HireWings ("HireWings", "we", "us", or "our") operates the website www.thehirewings.com and provides premium recruitment services. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it.
This policy applies to employers and hiring managers who contact us through our website, candidates whose details we receive in the course of providing recruitment services, and all visitors to our website.
By using our website or engaging our services, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Employer and Client Data (Contact Form)
When a company or hiring manager submits an enquiry through our contact or hire-talent form, we collect:
- Full name
- Business email address
- Company name
- Job title or role being hired
- Phone number (optional)
- Enquiry type and message content
- Source of the enquiry (e.g. website, referral, LinkedIn, Google)
1.2 Candidate Data
In the course of providing recruitment services, we may receive or collect:
- Full name, contact details (email, phone, city)
- CV / résumé and work history
- Current and expected compensation
- Educational background and certifications
- Skills, competencies, and technology experience
- Interview notes and assessment feedback
- References provided by or about the candidate
- LinkedIn profile or professional social media profiles
- Visa or work authorisation status (where relevant to an assignment)
Candidate data is collected directly from candidates, from publicly available professional platforms (such as LinkedIn), or from employers and third parties in the course of an active recruitment assignment.
1.3 Technical and Usage Data
When you visit our website, we automatically collect certain technical data, including:
- IP address and approximate geographic location
- Browser type, version, and device type
- Pages visited, time on page, and referring URL
- Session identifiers (stored in cookies — see Section 5)
2. How We Use Your Information
2.1 Employer and Client Data
- To respond to your hiring enquiry and provide a recruitment proposal
- To match suitable candidates to your vacancy
- To send service-related communications (follow-ups, shortlists, interview coordination)
- To maintain our CRM and manage our client relationship
- To send email notifications about new enquiry submissions (operational)
- To improve our services based on the types of roles clients engage us for
2.2 Candidate Data
- To identify and assess suitability for current and future job opportunities
- To present your profile (with your knowledge and consent) to relevant client employers
- To coordinate interviews, assessments, and offer processes
- To maintain a talent database for future relevant roles
- To comply with our obligations to client employers
2.3 Website Usage Data
- To understand how visitors use the site and improve page content
- To diagnose technical issues and monitor server performance
- To measure the effectiveness of our content and landing pages (analytics)
3. Legal Basis for Processing
For individuals in the European Economic Area (EEA) or United Kingdom, the General Data Protection Regulation (GDPR) requires us to identify a lawful basis for each processing activity:
- Contract performance — processing necessary to provide recruitment services you have engaged us for.
- Legitimate interests — operating our business, maintaining a talent pipeline, responding to enquiries, improving our services, and ensuring security. We assess that our legitimate interests do not override your rights in these cases.
- Consent — where we rely on consent (e.g. adding a candidate to a talent database for future roles, analytics tracking), you may withdraw consent at any time by contacting us.
- Legal obligation — where processing is required to comply with applicable law.
For individuals in India, processing is carried out in accordance with the Digital Personal Data Protection Act 2023 (DPDP Act) and the Information Technology Act 2000 (see Section 10).
4. Data Sharing
HireWings does not sell personal data. We share personal data only in the following circumstances:
4.1 Client Employers
Candidate profiles are shared with client employers only in connection with an active recruitment assignment and only with the candidate's knowledge. We do not share candidate data speculatively without a specific role context.
4.2 Service Providers
We use a small number of third-party services to operate our business. These include:
- Cloud hosting and database infrastructure (Replit / PostgreSQL)
- Email delivery services (SMTP provider for operational notifications)
- Analytics platforms (Google Analytics, Microsoft Clarity — see Section 5)
- Video conferencing tools (for candidate and client meetings)
All service providers are contractually bound to process data only on our instructions and to maintain appropriate security standards.
4.3 Legal Requirements
We may disclose personal data if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect rights, safety, or property.
5. Cookies and Analytics
5.1 Essential Cookies
Our website uses a session cookie (hw_session) to maintain authenticated admin sessions. This cookie is strictly necessary for the operation of the admin panel and is not used on public pages. It is set only when an administrator logs in, expires after 24 hours, and is marked HttpOnly and Secure.
5.2 Analytics Cookies
We use or intend to use the following analytics services to understand how our website is used. These services may set cookies or use similar tracking technologies:
- Google Analytics 4 — page views, session data, traffic sources. Data is processed by Google LLC in accordance with their privacy policy. You can opt out via the Google Analytics Opt-out Browser Add-on.
