1. About this notice
This notice explains how Pfundit collects, uses, shares, stores and protects your personal data when you apply for a role with us, are referred to us, or are contacted by us about a role. It applies to applications made through pfundit.com/hiring, by email to careers@pfundit.com, through LinkedIn, or through a recruitment agency or referrer.
It is written to meet the requirements of India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and Digital Personal Data Protection Rules, 2025 (DPDP Rules), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and Singapore’s Personal Data Protection Act 2012 (PDPA).
Most obligations under the DPDP Act and DPDP Rules come into force on 13 May 2027. Until then, the SPDI Rules continue to apply in India. We already follow the DPDP standards set out in this notice, in addition to the SPDI Rules.
This notice relates only to recruitment. Pfundit Capital Private Limited does not hold a Certificate of Registration from the Reserve Bank of India and does not offer loans or any other financial product or service.
2. Who we are
- Pfundit Capital Private Limited (CIN: U64910KA2026FTC227353; registered office: Prestige Central, 36 Infantry Road, M.G. Road, Bengaluru 560001, India) decides why and how your data is processed for roles in India. It is the “Data Fiduciary” under the DPDP Act and the “body corporate” under the SPDI Rules.
- Pfundit Pte. Ltd. (UEN: 202544131H; registered address: 14B, Stanley Street, Singapore 068733) is our parent company. It reviews applications and takes part in hiring decisions, and is an “organisation” responsible for your data under the PDPA.
In this notice, “Pfundit”, “we” and “us” mean both companies. Each is responsible for its own compliance, and you can contact either of them using the details in section 12.
Build–Operate–Transfer roles. For the Technology Lead role, you will initially be employed by our managed technology-services partner. We share the data needed for that arrangement with the partner, which processes it under its own privacy notice. We will name the partner before sharing your data.
3. Personal data we collect
We collect only what we need to assess your application. Specifically:
- Identity and contact details: name, email address, phone number, city of residence and professional profile links (such as LinkedIn).
- Application details: CV, cover letter, portfolio, employment history, education, qualifications, certifications, skills, current and expected compensation, notice period and references.
- Assessment details: interview notes, results of tests or case studies, and evaluator feedback.
- Offer-stage checks (only if we plan to make you an offer, with your separate consent): proof of identity, employment and education verification, reference checks and, for senior or key managerial roles, fit-and-proper checks such as litigation, regulatory and credit-history checks.
- Financial information (offer stage only): bank account details for payroll. This is “sensitive personal data or information” under the SPDI Rules, and we collect it only with your written (including electronic) consent.
- Accessibility information (optional): details you choose to share so that we can make reasonable adjustments to the recruitment process.
- Technical data: IP address, device and browser information and cookies when you use our application form. See our Cookie Notice.
Where we get it from: you; people who refer you; recruitment agencies; your public professional profiles; your referees; and, at offer stage, background-verification agencies.
4. Why we use your data and our legal basis
We use your personal data to:
- assess your skills, experience and suitability for the role you applied for, or for similar roles if you agree;
- communicate with you and arrange interviews and assessments;
- carry out offer-stage checks and, if you are selected, make an offer and prepare for onboarding;
- where you are selected for a senior or key managerial role, show regulators (including the Reserve Bank of India as part of our registration process) the capability and fit-and-proper status of our management team;
- keep our recruitment process secure, including preventing recruitment fraud and fake job offers; and
- comply with law and establish, exercise or defend legal claims.
India: we rely on the consent you give when you submit your application, which you can withdraw at any time (section 10). We may also rely on the “legitimate uses” allowed by section 7 of the DPDP Act, such as where you have voluntarily provided your data for a specified purpose or where processing is required to comply with law.
Singapore: we rely on your consent, including consent you are deemed to give by submitting your application voluntarily. We may also rely on the PDPA exception for “evaluative purposes” (assessing your suitability for employment) and on the need to comply with law.
Use of technology: we may use software, including AI-assisted tools, to organise applications and schedule interviews. No hiring decision about you is made solely by automated means; every decision is reviewed by a person.
5. Who we share your data with
We share your personal data only as needed for the purposes above, with:
- each other (Pfundit Capital Private Limited and Pfundit Pte. Ltd.) for hiring decisions;
- service providers who process data on our behalf, such as applicant-tracking, cloud-hosting, email, video-interview, assessment and background-verification providers, under written contracts that require them to protect your data and use it only on our instructions;
- our managed technology-services partner, for Build–Operate–Transfer roles;
- the recruitment agency or person who referred you, limited to the status of your application;
- our professional advisers, and regulators, courts, law-enforcement or government authorities where required by law; and
- a prospective buyer or investor in connection with a merger, acquisition or restructuring, subject to confidentiality.
