Privacy Notice — For Candidates

Utkrusht Skill Assessment Platform

Last Updated: May 5, 2026 Effective Date: May 5, 2026 Version: 1.0.1 — language tightened: enumerated 5 cross-org purposes, removed AI-training language, removed microphone references (not currently captured)

Who this is for: You're reading this because you've been invited to take an assessment on Utkrusht. This notice explains, in plain English, what data we collect about you, why, who sees it, and what you can do about it. If you're a recruiter or organization using the platform, see our B2B Privacy Policy instead.

---

TL;DR

1. We record you during proctored assessments. Webcam video, screen, audio, and AI-detected behavioral signals (face visible, tab switching, etc.). This is the most invasive thing we do — it's covered in detail below.
2. AI scores and ranks your responses. Humans make the final hiring call, not the AI. You can ask for a human re-review.
3. The recruiter who invited you sees your results. They are an independent controller of the data they receive — for their privacy practices, contact them.
4. We use anonymized assessment data to improve our AI and benchmarks. You can opt out (see Section 7).
5. You have rights — access, correction, deletion, objection, portability. Email naman@utkrusht.ai to use them. EU/EEA candidates can also use our representative Prighter at https://app.prighter.com/portal/18473340039.

---

1. WHO HANDLES YOUR DATA

When you take an Utkrusht assessment, two organizations handle your personal data:

This notice covers only what Utkrusht does. For questions about why you were assessed, how your results will be used in their hiring decision, or how long they'll keep your data after they receive it, contact the recruiting organization directly.

Utkrusht contact details

Utkrusht Learning Services Private Limited (CIN: U85490GJ2024PTC157512)

• India: A-18 Shreenathji Kurpa Society, Subhanpura, Vadodara - 390023 · +91-9023239479
• USA: 572 Amboy Dr, San Jose, CA 95136 · +1-919-793-6081
• Email: naman@utkrusht.ai
• EU/EEA representative (GDPR Art. 27): Prighter Group — https://app.prighter.com/portal/18473340039

---

2. WHAT WE COLLECT AND WHY

2.1 Identity and contact information

Your name, email, phone number, and a user ID. This comes from the recruiter who invited you, or from you when you sign up. We use it to give you access to the assessment and to contact you about it.

2.2 Professional information

Your resume / CV, LinkedIn profile, GitHub profile (if you provide it), work history, education, and stated skills. We extract structured fields from your resume so the recruiter and our AI can compare against the role requirements.

2.3 Your assessment responses

Text answers, audio recordings of spoken answers, video recordings of video answers, and code submissions. These are the substance of what's evaluated.

2.4 Proctoring data — the important one

If the recruiter has enabled proctoring for the assessment, before recording starts you'll be shown a separate consent screen explaining exactly what will be captured. You can decline — but if you decline, you typically can't take the proctored assessment (the recruiter set it that way).

When proctoring is on, we capture:

We do not currently capture microphone audio or transcripts of audio during proctoring. If we add audio-based proctoring in a future release, we will obtain separate explicit consent before any recording begins, and we will update this notice.

Important: AI generates the flags. Recruiters review the flags. The AI does not disqualify you on its own.

2.5 Derived data the AI generates about you

Quality scores per response, competency ratings (1-5 with proficiency labels from Novice to Expert), SWOT-style analysis, code analysis, and a ranking position relative to other candidates for the role. See Section 4 for how AI is used.

2.6 Technical and source data

IP address, browser, device info, session timestamps, and a SHA-256 source hashcode that identifies which referral link you came from (e.g. a specific recruiter campaign). The hashcode is pseudonymous — it doesn't contain personal info on its own.

2.7 Communications

Emails, SMS, or WhatsApp messages we send you about your assessment, plus your replies to support.

---

3. THE LEGAL BASIS WE RELY ON

For our processor-role activities (delivery, scoring, reporting), the recruiter is the controller and determines the legal basis. Ask them.

---

4. HOW WE USE AI

We use AI throughout the assessment:

• Response evaluation: Each answer is scored for quality and relevance.
• Competency ratings: We generate a 1-5 rating per skill area with a proficiency label.
• Code analysis: Code submissions are evaluated for correctness, efficiency, and style.
• SWOT analysis: A short narrative of strengths/weaknesses/opportunities/threats.
• Ranking: We position you against other candidates for the same role, including anonymized benchmark data from candidates at other organizations.
• Proctoring analysis: AI watches your video and screen and raises flags for human review. (Microphone audio is not currently captured — see Section 2.4.)

You will not be hired or rejected purely by an algorithm. Human recruiters make the final call. You have the right to:

• Ask for a human review of any AI-generated assessment of you
• Express your point of view and contest the AI output
• Get meaningful information about how the AI reached its conclusion

Email naman@utkrusht.ai to invoke any of these.

---

5. WHO WE SHARE YOUR DATA WITH

5.1 The recruiting organization

They see your identity info, responses, scores, AI-generated analysis, proctoring flags (and on request, the underlying recordings), and your ranking. Once they have the data, they're an independent controller — meaning they decide how long to keep it, who else inside their company sees it, and how it factors into hiring. Contact them for those details.

