Data processing agreement

This Data Processing Agreement ("DPA") is between the customer that has accepted our Terms of Service ("Customer" or "you") and ProMonkey Technologies LLP, LLPIN AAX-XXXX ("ProMonkey", "we" or "us"), which operates Pratibha.

It forms part of the Terms of Service and applies whenever we process Customer Personal Data in providing the Services. You accept it when you accept the Terms. If your organisation needs a signed copy, write to info@pratibha.tech and we'll countersign this version.

If this DPA conflicts with the Terms of Service on any matter concerning personal data, this DPA prevails.

Words not defined here have the meaning given in the Terms of Service.

• "Applicable Data Protection Law" means the Digital Personal Data Protection Act, 2023 and the rules made under it, including the Digital Personal Data Protection Rules, 2025, as and when their provisions come into force; the Information Technology Act, 2000 and the rules made under it; and any other law of India on personal data that applies to the Services.
• "Candidate" means an individual who applies for, or is considered for, a job with the Customer or the Customer's clients, and whose personal data is processed through the Services.
• "Customer Personal Data" means personal data within Customer Data, as defined in the Terms of Service, that we process on the Customer's behalf. It doesn't include account, billing, security and website data that we process for our own purposes as described in our Privacy Policy.
• "Data Fiduciary", "Data Principal", "Data Processor", "personal data", "processing" and "personal data breach" have the meanings given in the Digital Personal Data Protection Act, 2023.
• "Subprocessor" means a third party we engage that processes Customer Personal Data.
• "Services" means the Pratibha services described in the Terms of Service.

For Customer Personal Data, the Customer is the Data Fiduciary and ProMonkey is the Data Processor.

ProMonkey is a separate Data Fiduciary for the account, billing, security and website data it collects for its own purposes. That data is covered by our Privacy Policy, not by this DPA.

Annex 1 describes the processing.

We process Customer Personal Data only on your documented instructions. Your instructions are:

• The Terms of Service and this DPA.
• Your configuration and use of the Services, for example connecting a mailbox, creating a role, approving a shortlist or changing a retention setting.
• Other reasonable written instructions you give us that are consistent with the Services.

We'll tell you if we believe an instruction breaks Applicable Data Protection Law, and we may decline to follow it.

We process Customer Personal Data outside your instructions only where the law requires it, and we'll tell you before doing so unless the law prevents us.

As the Data Fiduciary, you're responsible for:

• Having a valid basis under Applicable Data Protection Law, such as consent or a legitimate use, for collecting Candidate personal data and having it processed through the Services.
• Giving Candidates the notices the law requires, including that AI may be used to screen applications and conduct interviews, and that interviews are recorded and assessed. Pratibha's job post text, invitation templates and interview opening give this information by default, and you must not remove it.
• Making sure your instructions, job criteria and interview settings are lawful and job related, and don't discriminate on any ground protected by law.
• Sending or connecting only the emails and mailboxes needed for hiring, and wherever possible using the forwarding option to share only job applications.
• Not using the Services for Candidates under 18 years of age.
• Responding to requests from Candidates exercising their rights, with our help under section 9.
• The accuracy of the personal data you provide, and the decisions you make using the Services.

We will:

• Process Customer Personal Data only to provide, secure and support the Services for you, and as instructed under section 4.
• Ensure that our personnel who can access Customer Personal Data are bound by confidentiality obligations, and limit access to those who need it.
• Implement and maintain the security measures described in Annex 2.
• Not sell Customer Personal Data, not use it for advertising, and not combine it with other customers' data.
• Not use Customer Personal Data to train or fine tune AI models.
• Where a Subprocessor provides AI model or speech services, use the contractual terms and settings available to us to stop it from using Customer Personal Data to train its models.
• Not contact any Candidate except as the Services are designed to on your behalf, such as through invitations you approve and interview calls the Candidate places.
• Not make hiring decisions. Every shortlist needs approval by one of your Users, and hiring decisions are yours.

You authorise us to engage the Subprocessors listed in Annex 3.

We'll give you at least 14 days' notice before adding or replacing a Subprocessor, by email or through a notice in the app together with an update to Annex 3. If you have reasonable data protection grounds to object, tell us within that period. We'll try to address your concern. If we can't, you may terminate the affected Services, and we'll refund any prepaid fees for the period after termination.

We'll have a written contract with each Subprocessor that requires it to protect Customer Personal Data to a standard no lower than this DPA. We remain responsible to you for our Subprocessors' performance of those obligations.

In an emergency, for example to keep the Services running or secure, we may replace a Subprocessor immediately, and we'll notify you as soon as possible.

Customer Personal Data may be processed outside India by us or our Subprocessors, as shown in Annex 3. We'll transfer it only where Applicable Data Protection Law permits, never to a country or territory restricted by the Government of India under section 16 of the Digital Personal Data Protection Act, 2023, and only with protections consistent with this DPA.

If we receive a request from a Data Principal about Customer Personal Data, such as a request to access, correct or erase data, we'll forward it to you within 5 business days. We won't respond to it ourselves, except to tell the person that we've passed it on.

