Who we are

Escalati is the trading name of the human recruitment consulting division of Absolute Link Limited. We operate from head offices in India and Canada and provide recruitment, executive search, recruitment process outsourcing (RPO), HR consulting, payroll/employer-of-record (EOR) and recruitment advertising services to clients in both markets and beyond.

For the purposes of data protection law, Escalati is the data controller of personal information we collect directly from you (for example, when you submit a CV, contact us, or use our website), and a data processor where we handle information on behalf of a client under an EOR or similar arrangement. The exact role depends on the context; we explain it where relevant throughout this policy.

Scope of this policy

This policy applies to personal information collected through:

• Our website at escalati.site and any related sub-domains;
• Our recruitment, executive search, RPO, consulting, payroll/EOR and advertising services;
• Any communication with us — email, phone, in-person meetings, messaging apps or third-party recruitment platforms;
• Events, marketing campaigns and newsletter subscriptions we run.

It does not apply to third-party websites we may link to, or to client systems we may access while performing services for a client. Those are governed by the relevant third party’s own privacy notice.

What information we collect

We collect different categories of information depending on whether you are a candidate, a client, a website visitor or another business contact.

If you are a candidate

• Identity and contact data: name, email address, phone number, location, nationality, right-to-work status (where relevant).
• Professional data: CV/résumé, work history, education, qualifications, certifications, skills, references and interview notes.
• Compensation data: current and expected salary, benefits, notice period and other remuneration details you choose to share.
• Assessment data: results of interviews, tests, background checks (where you have consented) and our internal assessments of fit.
• Diversity data (optional): where you choose to complete a diversity monitoring form, this is kept separate and anonymised for reporting unless you consent otherwise.
• Any other information you provide to us — for example in a cover note, a message on LinkedIn or an email exchange.

If you are a client or a business contact

• Contact data: name, job title, work email, work phone, employer and office location.
• Relationship data: record of conversations, meetings, engagements, contracts and invoices.
• Billing data: invoicing address, purchase order references and payment records (we do not store full card details ourselves — these are processed by our payment providers).

If you use our website

• Technical data: IP address, browser type and version, device type, operating system, referring URL, pages visited, date/time of visit.
• Usage data: how you interact with our site (links clicked, time on page, search terms entered into our site search).
• Communication data: any information you submit through our contact forms, newsletter signups or blog comment features.

How we collect information

We collect information in three main ways:

Directly from you

When you send us your CV, submit a form on our website, email or call us, attend an interview, subscribe to our newsletter, respond to a job advertisement or connect with us on a recruitment platform.

From third parties

With your consent or where the law permits, from professional references, background-check providers, job boards, LinkedIn and other recruitment platforms, and — for client contacts — from publicly available company sources.

Automatically

When you visit our website, through cookies and similar technologies (see Section 11). We may also collect technical data through server logs and standard analytics tools.

Why we use your information

We use personal information for the following purposes, each of which is explained below:

1. To provide our recruitment services. To assess your suitability for roles, present you to clients (with your consent), and manage the interview and offer process.
2. To provide our consulting and payroll/EOR services. To onboard employees, run payroll, administer benefits and comply with local employment law in India and Canada.
3. To manage client relationships. To respond to enquiries, issue proposals, manage contracts and invoices, and provide customer support.
4. To improve our services. To understand which services are used, which articles are read, and how we can improve our website and content.
5. To send you marketing. To share our blog, market insights and service updates — but only where you have opted in, or where we have a legitimate interest in doing so, and always with the ability to unsubscribe.
6. To comply with our legal obligations. To maintain records required by tax, employment and anti-money-laundering law in India and Canada.
7. To protect our business. To detect and prevent fraud, misuse of our website and other unlawful activity.

We will only use your information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your information for an unrelated purpose, we will notify you and explain the legal basis.

Our legal bases

Depending on where you are and what information we are handling, we rely on one or more of the following legal bases:

India — Digital Personal Data Protection Act, 2023 (DPDP Act)

We process personal data on the basis of your consent or, where the DPDP Act permits, for certain legitimate uses — including employment-related purposes, compliance with legal obligations, and responding to medical emergencies or disasters. Where we rely on consent, you may withdraw it at any time (see Section 12).

Canada — Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents

We collect, use and disclose personal information only with your knowledge and consent, except where the law permits otherwise (for example, for legal, regulatory or security reasons, or in an emergency). We handle personal information in accordance with the fair information principles set out in PIPEDA.

European Economic Area / United Kingdom — GDPR and UK GDPR (where applicable)

Where GDPR applies to our handling of your information, we rely on the following bases:

• Contract — to take steps to enter into a contract with you, or to perform a contract we have with you;
• Legal obligation — to comply with a legal or regulatory obligation;
• Legitimate interests — for our legitimate business interests (for example, improving our services, maintaining client relationships), provided your rights do not override those interests;
• Consent — where we have asked for it (for example, for certain marketing or diversity monitoring).

Who we share information with

We do not sell your personal information. We share it only as needed to deliver our services, comply with the law, or with your consent. The main recipients are:

Clients (for candidates)

If you are a candidate, we will share your CV and relevant details with a client only with your consent, and only for a specific role we have discussed with you. You can withdraw that consent for any future submission at any time.

Group companies

We may share information with other companies in the Absolute Link Limited group — for example, to support advertising or media work — under appropriate data protection safeguards.