We do not sell your personal data, and we do not use it for marketing.
6. International transfers
Your personal data may be transferred between India and Singapore, and to service providers in other countries.
- From India: the DPDP Act allows transfers outside India except to countries the Government of India restricts by notification. Singapore is not a restricted country at the date of this notice. Under the SPDI Rules, we transfer data only to recipients that provide the same level of protection, and where the transfer is needed for your application or you have consented.
- From Singapore: under the PDPA, we take steps to ensure that recipients outside Singapore protect your data to a standard comparable to the PDPA, for example through contractual clauses.
7. How long we keep your data
- If you are not selected: we keep your application for 12 months after the role is filled or closed, then erase it. If you agree, we will keep it for up to 24 months to consider you for future roles. You can ask us to erase it sooner.
- If you join us: your application becomes part of your employee record and is covered by our employee privacy notice.
We erase personal data once the purpose is served or you withdraw consent, unless the law requires us to keep it. As required by the DPDP Rules, we keep limited processing records (such as access logs) for at least one year. Under the PDPA, we stop keeping your data once it no longer serves the purpose for which it was collected or any legal or business purpose.
8. How we protect your data
We use reasonable security safeguards, designed with reference to IS/ISO/IEC 27001, including encryption, role-based and least-privilege access, access logging, vendor due diligence and confidentiality obligations for our staff.
If a personal data breach affects you, we will tell you without delay. We will also report it as the law requires, including to the Data Protection Board of India, to CERT-In, and, for notifiable breaches under the PDPA, to Singapore’s Personal Data Protection Commission (PDPC) within three calendar days of assessing that the breach is notifiable.
9. Your rights
Under Indian law
- Access: a summary of your personal data we process, what we do with it, and who we have shared it with.
- Correction and erasure: to correct, complete or update your data, or to erase data we no longer need.
- Withdraw consent: at any time, as easily as you gave it (see section 10).
- Grievance redressal: to raise a complaint with our Grievance Officer (section 12).
- Nomination: nominate another person to exercise your rights if you die or become incapacitated.
- Complain: to the Data Protection Board of India, once you have used our grievance process.
We will respond to requests and grievances within 30 days, and in any event within the time allowed by law. Under the DPDP Act, you must give us accurate information and must not raise false or frivolous grievances.
Under Singapore law
- Access: a copy of your personal data we hold and how it has been used or disclosed in the past year.
- Correction: to correct errors or omissions in your data.
- Withdraw consent: by giving us reasonable notice (see section 10).
- Complain: to the PDPC (pdpc.gov.sg).
We will respond to access and correction requests within 30 days or tell you when we will. We may charge a reasonable fee for access requests and will tell you the fee in advance.
How to make a request
Email privacy@pfundit.com with the subject line “Applicant data request” and tell us which right you want to exercise. We may ask you to verify your identity before we act on your request.
10. Withdrawing your consent
You can withdraw consent at any time by emailing privacy@pfundit.com or careers@pfundit.com. Once you do, we will stop processing your data and erase it (and ask our service providers to do the same), unless the law requires us to keep it.
Withdrawal does not affect processing before you withdrew. If you withdraw consent while your application is under review, we will not be able to continue considering you for the role.
11. Applicants under 18
Our roles are open only to people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will erase it.
12. Contact us
India – Grievance Officer
[Name], Grievance Officer
Pfundit Capital Private Limited
Prestige Central, 36 Infantry Road, M.G. Road,
Bengaluru 560001, India
Email: grievance@pfundit.com · privacy@pfundit.com
Hours: Monday to Friday, 10:00–18:00 IST
Singapore – Data Protection Officer
[Name or designation], Data Protection Officer
Pfundit Pte. Ltd.
14B Stanley Street,
Singapore 068733
Email: dpo@pfundit.com
Regulators: Data Protection Board of India (through its digital platform); Personal Data Protection Commission, Singapore (pdpc.gov.sg).
13. Language and changes to this notice
You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by emailing privacy@pfundit.com.
We may update this notice from time to time. We will post the updated version on pfundit.com/hiring with a new effective date and, if the changes are significant, tell applicants whose applications are under review.