CareerKing — Privacy Policy

Last updated: 14 July 2026

1. Who we are and what this policy covers

CareerKing is a recruitment and placement business. We introduce candidates for hotel, hospitality and healthcare roles — front office, F&B, culinary, housekeeping, nursing, allied health and related positions — to employer companies that are hiring.

This policy covers the CareerKing website and hiring platform, and the data we handle when you apply for a job through us, when our account managers build your profile, and when an employer company uses our platform to hire.

CareerKing is operated by [LEGAL ENTITY NAME], [CIN / registration number], registered at [registered office address].

Two things follow from the fact that we are an intermediary, and you should read them before you apply:

• For candidate data, we are the data fiduciary — we decide what we collect and why, and we are answerable to you for it.
• Placement only works by sharing your details with employers. When we send your profile and CV to a prospective employer, that employer becomes responsible for the copy it holds, under its own privacy practices. We cannot pull that copy back. If you are not comfortable with your details being shared with employers, do not apply through CareerKing.

2. Information we collect

Information candidates give us

• Contact details: your name, mobile number and email address. This is the minimum we need to register an application.
• Work profile: your location, the department and role you are looking for, years of experience, previous employer, education, professional qualifications, preferred shift, notice period, whether you are willing to relocate, whether you need accommodation, languages you speak, skills, and a short summary or set of highlights.
• Pay details: your current salary and your expected salary.
• Your CV and photograph, if you upload them or if an account manager builds a CV for you. We accept PDF, DOC, DOCX, JPG, PNG and WEBP files up to 10 MB.
• Your phone number for sign-in. Candidates do not set a password. You sign in with a one-time code tied to your mobile number.
• Messages you exchange with our account managers on the platform.

Information we generate about you

• Application records: the job, the employer company, the location, the status of your application, and the date you applied.
• Interview records: the date, time, mode and venue of an interview, who interviewed you, and the interviewer's scoring and written feedback. That feedback includes ratings for communication, technical skill, punctuality and grooming/presentation, a decision, and a reason if you were not selected. These are subjective staff assessments and they sit on your record.
• Offer records: the role, the employer, the location, the salary offered, and the offer letter.
• Internal notes: free-text notes our staff write about you and your candidacy.
• Automated scoring: the platform automatically derives a tier and a reliability score from the profile information you give us. See section 3.

Information employers give us

• Company name, industry, city, size, address, a description of the business, and a logo.
• GSTIN and, where an offer is being verified, supporting verification documents.
• Contact person's name, designation, phone number and company number.
• Sign-in details for employer users: name, email, phone and a password (which we store only as a hash — see section 8).
• Account and plan status, and whether a contract has been signed.

Information collected automatically

• Session data. When you sign in, your browser stores a sign-in token and your basic account details (name, role, email, phone) in your browser's local storage so you stay signed in. See section 9.
• Server logs. Our web server keeps ordinary operational logs, which can briefly contain IP addresses. These are used to keep the service running and are not linked to your profile inside our database. They are kept for [retention period — e.g. 30 days].
• Nothing else. The platform does not run analytics, advertising, tracking pixels, tag managers, session recording or A/B testing tools. We do not build a behavioural profile of you.

What we do NOT collect

We want to be specific about this, because recruiters are often assumed to ask for more than they need. CareerKing does not collect:

• Aadhaar, PAN, passport or any other government ID number, and we do not run Aadhaar verification.
• Date of birth, age, gender, caste, religion, nationality, marital status or disability status.
• Your home address.
• Bank account, UPI, card or any other payment details. CareerKing never charges candidates and will never ask you for money or bank details. If someone claiming to be from CareerKing asks you to pay, it is a fraud — report it to the address in section 12.
• Criminal-record or background-check data.
• Biometric data or geolocation.

3. How we use your information

We use candidate information for placement and for running the platform. Specifically:

• To match you to jobs — to work out which open roles fit your experience, location, shift preference, notice period and pay expectations.
• To put you forward to employers — to send your profile and CV to prospective employer companies. See section 4.
• To arrange and record interviews — to schedule, confirm, and capture the outcome and feedback.
• To make and verify offers — to prepare offer letters and to record whether an offer was accepted.
• To contact you about applications, interviews and offers.
• To verify who you are at sign-in, using the one-time code sent to your mobile number.
• To operate, secure and improve the platform.
• To meet legal obligations and to establish or defend legal claims.

