Version 1.0 | Effective 17.08.2026 | Last reviewed 17.08.2026
1.1 This Privacy Policy explains how we collect, use, disclose, retain and protect personal data, and the rights available to you in relation to that data. It applies to our website, to our dealings with clients and prospective clients, and to our processing of information about candidates.
1.2 Controller and processor: Where we determine the purpose and means of processing we are the controller and, under Indian law, the Data Fiduciary. Where we process candidate information solely on a client's documented instructions we act as a processor, and the client is the controller.
1.3 Applicable law: We are established in India. This Policy is drafted to comply with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India); and to the extent they apply to our processing, the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and Canada's Personal Information Protection and Electronic Documents Act. Where laws differ, we apply the standard most protective of the individual.
1.4 The Indian Rules were notified on 14 November 2025 and core obligations for Data Fiduciaries including notice, purpose limitation, retention and erasure, and security safeguards are phased in over eighteen months from that date. We are implementing this Policy ahead of that deadline.
| Entity | Details |
|---|---|
| Legal name | NorthRidge Solution LLP, trading as NorthRidge Solution |
| Registered address | L Block, Lajpat Nagar-III, New Delhi, Delhi-110024 |
| Registration number | ADA-5614c |
| Privacy contact | office@northridgesolution.com |
| Grievance Officer (India) | Taha Hayat |
3.1 We process the following categories. This itemisation is provided because Indian law requires an itemised description of the personal data processed, and Californian law requires disclosure by category.
| Data subject | Categories of personal data | Illustrative examples |
|---|---|---|
| Website visitors | Identifiers; internet activity | Name, email address, company, message content; IP address, browser and device type, pages viewed, referring site |
| Clients and prospective clients | Identifiers; professional information; commercial and financial records | Name, job title, business email and telephone, employer, role requirements, correspondence, engagement terms, invoices, payment details |
| Candidates who contact us | Identifiers; professional and employment information; compensation information | Name, contact details, curriculum vitae, employment history, qualifications, professional licences, references, notice period, salary expectations, interview notes |
| Candidates identified through research | Identifiers; professional and employment information | Name, current and previous job titles, employers, city or metropolitan area, skills and software proficiency, stated certifications, publicly recorded professional licence details, published professional profile |
| Suppliers | Identifiers; commercial records | Contact details, contract and payment records |
3.2 We do not knowingly process any special category or sensitive personal data. We do not seek information about health, racial or ethnic origin, religious or philosophical belief, political opinion, trade union membership, genetic or biometric data, sex life or sexual orientation. Please do not send such information to us. If it reaches us unsolicited we will delete it.
4.1 We obtain personal data from the sources set out below. This disclosure is made because, where data is not obtained from the individual directly, the law requires us to identify its source, including whether it came from publicly accessible sources.
| Source | What we obtain | Publicly accessible? |
|---|---|---|
| The individual directly | Everything you send us by email, through the website, or in conversation | Not applicable |
| Professional networking platforms, principally LinkedIn | Self-published career history, job titles, employers, location, skills and certifications | Yes, as published by the individual |
| Licensed professional data platforms | Structured education and employment history compiled from public and licensed sources | Partly |
| Public regulatory registers, including state licensing boards | Professional licence number and status, for verification only | Yes |
| Referrals | Name and the roles an individual may suit | No |
| Clients | Details of candidates already within the client's process | No |
| Our website and hosting infrastructure | Technical and usage data | No |
5.1 We process personal data only for the purposes set out below. We do not process it for any further purpose that is incompatible with these.
| Purpose | Data subjects | Lawful basis |
|---|---|---|
| Responding to enquiries and arranging introductory calls | Visitors, clients, candidates | Consent; steps taken at the request of the individual prior to entering a contract |
| Providing recruitment services: researching, identifying, approaching, screening and introducing candidates | Candidates | Legitimate interests (clause 6); consent where required by applicable law |
| Providing marketing services to clients | Clients | Performance of a contract |
| Verifying professional licences against public registers | Candidates | Legitimate interests in ensuring the accuracy of information supplied to clients |
| Managing the client relationship, invoicing and collecting payment | Clients | Performance of a contract; legal obligation |
| Meeting accounting, tax and other statutory obligations | Clients, suppliers | Legal obligation |
| Maintaining the security and integrity of our systems and records | All | Legitimate interests; legal obligation |
| Sending occasional information about our services to business contacts | Clients and prospective clients | Legitimate interests, subject to an opt-out in every communication |
6.1 Executive and technical search necessarily involves identifying people who are qualified for a role before any approach is made. It follows that we may hold information about you before you have ever heard from us.
