1. Who we are
Convolexa Solutions LLP ("Convolexa", "we", "us") is a limited liability partnership registered in India with its registered office at 405–406 Raghav Agency Corporate House, 169 R N T Marg, Indore, Madhya Pradesh, India. For personal data described in section 3, we are the controller (or "data fiduciary" under India's Digital Personal Data Protection Act, 2023).
2. Scope
This policy applies to personal data we collect through this website, through enquiries and business communications, from candidates who apply to work with us, and from representatives of our clients and suppliers. It does not apply to personal data we process on behalf of clients, which is governed by section 5 and by our contracts with those clients.
3. Data we collect
- Enquiry data: name, job title, organisation, email, telephone, country and the content of your message.
- Business relationship data: contact details of client and supplier representatives, contract and billing information, communications and meeting records.
- Candidate data: CVs, application details, interview notes, references and, where lawful, background-verification results.
- Website data: IP address, device and browser information, pages visited and referral source, collected through cookies and similar technologies where you consent.
- Marketing preferences: your subscriptions and opt-outs.
We do not intentionally collect special-category or sensitive personal data through this website. Please do not submit it.
4. Purposes and lawful bases
- Responding to enquiries and preparing proposals: legitimate interests, or steps taken at your request before entering a contract.
- Delivering services and managing the client relationship: performance of a contract and legitimate interests.
- Recruitment: legitimate interests and, where required, consent; legal obligation for right-to-work and similar checks.
- Business-to-business marketing: legitimate interests, or consent where PECR, CASL, the Spam Act 2003 or other law requires it.
- Website analytics and non-essential cookies: consent.
- Legal, tax, regulatory and accounting obligations: legal obligation.
- Establishing, exercising or defending legal claims: legitimate interests.
Where the DPDP Act applies, we process personal data on the basis of your consent or a legitimate use permitted by that Act, and you may withdraw consent at any time.
5. Client data we process as processor
When we provide services, we process personal data on our clients' documented instructions as a processor, service provider, business associate or data processor, as the relevant law describes it. The client's own privacy notice governs that data. Our obligations are set out in the data processing agreement that forms part of each engagement, and our safeguards are described on our Trust & security page. Individuals who wish to exercise rights over such data should contact the relevant client; we will assist the client in responding.
6. Sharing
We share personal data only with: our partners and personnel who need it; service providers acting on our behalf (hosting, email, CRM, analytics, background screening) under written contracts; professional advisers; licensed partner firms you have asked us to involve; and authorities where required by law. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
7. International transfers
We are based in India and our service providers may be located elsewhere. Where personal data is transferred from the UK, EU, Switzerland, Canada, Australia, the UAE, Saudi Arabia or another jurisdiction with transfer restrictions, we use a lawful transfer mechanism, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or contractual safeguards required by local law, supported by a transfer risk assessment. Copies of the relevant safeguards are available on request.
8. Retention
Enquiry data is kept for up to 24 months after our last contact unless a relationship follows. Client relationship records are kept for the duration of the relationship and for up to eight years afterwards to meet legal and tax requirements. Unsuccessful candidate data is kept for up to 12 months unless you agree to a longer period. Cookie data is kept for the periods shown in our cookie settings.
9. Security
We apply technical and organisational measures appropriate to the risk, including encryption, access control, multi-factor authentication, logging, staff training and confidentiality agreements. No system is completely secure; we will notify you and the relevant authority of a personal-data breach where the law requires.
10. Your rights
Depending on where you live, you may have the right to: access your personal data; correct or complete it; erase it; restrict or object to processing; data portability; withdraw consent; opt out of direct marketing; not be subject to solely automated decisions with significant effects; nominate another person to exercise your rights (India); and know the categories of personal data disclosed (California). We will respond within the time limit set by the law that applies to you, usually one month. We will not discriminate against you for exercising your rights.
11. Cookies
We use strictly necessary cookies to run this website. We use analytics and marketing cookies only with your consent, which you can withdraw at any time through the cookie settings link in the footer.
12. Children
Our services and website are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.
13. Complaints
Please contact us first. You may also complain to your local supervisory authority, such as the UK Information Commissioner's Office, an EU data protection authority, the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of Canada, the UAE Data Office, the Saudi Data and AI Authority, or the Data Protection Board of India.
14. Changes
We may update this policy. The current version and its date are always shown on this page; material changes will be notified to clients directly.
15. Contact and grievance officer
Privacy enquiries and requests: [email protected]
Grievance Officer (India): Sheevani Mahore, Designated Partner, at the registered office above.