Privacy Policy

TheProfession.org is an AI-powered job portal and career platform operated by OpNex (OPC) Pvt Ltd, a company incorporated under the Companies Act of India.

By using TheProfession.org, whether as a job seeker, employer, recruiter, college partner, or visitor, you agree to the terms described in this Privacy Policy. If you do not agree, please discontinue use of the platform immediately.

We collect information in three ways: information you give us directly, information collected automatically as you use the platform, and information from third-party sources.

2.1 Information You Provide Directly

When you register an account, we collect your full name, email address, mobile number, and password. When you build a profile as a job seeker, we additionally collect your date of birth, city, educational qualifications, work experience history, skill set, preferred job types, expected salary range, and resume content. When you apply for a job or internship, we log your application details and any cover letter or message you attach. When you use the AI Resume Builder, we store the sections you complete including your career objective, education, experience, skills, and projects so that you can return and continue editing. When you enrol in a training programme, we collect your educational background, preferred course, and payment information. When you submit an inquiry through our contact forms, we collect the details you enter including your organisation name, role, and the message content.

2.2 Information Collected Automatically

When you browse TheProfession.org, our servers automatically log your IP address, browser type, operating system, referring URL, pages viewed, time spent on each page, and search queries entered. We collect this data to understand how users navigate the platform, improve features, and detect fraudulent activity. We use cookies and similar browser storage to maintain your login session, remember your search preferences, and measure which job listings receive the most engagement. Device information including screen resolution and device type is also collected to ensure the platform renders correctly across all screens.

2.3 Information from Third Parties

If you sign in using a Google or LinkedIn account, we receive your name, email address, and profile picture from that provider subject to your permission settings on their platform. If an employer or recruiter views your profile and adds notes, we may store those annotations as part of the hiring workflow. We do not purchase data from third-party data brokers.

We use your information for the following purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent.

• To create and manage your account and authenticate your identity on each login.
• To match job seeker profiles with suitable job listings and internship openings using our AI ranking engine.
• To show your resume and profile to employers and recruiters when you apply to a listing or make your profile public.
• To generate ATS resume scores, profile completeness indicators, and personalised improvement suggestions.
• To facilitate the hiring workflow between job seekers and employers including application tracking and in-platform messaging.
• To process subscription payments and manage your billing history.
• To send transactional emails such as job application confirmations, password resets, and payment receipts.
• To send job alerts, platform updates, and promotional communications if you have opted in to receive them.
• To operate our AI Mock Interview feature and store your practice session history for your personal review.
• To manage college partnership accounts and bulk internship placement workflows.
• To detect, investigate, and prevent fraudulent activity, spam, and violations of our Terms of Service.
• To analyse platform usage in aggregate to improve features, fix bugs, and plan new product development.
• To comply with our legal obligations under Indian law.

Under applicable data protection laws including the Digital Personal Data Protection Act (DPDPA) 2023 of India, we rely on the following legal bases to process your personal data.

• Consent: For sending marketing communications and for processing sensitive personal data such as disability status or caste information if voluntarily provided.
• Contractual necessity: To deliver the services you have signed up for, including job matching, resume building, and payment processing.
• Legitimate interests: For platform security, fraud prevention, and aggregate analytics that improve our services without disproportionate impact on your privacy.
• Legal obligation: When we are required by law or a court order to process or disclose data.

We do not sell your personal data. We do not rent it. We do not share it with advertisers. We share data only in the circumstances described below.

5.1 With Employers and Recruiters

When you apply for a job or make your profile searchable, your resume, work history, skills, and contact details become visible to the relevant employer or recruiter on our platform. You can control your profile visibility at any time from your account settings. You can make your profile private and visible only when you actively apply.

5.2 With Service Providers

We use trusted third-party service providers to help operate the platform. These include Razorpay for payment processing, Firebase by Google for hosting and database services, email delivery providers for transactional and marketing emails, and cloud infrastructure providers for data storage. All service providers are bound by data processing agreements that prohibit them from using your data for any purpose other than providing services to us.

5.3 With College and Institution Partners

If you are a student registered through a college partnership account, your placement status and basic profile information may be shared with your institution's Training and Placement Officer as part of the placement management service.

5.4 For Legal Reasons

We may disclose your data to law enforcement agencies, courts, or government authorities if required by a valid legal order, warrant, or applicable law. We will notify you of such requests where permitted by law.

5.5 Business Transfers

If OpNex (OPC) Pvt Ltd is acquired by or merges with another entity, your data may be transferred as part of that transaction. We will notify users through the platform and by email before any transfer occurs and provide options regarding your data.

We take the security of your personal data seriously and implement multiple layers of protection.

• All data transmitted between your browser and our servers is encrypted using HTTPS with TLS 1.3.
• Passwords are never stored in plain text. They are hashed using bcrypt with a per-user salt before storage.
• User sessions are managed using signed JWT tokens with short expiry times and secure same-site cookie flags.
• Our databases are encrypted at rest. Backups are performed daily and stored in a separate secure location.
• Access to production databases is restricted to a minimal number of authorised team members and requires multi-factor authentication.
• We conduct periodic security reviews and penetration testing of the platform.
• Payment card data is never stored on our servers. All payment information is handled directly by Razorpay, a PCI-DSS certified payment processor.