Taking into account the nature of the processing, we'll help you respond to such requests, through tools in the Services or, on request, by locating, exporting, correcting or deleting the relevant data.

We'll also give you reasonable help with any assessments, audits or consultations with the Data Protection Board of India that relate to the Services, where the law requires them.

If we become aware of a personal data breach affecting Customer Personal Data, we'll notify you without undue delay, and in any event within 24 hours of becoming aware of it.

Our notice will include, as far as we know at the time: a description of the breach, including its nature, timing and likely extent; the categories and approximate number of Data Principals and records affected; its likely consequences; the steps we've taken or propose to take to contain it and reduce harm; and a contact person. We'll share further information as it becomes available.

We'll take reasonable steps to contain and investigate the breach and reduce its effects, and cooperate with you so that you can meet your own obligations, including notifying the Data Protection Board of India and affected Data Principals within the time the law requires. We'll also report cyber security incidents to the Indian Computer Emergency Response Team where the law requires us to.

Notifying you of a breach is not an admission of fault by either party.

During your subscription, we keep Customer Personal Data according to your settings and the defaults in the Services, including keeping call recordings for 90 days unless you choose otherwise.

Emails in a connected mailbox that aren't identified as job applications are used only to find applications, and are not kept for more than 7 days.

You can ask us to delete specific Customer Personal Data at any time, and we'll do so within 30 days, unless the law requires us to keep it.

When your subscription ends, your account becomes read only for 30 days. During that time, you can ask us for an export of your Candidate records, including CVs, transcripts and reports, in a commonly used format. After 30 days, we delete Customer Personal Data from our live systems. Copies in backups are deleted in our normal backup cycle and stay protected until then.

We keep Customer Personal Data for longer only where the law requires, and only for that purpose.

We'll make available the information reasonably needed to show that we comply with this DPA, including by completing one security questionnaire a year at no cost.

Where the law or a regulator requires it, we'll allow and cooperate with an audit of our processing of your Customer Personal Data, carried out by you or by an independent auditor bound by confidentiality. Audits need at least 30 days' written notice, take place during business hours, happen no more than once a year unless a regulator requires otherwise, and are at your cost. Enterprise customers may agree different audit terms in their contract.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where the law doesn't allow them.

This DPA applies for as long as we process Customer Personal Data for you, including after the Terms of Service end, until deletion is complete.

We may update this DPA to reflect changes in Applicable Data Protection Law or in the Services. We'll give you at least 30 days' notice of material changes, and we won't reduce the overall level of protection for Customer Personal Data.

This DPA is governed by the same law, and the same dispute resolution terms, as the Terms of Service.

Subject matter. Provision of the Pratibha recruitment services to the Customer.

Duration. The term of the Customer's subscription, followed by the deletion period in section 11.

Nature of processing. Collecting applications from connected or forwarded mailboxes; storing data; reading and extracting information from CVs; screening applications against job requirements using AI; conducting and recording telephonic interviews; speech recognition and transcription; generating scores, reports and recommendations; displaying data to the Customer's Users; sending invitation emails the Customer approves; and deleting data.

Purpose. Helping the Customer assess candidates for its job openings, or for its clients' openings where the Customer is a recruitment agency.

Data Principals. Job applicants and candidates, and the Customer's Users where their names appear in notes, approvals and activity records.

Categories of personal data:

• Identity and contact details: name, phone number, email address and location.
• Professional details from CVs and applications: education, work history, skills, certifications, notice period, current and expected pay where the candidate provides it, and other information in the CV.
• Application emails and their attachments.
• Call data: calling number, date, time and duration of calls, call recordings, transcripts and the language chosen.
• Assessment data: screening scores, interview scores, reasoning, strengths, concerns, recommendations, statuses and notes added by the Customer's Users.

Sensitive information. The Services are not designed to collect health, bank account, religious, caste or similar sensitive information. CVs may contain such information if a Candidate includes it. Pratibha is designed to assess job related information only, and the Customer must not configure the Services to consider such information.

• Workspace separation. Each Customer's data is logically separated, and access rules are enforced on our servers for every request, not only in the app's interface.
• Encryption. Data is encrypted in transit using TLS, and encrypted at rest by our hosting provider. Mailbox passwords, if used, are encrypted before storage and are never shown again.
• Access control. Customers control their Users' access through roles. Our personnel access Customer Personal Data only when needed for support, operations or security, and that access is limited and logged.
• Human oversight. No Candidate is contacted until one of the Customer's Users approves the shortlist.
• Data minimisation. A forwarding option that needs no password and lets Customers share only job applications, and default retention limits for call recordings.
• Logging and monitoring. Security relevant events are logged and monitored, and logs are kept for at least one year.
• Resilience. Regular backups so the Services can be restored after an incident.
• Secure development. Code review before release, separate development and production environments, and no use of Customer Personal Data in development or testing.
• Personnel. Confidentiality obligations and security awareness for everyone with access to Customer Personal Data.
• Suppliers. Subprocessors are assessed before use and bound by written contracts.
• Incident response. A documented process to detect, contain, investigate and notify personal data breaches.

This list was last updated on 23 September 2026.