1. Introduction

Welspun Transformative services Ltd. (“WTSL”, “we”, “us”, or “our”) values your privacy and is committed to protecting your personal data throughout our recruitment process.

Our Welhire Talent Acquisition Application is an AI-enabled platform that streamlines recruitment by:

• Collecting job descriptions and role details from our HR teams, including department, location, salary range, required experience, and job level.
• Allowing candidates to submit applications, CVs, and contact information.
• Using artificial intelligence (AI) to match applications with job requirements.
• Scheduling interviews automatically and, where applicable, conducting preliminary AI-assisted interview assessments; and
• Enabling human recruiters to review AI outputs and make final hiring decisions.

This Privacy Notice explains how we collect, use, share, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Digital Personal Data Protection Act, 2023 (DPDPA), and applicable local laws.

2. Information We Collect from You

WTSL collects data both from internal HR sources and applicants who use the Welhire.

2.1 Information Provided by Candidates

Candidates submit data directly through the Welhire or via authorized recruiters. This includes:

a. Contact and Identification Data

1. Full name, email address, and phone number (used for communication and verification).
2. Nationality, country of residence, and eligibility to work.

b. Application Data (CV / Resume)

1. Employment history, education, professional skills, and certifications.
2. References, portfolio links, and cover letter information.

c. Voice, Video, and Test Data (AI Interview Assessments)

1. Audio or video responses recorded during AI-assisted or virtual interviews.
2. Written or verbal test results from aptitude, technical, or psychometric evaluations.
3. AI-generated scores and summaries assessing role suitability.

d. Technical and Usage Data

1. IP address, device type, browser version, access logs, and timestamps.
2. Interaction history within the Welhire (logins, test submissions, etc.).

e. Technical and Usage Data:

1. Subscription details, invoices, payment references, and contract metadata.

f. Support Data:

1. Communications and attachments submitted through customer support.

WTSL does not sell, rent, or otherwise commercially exploit Customer Data for independent marketing or profiling.

Note - Providing optional data such as diversity information or consent for talent pool retention is voluntary and will not affect your application outcome

3. Cookies and Tracking Technologies

For detailed information on the cookies we use, their purpose, duration, and how to manage your preferences, please see our Cookie Policy at Cookie Policy. You can also manage cookie settings through your browser at any time.

Essential cookies are required for the portal to function (e.g., session management, authentication) and cannot be disabled.

Optional analytics cookies help us understand how candidates use our platform. These are activated only with your consent, which you may grant or withdraw at any time through the cookie preferences panel on our portal.

WTSL does not use cookies for advertising, profiling for commercial purposes, or any purpose unrelated to the operation and improvement of the WelHire platform.

4. Your Rights

• Right to Access: You can request a copy of the personal data we hold about you, confirmation of whether we process it, the purposes for which it is used, and the identities of any third parties with whom it has been shared.
• Right to Correction and Completion: You can request that we correct inaccurate personal data or complete incomplete personal data we hold about you.
• Right to Erasure: You can request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where it has been unlawfully processed. Deletion may be deferred where we are required by law to retain your data.
• Right to Withdraw Consent: Where we process your data based on your consent, you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that took place before withdrawal. We will make withdrawal as easy as giving consent.
• Right to Restrict Processing (EU/UK only): You can request that we suspend active use of your personal data — while retaining it — where its accuracy is contested, processing is unlawful, or you have raised an objection.
• Right to Data Portability (EU/UK only): You can request a copy of your personal data in a structured, machine-readable format (e.g., JSON or CSV) and ask us to transfer it directly to another service provider where technically feasible.
• Right to Object to Processing (EU/UK only): You can object to processing of your personal data based on our legitimate interests, including profiling. You have an absolute right to object to your data being used for direct marketing.
• Right Against Solely Automated Decision-Making (EU/UK only): You have the right not to be subject to a decision made solely by automated means — including profiling — that produces legal or similarly significant effects on you, without human involvement.
• Right to Human Review and to Contest Decisions: Where an automated or AI-assisted decision significantly affects you, you can request that a qualified person reviews the decision, express your view, and challenge the outcome if you believe it was incorrect or unfair. You are also entitled to a clear explanation of the logic and key factors behind any such decision.
• Right to Nominate a Representative (India only): If you are an Indian resident, you can nominate one or more individuals to exercise your data rights on your behalf in the event of your death or incapacity.
• Right to Grievance Redressal (India only): If you are an Indian resident, you may raise a grievance with our designated Grievance Officer regarding the processing of your personal data (S. 13 DPDPA). We will acknowledge and address your grievance within the timelines prescribed under the DPDPA.

NOTE-The AI uses natural language processing to semantically match your CV with job descriptions by analysing keywords, skills, qualifications, and experience levels. It assigns a compatibility score that helps HR identify strong candidates. The AI interview system evaluates responses based on relevance, completeness, and communication quality. You will be informed whenever AI tools are used in your assessment. Where an AI-assisted output has materially influenced a decision affecting your application, you may request a meaningful explanation of the factors involved, ask for human review of that output, and challenge the decision if you believe it is incorrect or unfair.

To exercise any of these rights, contact us at dpo_wgcc@welspun.com.

