Version 1.1

Privacy Notice

Effective date: 12 August 2026 · Last updated: 26 October 2026

1. Who we are

Diviplace is operated by Divikriti Technologies Private Limited (CIN U62099TS2025PTC202302; registered office: Telangana, India) (“we”, “us”, “our”). We are the data controller for personal data processed through the Diviplace platform.

Divikriti Technologies Private Limited is established in India. We do not currently operate a separate European establishment. Where we process the personal data of people in the European Economic Area we do so as a controller established outside the EEA, and EU data-protection law still applies to that processing. We are taking advice on appointing an EU representative under Article 27 GDPR and will name it here before one is required.

Contact: [email protected]

1a. Which country’s rules apply to you

Diviplace is used by recruiters, employers and candidates in different countries, and a single placement routinely spans more than one — an Indian recruiter, a Dutch employer and a candidate in the United States can all touch the same record. Rather than publish one notice per audience, this notice is written to cover every combination, with country-specific clauses stated where the law of that country demands something different.

India — our place of establishment. Processing here is governed by Indian law, including the Digital Personal Data Protection Act.
European Economic Area (incl. the Netherlands) — where you are in the EEA, the GDPR applies to your personal data regardless of where we are established. Your rights in section 6 apply in full, and the Article 27 position in section 1 applies.
United States — state privacy laws may give you additional rights depending on your state of residence. Where they do, we honour them through the same request route in section 6.
Anywhere else — this notice applies as written. Countries are added to the platform through the operating-countries configuration, and a country joining that list does not require a new privacy notice: it inherits this one, plus any country-specific clause added here at the same time.

Which country’s clauses apply is determined by where you are, not by where the other parties to a placement are. If two sets of rules both apply to the same record, we apply the stricter one.

2. Service status

Diviplace is at version 1.0, a live service with paid plans. We do not reset or delete your workspace's data as part of developing the product. Features improve over time; if a change affects how your data is stored or kept, we tell you at least 30 days before it takes effect.

3. What data we collect and why

Category	Examples	Purpose	Legal basis
Account data	Name, email address, organisation name	Create and manage your account	Contract (Art. 6(1)(b) GDPR)
Candidate data	CV, contact details, employment history, interview notes	Recruitment pipeline management	Legitimate interest (Art. 6(1)(f)); Consent where required
Placement records	Contract dates, hours worked, pay rates	Manage placements and timesheets	Contract (Art. 6(1)(b))
Usage data	Page views, feature usage, error logs	Platform improvement and debugging	Legitimate interest (Art. 6(1)(f))

4. How long we keep your data

Account data: Retained for the duration of your account plus 12 months after closure.
Candidate data: Retained for up to 2 years from last activity, or until you request deletion.
Placement and timesheet records: Retained for 7 years for tax/legal compliance.
Data in the current release: Subject to the retention terms in Section 2 above.

5. Who we share data with

We share personal data only with the service providers that run Diviplace for us (hosting, database, sign-in, e-mail, payments, error monitoring and AI). They are listed, with what each does and where, on our Sub-processors page.

All subprocessors are contractually bound to process data only as instructed and maintain appropriate security measures. We do not sell personal data to third parties.

6. Your rights under GDPR

If you are in the EU/EEA or UK, you have the following rights:

Access: Request a copy of the personal data we hold about you.
Rectification: Ask us to correct inaccurate data.
Erasure: Request deletion of your data where there is no overriding legal obligation to retain it.
Portability: Receive your data in a machine-readable format.
Restriction: Ask us to restrict processing in certain circumstances.
Objection: Object to processing based on legitimate interest.
Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any right, contact [email protected]. We respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

6a. Your rights in India (Digital Personal Data Protection Act, 2023)

If you are in India, you can ask us:

for a summary of the personal data we process about you and who we shared it with;
to correct, complete, update or erase your personal data;
to withdraw a consent you gave (this does not affect processing that already happened);
to nominate another person to exercise these rights if you die or become unable to;
to resolve a grievance about how we handle your data.

Grievance contact: Manoj Gandla, [email protected]. We acknowledge a grievance within 7 days and answer within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

7. Security

Data is encrypted in transit (TLS) and at rest by our hosting and database providers (encrypted disks). The contents of support requests are additionally encrypted field by field with AES-256-GCM. Access to production data is limited to the people who run the service, every workspace's data is separated by workspace, and we review security regularly. No system is perfectly secure; if you discover a vulnerability, please contact [email protected].

8. Changes to this notice

We will post any changes to this page and update the “Last updated” date above. Material changes will be notified by email to registered users at least 14 days in advance.