about it. We help you meet your own duty to inform the Data Protection Board of India and each affected person.

You authorise us to use the companies on our Subprocessors page. That page is the full, current list, with what each company does, the data it sees, and where.

We bind each one by written contract to protect the data. Before a new company starts to receive personal data, we add it to that page and tell you in writing. If you object for a reasonable data protection reason, tell us and we will discuss it with you. We remain responsible to you for our subprocessors.

Some of our subprocessors store or process data outside India. Section 16 of the DPDP Act permits this, except to a country the Central Government restricts. We do not transfer personal data to a restricted country.

If a candidate or employee asks us to access, correct or erase their data, or raises a grievance, we tell you and help you answer. Where the law requires us to act directly, we do.

When the service ends, or when you ask in writing, we delete or return the personal data we hold for you. We keep data only where the law requires us to, and only for as long as it requires.

We answer your reasonable written questions about how we process your data, so that you can show you meet the DPDP Act. Send them to the contact below.

This agreement is governed by the laws of India. The courts at Nashik, Maharashtra have exclusive jurisdiction. The limits of liability in our Terms apply to this agreement.

Our Grievance Officer is Yash Khatri. Write to team@kirnova.com or call +91 85913 13113.