Automated scoring. The platform automatically assigns you a tier and a reliability score, calculated from information such as your experience, education and profile completeness. These scores are visible to our staff and to employers. They are an input, not a decision: no candidate is hired, rejected or shortlisted by an automated system alone — a human account manager and the employer make those calls. You can ask us how your score was arrived at, ask us to correct the underlying data, and ask for a human review, using the contact details in section 12.

We do not use your data for advertising, and we do not sell it.

4. Sharing and disclosure

This is the section that matters most in a placement business. Read it carefully.

Prospective employer companies. The whole point of applying through CareerKing is that we introduce you to employers. When you apply to a job, or when we shortlist you for one, we disclose to that employer:

• your name, mobile number and email address;
• your CV and photograph;
• your work history, education, skills, languages, location, shift and notice-period preferences;
• your current and expected salary;
• your tier and reliability score;
• interview feedback and ratings relating to that employer's process.

Employer users of the platform can view candidate profiles in the talent pool for the purpose of hiring. Assume that any employer with an account on the platform may see your profile, not only the ones you have applied to. If you want your details shown only to specific employers, tell us in writing (section 12) and we will handle your profile manually instead of listing it.

Once an employer has your CV, they hold their own copy. From that point they are a separate data fiduciary and their own privacy policy applies to that copy. If you want it deleted, you must ask them; we will tell you which employers we sent your profile to and help you contact them.

CareerKing account managers, recruiters and administrators. Our own staff can see your full record, including internal notes and interview feedback, so they can place you.

Service providers. At present, CareerKing does not share candidate data with any third-party processor. There is no SMS gateway, no WhatsApp integration, no email service, no analytics vendor, no cloud storage bucket and no payment processor in the platform. Your data sits in our own database and on our own servers, at [hosting location / provider — e.g. our servers in India]. If we engage a processor in future — for example an SMS provider to deliver one-time codes — we will update this policy and name them before that data starts flowing.

Legal and regulatory disclosure. We will disclose personal data where we are required to by law, by a court, or by a lawful request from a government agency or law-enforcement authority, and where necessary to protect our rights, our users, or the safety of any person.

Business transfer. If CareerKing is merged, acquired or reorganised, candidate and employer records may transfer to the successor entity, which will remain bound by this policy or a policy no less protective.

5. Consent and your choices

Under the Digital Personal Data Protection Act, 2023, we process your personal data with your consent, and we must tell you what we are asking consent for. You give that consent when you submit an application, verify your mobile number, upload a CV, or ask an account manager to build your profile. By doing any of those things you agree that CareerKing may hold your details and share them with prospective employers for the purpose of getting you a job.

We also process some data because it is necessary for us to provide the service you asked for, and to comply with law.

Withdrawing consent. You can withdraw consent at any time by emailing [email protected] or writing to the Grievance Officer at the address in section 12. When you withdraw:

• we stop putting you forward for new roles;
• we remove your profile from the pool visible to employers;
• we delete or anonymise your record, subject to the retention rules in section 6;
• we cannot recall the copies already given to employers — we will tell you who has them so you can ask each employer directly.

Withdrawing consent does not make our earlier processing unlawful, and it may mean we can no longer place you.

6. Data retention

We keep candidate data for as long as it is useful for placing you, and then we get rid of it:

• Candidate profiles and CVs: kept while your profile is active, and for [24 months] after your last activity with us (last application, last interview, or last contact). After that we delete the profile and the uploaded CV and photograph, or anonymise the record so it can no longer identify you.
• Application, interview and offer records: kept for [36 months] from the date of the application, so that we can answer disputes about a placement, and then deleted or anonymised.
• Placement records where a candidate was actually hired: kept for [period required for contractual, tax and audit purposes — confirm with counsel].
• One-time sign-in codes: deleted within [24 hours]. They are only valid for five minutes.
• Server logs: as stated in section 2.
• Employer and company records: kept for the life of the commercial relationship and for [8 years] afterwards for tax and audit purposes.

If you ask for erasure earlier, we act on it as described in section 7. We may keep a minimal record — for example, your phone number and the fact that you asked to be deleted — so that we can honour that request and not re-add you.