Service providers

We use a small number of trusted service providers to run our business, including:

• Cloud hosting and email providers;
• Applicant tracking and CRM systems;
• Payroll processors (for EOR services);
• Background-check providers (with your consent);
• Website analytics tools;
• Professional advisers (lawyers, accountants, auditors).

These providers are contractually required to protect your information and to use it only for the purposes for which we shared it.

Legal and regulatory recipients

We may share information where required by law, court order or a regulator; to protect our rights or the rights of others; or in connection with a merger, acquisition or sale of our business (in which case we will notify you of any material change in how your information is handled).

International data transfers

Escalati operates from India and Canada, and our team works across both markets. This means that your information may be transferred to, stored in and processed in a country other than the one in which you provided it.

Where we transfer personal information across borders, we take steps to ensure it receives an appropriate level of protection. These steps include:

• Relying on recognised adequacy mechanisms (where available);
• Putting in place appropriate contractual clauses (such as Standard Contractual Clauses) with our service providers;
• Applying internal data protection policies across the group; and
• Limiting access to those who need it for the purposes described in this policy.

How long we keep information

We retain personal information only for as long as we need it for the purpose for which it was collected, or for as long as the law requires. Our standard retention periods are:

• Candidate CVs and profiles: typically up to 24 months from the last meaningful contact, unless you ask us to delete them sooner or extend the period;
• Client contact records: for the duration of the client relationship and up to 7 years afterwards, to meet tax and legal record-keeping requirements;
• Website analytics data: typically up to 26 months, depending on the analytics tool;
• Marketing preferences and consent records: for as long as we continue to send you marketing, and for a reasonable period afterwards to evidence the consent;
• Payroll and EOR records: as required by applicable tax and employment law in India and Canada (typically 7 years).

When information is no longer needed, we securely delete or anonymise it.

How we protect information

We take the security of your information seriously and have put in place appropriate technical and organisational measures to protect it against accidental loss, unauthorised access, misuse, alteration or disclosure. These include:

• Encryption of data in transit (HTTPS) and, where appropriate, at rest;
• Access controls limiting who can see your information to those who need it;
• Multi-factor authentication on key systems;
• Regular software updates and security patching;
• Staff training on data protection and confidentiality;
• Confidentiality obligations in employment contracts and supplier agreements;
• Incident response procedures to detect, investigate and respond to breaches.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulator where required by law.

Cookies and tracking

Our website uses cookies and similar technologies to make the site work, understand how it is used, and (where you have consented) support marketing.

Types of cookies we use

• Strictly necessary cookies — required for the website to function (for example, remembering your cookie preferences). These cannot be switched off via our consent tool.
• Analytics cookies — help us understand which pages are visited and how users interact with the site. These are set by tools such as Google Analytics.
• Marketing cookies — set by advertising or social platforms to measure campaign effectiveness. These are used only where you have consented.

Managing cookies

You can manage cookies through our cookie consent banner (where shown), and through your browser settings. Blocking some cookies may affect the functionality of the site. For more information, see your browser’s help pages.

Do Not Track

Some browsers send a “Do Not Track” signal. There is currently no industry standard for how to interpret these signals, and we do not currently respond to them. You can still control cookies through your browser and our consent tool.

Your rights

Depending on where you live, you may have some or all of the following rights in relation to your personal information:

• Right of access — to receive a copy of the personal information we hold about you;
• Right to correction — to have inaccurate or incomplete information corrected;
• Right to erasure — to ask us to delete your information in certain circumstances (for example, where it is no longer needed for the purpose we collected it);
• Right to restrict processing — to ask us to limit how we use your information;
• Right to object — to object to processing based on legitimate interests, or to direct marketing;
• Right to data portability — to receive your information in a structured, commonly used, machine-readable format;
• Right to withdraw consent — where we rely on consent, to withdraw it at any time (without affecting the lawfulness of processing before withdrawal);
• Right to complain — to lodge a complaint with your local data protection authority.

Right to nominate (India — DPDP Act)

Under India’s DPDP Act, you may nominate an individual to exercise your data protection rights on your behalf in the event of your death or incapacity.

Right to grievance redressal (India — DPDP Act)

You may raise a grievance with us using the contact details in Section 17. If your grievance is not resolved within a reasonable time, you may escalate it to the Data Protection Board of India.

How to exercise your rights

To exercise any of your rights, or to ask us a question about how we handle your information, please email privacy@escalati.site or write to us at the address in Section 17.

To help us respond quickly, please include:

• Your full name and contact details;
• A clear description of what you would like us to do;
• Any information that helps us locate your records (for example, a recent email address you used with us).

We will verify your identity before acting on most requests. We aim to respond within 30 days, and will tell you if we need more time. We do not charge a fee for most requests, but may charge a reasonable fee for repeated, excessive or clearly unfounded requests.

Children’s privacy

Our services are aimed at adults in the workforce. Our website and services are not directed at children, and we do not knowingly collect personal information from anyone under 18 without appropriate parental or guardian involvement. If you believe we have collected information from a child, please contact us at privacy@escalati.site and we will delete it promptly.

Third-party links

Our website may contain links to third-party sites (for example, LinkedIn, job boards, or our partners). We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policy of any third-party site you visit.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our services, or the law. When we make material changes, we will:

• Update the “Last updated” date at the top of this page;
• Post the updated policy on this page; and
• Where required by law, notify you by email or through a banner on our website.

Your continued use of our website or services after an update takes effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.

How to contact us

If you have any questions, concerns or requests about this policy or about how we handle your personal information, please contact our data protection team at either of our head offices: