01
Laws we follow
- Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
- Information Technology Act, 2000 and its rules on reasonable security practices.
- Reserve Bank of India rules for online payments, through our payment provider.
- For customers in the EU and UK, the GDPR, through a data processing agreement.
02
Who is responsible for what
Your organization decides which candidates are interviewed and why. Under the DPDP Act, your organization is the Data Fiduciary for candidate data, and Polar Integrity processes that data on your behalf as a Data Processor.
- We use candidate data only to run the checks and produce the report for your interview.
- We do not sell candidate data or use it for advertising.
- Reports never rank candidates or recommend a hiring outcome. The decision stays with your team.
- A data processing agreement is available for enterprise customers.
03
Candidate consent
- Before anything is collected, the candidate sees what is collected, what is not, how long it is kept, who can see it and their rights.
- The notice is available in English and Hindi.
- Each consent is recorded with the time, IP address, browser and the version of the notice.
- Call audio is captured only if the candidate agreed to a notice that covers it. When the wording changes, candidates are asked again.
- The candidate can close Polar Check at any time. The report then shows it was closed.
04
Notice to interviewers
Call audio includes what interviewers say. Every interviewer assigned to an interview is told this in their assignment email and reminder. Your organization is responsible for informing interviewers who are not its employees, such as agency panelists.
05
Data retention
| Data | Kept for |
|---|---|
| Full call audio | Not stored. It is analysed while the call runs. |
| Evidence clips | 30 days by default. Admins can set 7 to 90 days. |
| Voice profile used for matching | Deleted once the report is generated. |
| Reports and interview events | 12 months. |
| Candidate contact details | Deleted with the interview. |
| Consent records and audit log | Kept as a record of what was agreed and done. |
| Error reports | 30 days, with personal data removed. |
| Encrypted backups | Up to 90 days, then deleted. |
Deleted data can remain in encrypted backups until they expire. It is not restored into the service except to recover from an incident.
06
Data requests
Candidates have the right to access, correct and erase their personal data, and to raise a grievance. Because your organization is the Data Fiduciary, candidates should contact the organization that interviewed them. We act on that organization's instructions.
If a request reaches us directly, we pass it to the organization and help it respond. Write to [email protected].
07
Sub-processors
We use a small number of vetted providers for hosting, email delivery, payments and monitoring. The full list, with what each provider processes and where, is part of our data processing agreement and is shared with customers on request: write to [email protected].
08
Billing and tax
- Every purchase has a numbered invoice, available to your organization’s admins.
- Polar Integrity is not yet registered under GST, so prices include no GST and invoices say so. This will change once we register, and existing customers will be told first.
09
Contact
For compliance questions, a data processing agreement or a security questionnaire, write to [email protected].