7. Your rights

Under the Digital Personal Data Protection Act, 2023, and under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, you have the following rights over the data we hold about you:

• Right to access. You can ask us for a summary of the personal data we hold about you, what we have done with it, and the identities of the employers and other parties we have shared it with.
• Right to correction and completion. If your phone number, experience, education, salary or any other detail is wrong or out of date, you can ask us to correct or complete it, and we will.
• Right to erasure. You can ask us to delete your personal data, unless we are required to keep it by law. We will act on the request within [30 days].
• Right to withdraw consent, as described in section 5.
• Right to nominate. You can nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Right to grievance redressal. You can complain to our Grievance Officer (section 12). We will respond within [30 days]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

To exercise any of these rights, email [email protected] from the email address on your profile, or call from the mobile number on your profile, so we can be sure it is you. We do not charge for this.

Your duties as a Data Principal under the DPDP Act also apply: do not impersonate someone else, do not file frivolous or false complaints, and give us information that is authentic. Your CV and your work history are things employers rely on.

8. Security measures

What we actually do:

• Staff and employer passwords are never stored in readable form. They are hashed with bcrypt (12 rounds). We cannot see your password, and neither can anyone who obtains the database.
• Candidates have no password to steal. Sign-in is by a four-digit one-time code, generated with a cryptographically secure random number generator, valid for five minutes, usable once.
• Sign-in tokens are cryptographically signed so they cannot be forged or tampered with.
• Access is by role. Every account is a candidate, an employer, an account manager or an administrator, and the platform restricts what each role can see and do. Internal staff notes and interview feedback are not shown to candidates.
• Traffic between your browser and our servers is protected in transit using HTTPS.
• Uploaded files are given random, unguessable names so that a CV cannot be found by guessing a filename.
• Data stays on our own infrastructure. The database and uploaded files sit on servers we control; they are not handed to a third-party cloud service.

What we are not going to pretend:

• We hold no security certification — no ISO 27001, no SOC 2 — and we do not claim compliance with any standard we have not been audited against.
• We do not currently encrypt data at rest in the database.
• We do not scan uploaded files for malware.
• No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as required by the DPDP Act.

You can help: do not share your one-time code with anyone, including anyone claiming to be from CareerKing, and sign out on shared devices.

9. Cookies and session storage

CareerKing does not use cookies. We set no tracking cookies, no advertising cookies and no analytics cookies, and there is no third-party script, font or tag on our pages.

We use your browser's local storage — not cookies — to keep you signed in. Two items are stored on your own device:

• kenzed_access_token — your sign-in token.
• kenzed_auth — your sign-in token, a refresh token, and your basic account details (name, role, email, phone).

This data lives in your browser, not on our servers, and it is there so that you do not have to sign in on every page. Clearing your browser's site data, or signing out, removes it. Because this is strictly necessary to run the service and involves no tracking, there is no cookie banner to click.

10. Children and minors

CareerKing is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18, and we do not place anyone under 18.

This is a hard line for a placement company, for two reasons. First, the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986 prohibits the employment of children under 14 and restricts adolescents aged 14 to 18 in hazardous occupations and processes — which includes much of the work we place people into, such as commercial kitchens. Second, the DPDP Act requires verifiable parental consent before processing a child's data, and we do not operate any such mechanism. So we simply do not accept candidates under 18.

Some roles we place — for example roles involving the service of alcohol — have a higher minimum age under state excise law, and the employer will apply that rule.

By registering or applying, you confirm you are 18 or older. If we learn that we hold data about someone under 18, we will delete it. If you believe a minor has registered, tell us at [email protected] and we will remove the record.

11. Changes to this policy

We will update this policy when what we do with data changes — for example, when we engage an SMS provider to deliver one-time codes, or add any other third-party service. When we do, we will change the "Last updated" date at the top, and for changes that materially affect your rights or that widen who your data is shared with, we will notify you before the change takes effect and, where the law requires it, ask for your consent again.

We keep previous versions. You can ask us for the version that applied on the day you signed up.

12. Grievance Officer and contact

If you have a question, a complaint, or want to exercise any right in section 7, contact our Grievance Officer. We are required to name one under Indian law, and to respond to you.

• Grievance Officer: [FULL NAME]
• Designation: [DESIGNATION]
• Email: [email protected]
• Phone: [PHONE NUMBER]
• Postal address: CareerKing, Tower 10, 11D, Action Area 1C, New Town, Kolkata – 700156, West Bengal, India
• Response time: we acknowledge within [48 hours] and resolve within [30 days].

If we do not resolve your complaint to your satisfaction, you may escalate it to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

For general enquiries that are not about privacy, write to [email protected].