- Microsoft Clarity — session recordings and heatmaps to understand interaction patterns. Data is processed by Microsoft in accordance with their privacy policy.
- LinkedIn Insight Tag — conversion tracking for LinkedIn advertising campaigns. Set only if you arrive from a LinkedIn ad. Data processed by LinkedIn / Microsoft.
Analytics cookies are not set until you have given consent where required by applicable law. You can withdraw consent at any time by clearing cookies in your browser settings.
5.3 Managing Cookies
Most browsers allow you to refuse or delete cookies. Refusing essential cookies will prevent admin functionality from working. Refusing analytics cookies will not affect your ability to use any public feature of the website.
6. Data Retention
- Employer enquiries — retained in our CRM for up to 3 years from the date of the last interaction. Enquiries that do not result in an engagement are reviewed annually and deleted if no further contact is anticipated.
- Candidate data (active) — retained for the duration of an active recruitment process plus 12 months thereafter to facilitate follow-up opportunities.
- Candidate data (talent database) — retained for up to 3 years from the date of collection or last meaningful interaction. You may request deletion at any time.
- Website analytics data — retained in accordance with the retention settings of the respective analytics platform (typically 14 months for GA4).
- Session data — admin sessions expire after 24 hours.
We review retained data periodically and delete data that is no longer necessary for the purpose for which it was collected.
7. Your Rights
Depending on your location and applicable law, you may have the following rights in relation to your personal data:
- Right of access — to obtain a copy of the personal data we hold about you.
- Right to rectification — to correct inaccurate or incomplete data.
- Right to erasure — to request deletion of your personal data where there is no longer a lawful basis for processing it.
- Right to restrict processing — to ask us to pause processing while accuracy or lawfulness is assessed.
- Right to data portability — to receive your data in a structured, machine-readable format (GDPR only).
- Right to object — to object to processing based on legitimate interests, including direct marketing.
- Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting prior processing.
Under India's Digital Personal Data Protection Act 2023, data principals have the right to access information about their data, to correct inaccuracies, to erasure upon withdrawal of consent (where consent was the basis), and to grievance redressal.
To exercise any of these rights, please contact us at info@thehirewings.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.
If you are in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.
8. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include:
- Encrypted HTTPS connections for all website traffic
- PostgreSQL database with access restricted to application services
- Admin access protected by bcrypt-hashed passwords and session-based authentication
- Session cookies configured as HttpOnly, Secure, and SameSite=Strict
- Rate limiting on contact form and login endpoints to prevent brute-force attacks
- Separation of admin credentials from application code (stored as environment secrets)
No method of transmission over the internet or electronic storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights, we will notify affected individuals as required by applicable law.
9. International Transfers
HireWings is based in India. Where we transfer personal data outside India (for example, to cloud infrastructure or analytics services located in the United States or European Union), we ensure that appropriate safeguards are in place in accordance with applicable data protection law, including standard contractual clauses where required by GDPR.
Candidate profiles shared with client employers located outside India are transferred only with the candidate's awareness and in connection with a specific role.
10. Indian IT Act Compliance
HireWings complies with the following Indian legislation applicable to the collection and processing of personal data:
- Information Technology Act, 2000 (IT Act) — we comply with Section 43A (reasonable security practices) and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules). We implement a comprehensive information security programme aligned with ISO/IEC 27001 principles for the protection of sensitive personal data.
- Digital Personal Data Protection Act, 2023 (DPDP Act) — we process personal data lawfully, collect only what is necessary for the stated purpose, maintain accuracy, and respect the rights of data principals as set out in Section 7 above. We will update this policy as the DPDP Act's implementing rules are notified by the Government of India.
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — to the extent applicable to our services, we comply with intermediary obligations including the publication of this privacy policy and grievance redressal mechanism.
Grievance Officer: In accordance with the IT Act and DPDP Act, any grievances regarding the processing of your personal data may be addressed to us at info@thehirewings.com. We will acknowledge grievances within 48 hours and resolve them within 30 days.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Continued use of our website or services after changes are published constitutes acceptance of the updated policy.
12. Contact Us
If you have any questions, requests, or concerns about this Privacy Policy or our data practices, please contact us: