Applies to Data Principals in India under the Digital Personal Data Protection Act 2023 (DPDP Act) and the Digital Personal Data Protection Rules 2025, the Information Technology Act 2000 with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules) and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, in addition to the Privacy Policy.
1. Who we are under the Act
Axion Connect, Registered office address — to be confirmed, is the Data Fiduciary for personal data about workspace users and anyone who contacts us. For candidate data an organisation enters into HR Assist, that organisation is the Data Fiduciary and we are its Data Processor under the Data Processing Agreement, processing only under a valid contract and on its instructions (§8(2)).
2. Notice (§5) — what, why and how to withdraw
This supplement and the Privacy Policy together are the notice §5 requires. In itemised form:
| Personal data | Purpose |
|---|---|
| Name, work email, password hash or identity-provider ID, role | To provide and secure your account and send service email |
| Sign-in events, IP address, user agent | Security and abuse prevention |
| Calendar or mailbox connection | Scheduling and sending mail from your own account, with your consent through the provider's screen |
| Acceptance records | Evidence that you agreed to the Terms, and to which version |
| Billing contact and invoices | Charging for the Service and keeping tax records |
| Candidate data (on the recruiting organisation's behalf) | Recruitment, as that organisation describes in its own notice; see the Candidate Privacy Notice |
You may withdraw a consent as easily as you gave it: disconnect a calendar or mailbox in Settings; decline to start a proctored test; or write to privacy@axionconnect.com. Withdrawal does not affect processing before it, and processing the law permits without consent (a legitimate use under §7, such as performing a contract you asked for or complying with law) continues. You may exercise every right below and complain to the Data Protection Board of India in the manner section 6 describes.
3. Lawful ground
We process your personal data on the ground of your consent (§6) or a legitimate use (§7): where you voluntarily provided the data for the specified purpose, to perform the contract you are party to, to comply with Indian law, or for the security of the Service. Sensitive personal data under the SPDI Rules (passwords, and biometric data in a proctored test) is processed only with consent and for the stated purpose (Rule 5).
4. Children (§9)
We do not knowingly process personal data of anyone under 18, and the Service performs no tracking, behavioural monitoring or targeted advertising directed at children. A recruiting organisation that has entered such a record must delete it, and we delete it on notice.
5. Your rights as a Data Principal
- Access (§11) — a summary of the personal data processed, the processing activities, and the identities of Data Fiduciaries and Processors with whom it was shared.
- Correction, completion, updating and erasure (§12) — subject to retention the law requires.
- Grievance redressal (§13) — through the Grievance Officer in section 7.
- Nomination (§14) — you may nominate a person to exercise your rights if you die or are incapacitated; write to privacy@axionconnect.com with the nominee's name and contact.
- Consent Manager (§6(7)) — where you registered a consent through a Consent Manager, you may manage, review or withdraw it there.
Workspace users write to privacy@axionconnect.com. Candidates write to the organisation recruiting them, which is the Data Fiduciary; a request sent to us is forwarded within five business days. We respond within the period the DPDP Rules prescribe, and in any event within one month (SPDI Rules, Rule 5(9)). We do not treat anyone adversely for exercising a right; a Data Principal must not file a false or frivolous grievance (§15).
6. Complaints to the Data Protection Board
If the Grievance Officer does not resolve your grievance within the period in section 7, you may complain to the Data Protection Board of India under §13(3), in the manner the Board prescribes. We ask that you contact us first so we can resolve the matter.
7. Grievance Officer
Grievance Officer — to be named, Axion Connect, Registered office address — to be confirmed, privacy@axionconnect.com. Grievances are acknowledged within 24 hours and resolved within 15 days of receipt (IT Rules 2021, Rule 3(2)), and in any event within the period the DPDP Rules prescribe.
8. Security and breach (§8(5), §8(6); SPDI Rule 8)
We maintain the reasonable security practices in section 8 of the Privacy Policy and Annex II of the DPA. On a personal-data breach we inform each affected Data Principal without delay and the Data Protection Board within the period the DPDP Rules prescribe, and we tell a recruiting organisation within 48 hours so it can meet its own duty.
9. Retention and erasure (§8(7))
We erase personal data when the specified purpose is no longer served or when you withdraw consent, unless retention is required by law; the periods are in section 6 of the Privacy Policy. Where the Rules set a period after which a Data Principal is deemed inactive, we notify the Data Principal before erasing.
10. Transfers outside India (§16)
Personal data is hosted in the United States and processed by the sub-processors on the Sub-processors page. Transfers are made under §16 to countries the Central Government has not restricted, under written contracts that impose obligations no less protective than this supplement.
11. Significant Data Fiduciary
We are not notified as a Significant Data Fiduciary under §10. If we are, we will appoint a Data Protection Officer resident in India and an independent auditor, and update this supplement.
12. Contact
Axion Connect · Registered office address — to be confirmed · privacy@axionconnect.com · Grievance Officer: Grievance Officer — to be named
Questions about this document?
Write to privacy@axionconnect.com for anything about data and privacy, or support@axionconnect.com for the agreement itself. We reply within one working day.