6.2 Where this is so, we rely on our legitimate interests in matching qualified professionals to suitable roles, and on the corresponding interest of employers in identifying them. We have carried out and documented an assessment balancing that interest against your interests, rights and freedoms.
6.3 The safeguards that make that balance a fair one, and which we apply as binding practice, are:
we limit ourselves to professional information of the kind an individual publishes for professional purposes;
we do not purchase, and do not hold, the inferred age-group and gender fields offered by data platforms;
we do not disclose your identity, or the fact that you have been researched, to any client until you have been approached and have agreed to be put forward. Shortlists prepared before that point are anonymised;
we do not use the information for automated decision-making or profiling that produces legal or similarly significant effects;
we tell you that we hold information about you at the first point of contact, and in any event within one month of obtaining it; and
we act on any objection promptly and without requiring a reason.
6.4 Your right to object: You may require us to erase information we hold about you at any time by writing to office@northridgesolution.com. We will do so, and confirm when it is done. Exercising this right costs you nothing and will not affect how we deal with you in future.
7.1 We do not sell personal data, and we do not share it for cross-context behavioural advertising: In the twelve months preceding the date of this Policy we have not sold or shared personal data within the meaning of Californian law.
7.2 We disclose personal data only as follows:
to a hiring client, where a candidate has been approached and has agreed to be put forward;
to service providers who process on our documented instructions and are bound by written contract, listed at clause 8;
to our professional advisers, where necessary and under a duty of confidence;
to a purchaser or successor in the event of a reorganisation of our business, subject to equivalent protection; and
to a court, regulator or public authority where we are required by law to do so.
8.1 We retain personal data only for as long as necessary for the purpose for which it was collected, and then erase or anonymise it. The periods below are stated by category, as Californian law requires, and reflect our actual practice rather than an aspiration.
| Category | Retention period | Criteria applied |
|---|---|---|
| Website enquiries that do not proceed | [12] months from last contact | Sufficient to answer follow-up correspondence |
| Client records and correspondence | Term of the engagement plus [X] years | Limitation period for contractual claims |
| Invoices and accounting records | [8] years | Retention required under applicable tax law |
| Candidate records where the candidate has engaged with us | [24] months from last contact, then reviewed | Typical interval between career moves |
| Research records where the candidate has not been approached | [12] months, then erased | Professional information becomes stale |
| Security and access logs | [12] months | Minimum log retention expected under the Indian Rules |
8.2 Where the Indian Rules require it, we will give you at least forty-eight hours' notice before erasing your personal data on grounds of inactivity, so that you may tell us if you wish us to retain it.
9.1 We maintain reasonable technical and organisational security safeguards, including encryption of data in transit, access controls limiting access to those who need it, logging and monitoring of access, retention of logs, backups tested for recoverability, and contractual security obligations imposed on our processors.
9.2 No system is entirely secure. We do not represent that our safeguards are proof against every risk.
10.1 If a personal data breach occurs we will notify each affected individual without delay, through their registered means of contact, describing the nature and extent of the breach, its likely consequences, the measures we have taken to mitigate it, the steps you may take to protect yourself, and the contact details of the person who can answer your questions.
10.2 We will notify the Data Protection Board of India without delay of the nature, extent, timing, location and likely impact of the breach, and will furnish a detailed report within seventy-two hours. Where the General Data Protection Regulation applies we will notify the competent supervisory authority within seventy-two hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.
11.1 We do not make decisions producing legal effects, or similarly significant effects, by automated means alone. Research tools may rank or score profiles against a role specification, but every shortlisting decision is reviewed and made by a person.
12.1 Our services are directed to professionals and are not intended for children. We do not knowingly process the personal data of any person under the age of eighteen. Where Indian law requires verifiable consent from a parent or lawful guardian before a child's data is processed, we do not undertake such processing at all. If you believe we hold information about a child, tell us and we will erase it.
13.1 We may amend this Policy. The version number and effective date at the head of this document will be updated. Where an amendment materially affects how we process your personal data, we will notify you directly if we hold a means of contacting you.