Data Controller:

Welspun Transformative Services Limited

Corporate House – 6, Inspire Park, Adani Shanti gram, Ahmedabad - 382421 privacy@welspun.com | 18002582584

Data Protection Officer (DPO): Vikas Sharma dpo_wgcc@welspun.com | +91- 8860233568

Note- We aim to respond within one month, extendable to three months for complex cases. We will inform you of any extension and the reasons for the delay

5. Purpose and Lawful Basis of Processing

6. Use of Artificial Intelligence and Human Oversight

Welhire uses AI technology to analyze resumes, schedule interviews, and conduct preliminary assessments. Where AI-assisted tools are used during your assessment, you will be informed of this in advance. All AI outputs are advisory only and are reviewed by a qualified HR professional before any decision that significantly affects your application is made. However, all final hiring decisions are made by Welspun’s HR professionals.

The AI evaluates candidates based on semantic analysis of skills, experience, and competencies, producing a match score and qualitative feedback. These insights assist HR in shortlisting candidates but never replace human evaluation.

NOTE-WTSL performs regular audits of the AI system to detect and mitigate any potential algorithmic bias or unfairness. Our AI is prohibited from making exclusions based on protected characteristics such as gender, ethnicity, age, or disability. Human reviewers are trained to identify and correct any potential bias in AI-generated assessments.

7. International Data Transfers

Candidate data may be processed in:

• India (Microsoft Azure - Central India location).
• United States (Open AI infrastructure).

Safeguards include:

• SCCs for EU transfers and UK IDTA for UK transfers (Art. 46 GDPR).
• Encryption, access controls, and audit logging.
• Compliance with the EU–UK adequacy framework. Transfer Impact Assessments (TIAs) are conducted where required to assess the legal environment in the recipient country and apply supplementary safeguards. For transfers involving personal data of Indian residents, cross-border data flows are conducted in accordance with Section 16 of the DPDPA and any applicable Government of India notifications, with equivalent contractual and technical protections applied.
• Copies of safeguards can be requested from the DPO.

8. How We Safeguard your Personal Data

Safeguards include:

• Standard Contractual Clauses (SCCs) for EU transfers (Article 46 GDPR).
• UK International Data Transfer Agreement (IDTA) for UK transfers.
• Encryption, access controls, and audit logging.
• Compliance with the EU–UK adequacy framework (currently valid through December 27, 2025)

Welspun applies layered security measures, including:

• Encryption (TLS 1.2+ / AES-256) for all data in transit and at rest.
• Role-based access control, MFA.
• Continuous vulnerability assessments and security monitoring
• Employee awareness and confidentiality training.
• Incident response aligned with Articles 33–34 GDPR (72-hour supervisory authority notification for qualifying breaches) and applicable breach notification obligations under the DPDPA.

Additionally, Welspun Transformative Services Limited conduct a comprehensive Data Protection Impact Assessment (DPIA) to identify and mitigate privacy risks associated with AI-powered recruitment. This assessment covers potential algorithmic bias, data security, fairness, and transparency. The DPIA is reviewed regularly and updated as our AI systems evolve. We also maintain technical documentation of our AI systems’ accuracy, robustness, and bias-testing results, and keep automated logs of AI outputs to support auditability and human review. A summary is available upon request from our DPO.

9. Data Sharing and Third Parties Recipient-

WTSL does not authorize any third party to use personal data for its own marketing or promotional purposes. Personal data is shared only for the purposes described in this Privacy Notice and subject to appropriate contractual, technical, and organizational safeguards.

10. Data Retention Periods

After expiry, data is permanently deleted or anonymized per WTSL’s Data Retention & Disposal Policy.

11. Updates to This Notice

We may update this Privacy Notice periodically to reflect changes in law or processing activities. The 'Last Updated' date at the top indicates the most recent revision. Material updates will be communicated via email or system notification. If we introduce materially new processing activities or purposes not covered in this notice, we will provide you with updated information and, where required, seek your consent before proceeding.

12. Links to Other Sites and Advertisements

Our portal links to other websites that may collect personally identifiable information about you. Welspun is not responsible for the privacy practices or the content of those linked websites.

13. Data Security

WTSL implements industry-standard administrative, physical, and technical safeguards to protect data, including:

• Encryption of data in transit and at rest;
• Multi-factor authentication and role-based access controls;
• Continuous vulnerability monitoring and regular penetration testing; and
• Periodic security audits and staff training.

Any unauthorized access or data incident is handled in accordance with WTSL’s internal Incident Response and Breach Notification Policy.

14. Customer Responsibilities

Customers shall ensure that:

• They obtain lawful consent and provide notice to their users before submitting any personal data to WTSL;
• All data shared with WTSL is accurate and up to date; and
• No sensitive personal data (such as biometric or financial data) is uploaded to the Platform unless expressly authorized in writing.

Customers shall indemnify WTSL against any claims or penalties arising from their failure to comply with applicable data-protection obligations.

15. Age Restrictions

Our recruitment portal is intended for individuals aged 18 years and above. We do not knowingly collect personal data from individuals under the age of 18. All registrants are required to confirm at the point of registration that they are 18 years of age or older.

If you become aware that a minor has provided personal data through our portal, please notify us immediately at privacy@welspun.com. We will promptly delete such data upon verification.

16. Governing Law

This Policy shall be governed by and construed in accordance with the laws of India, and any disputes shall be subject to the exclusive jurisdiction of the courts at Mumbai, Maharashtra.

17. Consent for Future Opportunities

By opting in during application, you consent to WTSL retaining your data in the talent pool for up to 24 months and contacting you about suitable future roles.
You may withdraw consent anytime by emailing support@welhire.ai.

18. Effective Date and Acknowledgment

By continuing to use or access the WelHire Platform, You acknowledge that You have read, understood, and agreed to this Privacy Policy, and You authorize WTSL to process Your data in accordance with its terms.