This notice explains what personal data Dxred Technologies Private Limited, which operates the Optiploy service ("Optiploy", "we") collects, why, who sees it, how long we keep it and what choices you have. It applies to our website and platform. We act as the data controller (under GDPR and UK GDPR) and the data fiduciary (under India's DPDP Act 2023).

1. Data we collect

Data we collect
Category	Examples	Who it is about
Account data	Name, email, password hash, role, company	Everyone with an account
Profile data	Headline, products, experience, certifications, rate, availability, location	Talent
Verification data	Government ID, liveness check results, certification checks	Talent
Engagement data	Requirements, proposals, contracts, timesheets, approvals, messages	Clients and Talent
Usage and device data	Pages visited, device and browser type, IP address, cookie identifiers	Visitors and users
Communications	Messages to us, form submissions, support requests	Anyone who contacts us

We collect most of this from you directly. We also receive some from our verification provider, certification bodies you ask us to check, and from the company or professional on the other side of an engagement. We do not ask for more than we need, and we do not knowingly collect special-category or sensitive data beyond identity documents needed for verification.

2. Why we use it, and our legal basis

Purposes and legal bases
Purpose	Basis (GDPR / UK GDPR)	Basis (DPDP)
Create and run your account	Contract	Consent or legitimate use
Verify identity and skills, and match assignments	Contract; legitimate interests	Consent
Run engagements, timesheets, invoices and payouts	Contract; legal obligation	Legitimate use; consent
Keep the platform safe, prevent fraud and enforce our rules	Legitimate interests; legal obligation	Legitimate use
Respond to enquiries and send service messages	Contract; legitimate interests	Consent or legitimate use
Send marketing you opted into	Consent	Consent
Analytics and improving the site, where you allow it	Consent	Consent

Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing done before, and may mean we can no longer provide part of the service.

3. Who we share data with

We do not sell your personal data. We share it only as needed:

The other party in an engagement. Clients see the profile information Talent put forward for an assignment; Talent see the company and requirement details.
Service providers acting for us, such as hosting, identity verification (Veriff), email and support, analytics where you allow it, and professional advisers. They may use data only on our instructions.
Authorities and legal needs, where the law requires it or to protect rights, safety or the platform.
A business transfer, such as a merger or sale, with notice to you where required.

4. International transfers

We host data in the EU (EU West, Amsterdam, Netherlands) and our team and providers may access it from other countries, including India. Where data moves out of the EU or UK, we use approved safeguards such as standard contractual clauses, or another lawful transfer mechanism. Under the DPDP Act, we transfer data only to countries that the Government of India has not restricted. To get a copy of the safeguards we rely on, such as the standard contractual clauses (with commercial terms removed), write to privacy@optiploy.com.

5. How long we keep data

We keep data only as long as needed for the purpose, to meet legal, tax and accounting duties, and to handle disputes. Typical periods: account and profile data while your account is active and for 3 years after it closes, to handle claims; verification records for 1 year after your account closes; contracts, timesheets and invoices for 8 years, as Indian company and tax law requires; marketing preferences until you withdraw consent; and system logs for at least 1 year, as the DPDP Rules require. We then delete or anonymise it. [Counsel to confirm retention periods.]

6. Security

We protect data with encryption in transit and at rest, multi-factor and single sign-on options, access controls limited to staff who need access, and monitoring. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

7. Your rights

Where the law applies to you, you can ask us to:

Access the personal data we hold about you and get a copy.
Correct inaccurate or incomplete data.
Delete your data, subject to legal duties to keep some of it.
Restrict or object to certain processing, and ask for portability of data you gave us (GDPR and UK GDPR).
Withdraw consent at any time.
Nominate someone to exercise your rights if you die or cannot (DPDP).
Opt out of sale or sharing and limit use of sensitive data (California). We do not sell or share personal data for cross-context behavioural advertising, and we do not discriminate against you for using your rights.

To use a right, write to privacy@optiploy.com. We may need to verify who you are, and we will reply within the time the law sets: generally one month under GDPR and UK GDPR, 45 days under CCPA/CPRA, and the period set by the DPDP Rules. You can also complain to your data protection authority: the Data Protection Board of India, your EU supervisory authority, the UK ICO, or the California Privacy Protection Agency.

8. Cookies and similar technologies

We use necessary cookies to make the site work. We use preference, statistics and marketing cookies only if you accept them in the cookie banner, and you can change your choice any time through Cookie settings in the footer. The cookies we use, their purpose and how long they last are listed below.

Cookies we use
Type	Purpose	Examples	Lifetime
Necessary	Keep the site working and remember your cookie choice	[cookie names]	[session / duration]
Preferences	Remember settings such as language	[cookie names]	[duration]
Statistics	Understand how the site is used, only if you accept	[analytics provider and cookie names]	[duration]
Marketing	Measure campaigns, only if you accept	[provider and cookie names]	[duration]

[[legal-actions]]

9. Children

Optiploy is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

10. Automated matching

We rank assignments and Talent using profile data such as products, versions, seniority, rate and availability. This is a tool to help people decide. It does not by itself make a legal decision about you. You can ask us for a human review of a matching outcome.

11. Third-party sites

Our site may link to other sites. We are not responsible for their privacy practices.

12. Changes to this notice

We will post any update here with a new effective date and tell you about material changes.

13. Contact and grievances

Data controller: Dxred Technologies Private Limited, 2401, Tridev Tower-1, Bhakti Marg, Near Vardhman Nagar, Mulund West, Mumbai, Maharashtra, India – 400080. Privacy contact: privacy@optiploy.com. Grievance Officer (India): Nirav Dedhiya, grievance@optiploy.com. Data Protection Officer or EU/UK representative: none appointed.