5.2 Our sub-processors

We use third parties to actually run the platform. They're contractually bound to only process your data on our instructions, with appropriate security in place.

5.3 Other situations

We may also share data when legally required (court orders, regulatory requests), to protect our rights or the safety of others, or in connection with a merger or acquisition (with notice).

We do not sell your personal data.

---

6. WHERE YOUR DATA GOES (INTERNATIONAL TRANSFERS)

Your data is processed in India, Singapore, the USA, and Ireland. For transfers outside India to countries without an adequacy decision, we use EU-approved Standard Contractual Clauses plus supplementary safeguards: TLS 1.3 in transit, AES-256 at rest, pseudonymization before AI processing, and strict access controls.

Transfer Impact Assessments are available on request.

---

7. CROSS-ORGANIZATION DATA USE & OPT-OUT

By default, we use de-identified assessment patterns from candidates across all organizations for the following five purposes:

1. Aggregated benchmarks — computing how candidates score relative to industry / role / experience cohorts.
2. Question / task calibration — adjusting question difficulty and validity from response patterns over time.
3. Cross-organization fraud detection — identifying patterns where the same candidate appears across multiple organizations with suspicious signals (impersonation, coordinated cheating).
4. Platform analytics — aggregated platform-usage statistics for product development, marketing, and leadership reporting.
5. Recruiter "industry comparison" features — surfacing benchmark metrics in the recruiter dashboard.

What's used: de-identified response patterns and aggregated metrics. What's never used or shared cross-organization: your name, contact info, the actual content of your responses, or your proctoring recordings.

We do not currently train machine learning models on candidate data. If that ever changes, we will update this notice and notify candidates with active assessments.

To opt out: 1. Email naman@utkrusht.ai with the subject line Cross-Org Opt-Out 2. Include the name and email you used for the assessment so we can verify 3. We'll process the opt-out within 30 days

After opt-out, your future assessments will be excluded from all five cross-organization purposes listed above. Data that's already been de-identified cannot be removed (it's no longer linked to you). Your assessment results for the recruiter who invited you are unaffected.

---

8. HOW LONG WE KEEP YOUR DATA

When you ask us to delete your data, we remove it from active systems within 30 days and from backups within 90 days. We can't pull back data we've already shared with the recruiter — contact them for that. We also have to keep some data for legal reasons (e.g. anti-fraud records).

---

9. YOUR RIGHTS

Depending on where you are, you have some or all of the following rights:

We respond within 30 days of a verified request. Complex requests can take up to 90 days, in which case we'll tell you within the first 30 days.

To verify it's really you, we may ask you to confirm from the email address registered with your assessment, or for stricter requests, a government ID.

9.1 If you're in the EU / EEA

GDPR applies. You have all the rights listed above. You can also contact our EU representative, Prighter Group, at https://app.prighter.com/portal/18473340039 — they can route privacy requests to us. You can lodge a complaint with your national Data Protection Authority.

9.2 If you're in India

The Digital Personal Data Protection Act, 2023 applies. You have the right to access, correction, erasure, grievance redressal, and to nominate someone to act on your behalf. Email naman@utkrusht.ai. Once the Data Protection Board of India is operational, you can also escalate complaints there.

9.3 If you're in California (USA)

Under the CCPA / CPRA, you have the right to know what personal information we've collected about you, to delete it, to correct inaccurate data, and to opt out of "sharing" of personal information for cross-context behavioral advertising (we don't do this). You also have the right to limit the use of "sensitive personal information" — proctoring biometric data falls in this category, and the proctoring consent screen is your control point. We do not sell your personal information. To exercise these rights, email naman@utkrusht.ai.

9.4 If the recruiter invited you

You can also send rights requests to the recruiter — they're obligated to forward them to us, and we'll help them respond on time. You can always come straight to us at naman@utkrusht.ai.

---

10. CHILDREN AND MINORS

The Platform is not intended for use by minors. We apply the strictest of the following thresholds based on where you are:

If you're under the threshold for your region, you should not take an assessment without verifiable consent from a parent or guardian. If we discover we've collected data from a minor without proper consent, we will delete it promptly and notify the recruiting organization. To report this, email naman@utkrusht.ai.

---

11. SECURITY

We protect your data with encryption in transit (TLS 1.3) and at rest (AES-256), strict access controls (least privilege), audit logs, multi-factor authentication for staff, vulnerability scanning, and documented incident response procedures.

If a data breach affects your data, we will notify you without undue delay where the law requires us to (in particular, when there's a high risk to your rights), and we will notify supervisory authorities within 72 hours where applicable.

---

12. COOKIES

We only use essential cookies needed to keep you logged in and protect against cross-site attacks. We don't use advertising cookies, third-party tracking pixels, or social media tracking. Internal analytics are aggregated and not linked to individual candidates.

---

13. CHANGES TO THIS NOTICE

We may update this notice. The "Last Updated" date at the top tells you when. For material changes — new categories of data, new purposes, new recipients, changes to retention or your rights — we'll notify you by email at least 30 days before the change takes effect, where we have your email.

If you don't agree with a change, contact us to exercise your deletion rights.

---

14. CONTACT US

If you're not happy with our response, you can complain to your national data protection authority.

---

Utkrusht Learning Services Private Limited Document Version: 1.0