Despite these measures, no system connected to the internet is completely immune to attack. In the event of a data breach that affects your personal data, we will notify affected users within 72 hours of becoming aware of the breach as required by applicable law.

We use the following types of cookies on TheProfession.org. You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality such as staying logged in or maintaining your search preferences.

• Essential cookies: Required for core platform functionality including session management and login state. Cannot be disabled without losing access to account features.
• Preference cookies: Store your settings such as saved job filters, location preferences, and display choices across sessions.
• Analytics cookies: Used to measure page views, user flows, and feature engagement in aggregate. We use this data internally to improve the platform. We do not share raw analytics data with advertisers.
• We do not use third-party advertising cookies or allow external ad networks to place cookies on our platform.

Under the Digital Personal Data Protection Act 2023 and other applicable laws, you have the following rights regarding your personal data held by us. To exercise any of these rights, email us at privacy@theprofession.org. We will respond within 30 days.

• Right of Access: You may request a complete copy of all personal data we hold about you in a portable, machine-readable format.
• Right to Correction: You may request correction of any inaccurate or incomplete personal data at any time, either directly through your account settings or by contacting us.
• Right to Erasure: You may request deletion of your account and all associated personal data. We will process deletion within 30 days except where retention is required for legal or compliance purposes.
• Right to Withdraw Consent: Where we process data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Right to Opt Out of Marketing: You may unsubscribe from all marketing communications at any time using the unsubscribe link in any email or by emailing us at support@theprofession.org.
• Right to Restrict Processing: You may request that we stop actively using your data while retaining it, for example while a dispute is being resolved.
• Right to Lodge a Complaint: If you believe your data protection rights have been violated, you may lodge a complaint with the Data Protection Board of India once established under the DPDPA 2023.

We retain your personal data for as long as your account remains active or as necessary to deliver our services. Here is how long we retain specific categories of data.

• Account and profile data: Retained for the life of your account plus 90 days after deletion request to allow for account recovery.
• Job application data: Retained for 2 years from the date of application to allow employers to access historic hiring records.
• Payment transaction records: Retained for 7 years as required by Indian financial record-keeping regulations.
• Server and security logs: Retained for 90 days for fraud investigation and platform debugging.
• Inquiry and contact form submissions: Retained for 1 year from submission date.
• AI resume and interview session data: Retained for the life of your account and deleted with your account.

After the retention period, data is securely and irreversibly deleted from our systems and backups.

TheProfession.org is intended for users who are at least 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that a user under 16 has created an account, we will delete that account and all associated data promptly. If you believe a child under 16 has registered on our platform, please contact us immediately at privacy@theprofession.org.

TheProfession.org is operated from India. Our primary servers are hosted in India through Firebase. Some service providers we use, such as email delivery services, may process data on servers located outside India. When data is transferred internationally, we ensure appropriate safeguards are in place including standard contractual clauses or the service provider's compliance with applicable cross-border transfer regulations under Indian law.

All payments on TheProfession.org are processed by Razorpay, a licensed payment aggregator. We do not store, see, or have access to your credit card number, debit card number, CVV, or net banking credentials at any point. These details are entered directly into Razorpay's PCI-DSS Level 1 certified payment environment. We only receive a transaction reference number, the payment status, and the amount paid from Razorpay after a transaction is completed.

Employers and recruiters who register on TheProfession.org provide company information, contact details, and job posting content. This data is used to operate the employer dashboard, display job listings, and facilitate the hiring process. Employer contact information is not displayed publicly to job seekers. Job seekers can only contact employers through the in-platform messaging system. We do not sell employer data to third parties or use it for any purpose outside platform operations.

Several features on TheProfession.org involve automated processing of your data. Our AI resume scoring system analyses your resume content against job description keywords and ATS best practices to generate a score. This score is informational and does not constitute an employment decision. Our job recommendation engine uses your profile, skills, and application history to suggest relevant listings. These are generated algorithmically and are not manually curated. Our mock interview tool processes your typed answers to generate feedback using AI. Session data is stored in your account for your personal review. You may request that automated scores or recommendations not be used for any purpose by contacting us, and you may opt out of AI-powered matching while still using the basic platform functionality.

TheProfession.org contains links to employer career pages, external job listings, training resources, and other third-party websites. This Privacy Policy does not apply to those external sites. We are not responsible for the privacy practices of any third-party websites. We recommend reading the privacy policy of any external site before submitting personal information there.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will notify you of significant changes by displaying a prominent notice on the platform and sending an email to your registered address at least 14 days before the change takes effect. Minor changes such as clarifications or typographical corrections may be made without notification. The date at the top of this policy will always reflect the most recent update. Continued use of the platform after a policy update constitutes acceptance of the revised terms.

In accordance with the Information Technology Act 2000 and rules thereunder, and the Digital Personal Data Protection Act 2023, we have appointed a Grievance Officer to address data protection concerns from Indian users.

For any privacy-related questions, requests to exercise your rights, or concerns about how we handle your data, please reach out through the following channels.

We take every privacy inquiry seriously and will respond within the timeframes specified in Section 8.