Digital Personal Data Protection Act, 2023
DPDP Notice
Last updated 23 August 2026
This is the statutory notice required of a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
It says the same things as the Privacy Policy, in the Act’s own terms. Where you think the two differ, tell us — that is a fault worth fixing, not a drafting nuance.
1.Data Fiduciary
Data Fiduciary: OutsideIn Private Limited
CIN: U78100TS2026PTC218651
Registered office: No. 9, WeWork, Raheja Mindspace, Madhapur, Hyderabad 500081, Telangana, India
Product: Caddie — caddiehq.in and the Caddie browser extension
Contact for data protection matters: hello@caddiehq.in
OutsideIn Private Limited determines the purpose and means of processing the personal data described below, and is therefore the Data Fiduciary. You, whose personal data it is, are the Data Principal.
2.What this notice is
Section 5 of the DPDP Act requires that, before or at the time consent is sought, you are told what personal data will be processed, the purpose it will be processed for, how to exercise your rights, and how to complain. This page is that notice. It is written to be read, because a notice that cannot be understood is not notice.
3.Personal data and purposes
| Personal data | Purpose |
|---|---|
| Name, email address, authentication identifiers | Creating and securing your account |
| CV or résumé and the employment history parsed from it | Building your candidate profile and measuring roles against it |
| Saved application details — contact details, notice period, right-to-work details, pay history | Filling application forms you choose to prepare |
| Job preferences — seniority, area of work, location, pay, non-negotiables | Finding and ranking jobs |
| Application records | Keeping your history of what you prepared and sent |
| Subscription and payment-mandate records — the mandate reference, billing status, renewal dates and invoices | Taking the quarterly payment, sending the notice before each renewal charge, and issuing GST invoices |
| Technical and log data | Security, fault diagnosis, prevention of misuse |
We collect no personal data beyond what these purposes need, and we do not repurpose it. If we want it for something new, we come back and ask.
Card details are never held by us. The quarterly subscription runs on a payment mandate registered with our payment provider, who is the processor for it. We hold the reference to that mandate and the record of what was charged and when — enough to notify you before each renewal, to invoice you, and to stop the mandate when you cancel. Cancelling ends the mandate and the charges with it.
4.Consent
Processing is carried out on your consent, which under section 6 of the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose.
Consent for the search desk — making your profile visible to OutsideIn’s recruiters or to TigerHire — is requested separately from consent to use Caddie. It is not a condition of using the product, and bundling it with account creation would make the consent conditional and therefore invalid.
5.Withdrawing consent
You may withdraw consent at any time, and the Act requires that doing so be as easy as giving it. Withdraw from your Profile settings, or by writing to hello@caddiehq.in.
On withdrawal we stop the processing that consent supported and, unless law requires retention, erase the personal data — and we require our processors to do the same. Withdrawal does not make prior lawful processing unlawful.
6.Disclosure, including to group entities
We do not sell personal data and do not disclose it for anyone else’s marketing. Disclosure happens only as set out in the Privacy Policy.
On group entities, we want to be exact. OutsideIn operates Caddie, TigerHire, HolaHumans and eSigned / SignTiger, and runs an executive search practice. Where those are separate legal entities, the DPDP Act treats them as distinct persons rather than as one Data Fiduciary. Corporate relationship is not, by itself, a lawful basis for moving your data between them.
Accordingly:
- Group entities providing shared infrastructure act as Data Processors under contract, on our instructions, and may not process your data for their own purposes.
- Disclosure to the search desk is made only on your separate, opt-in consent, which is off by default and withdrawable.
- No group entity may make an onward disclosure for its own purposes.
7.Data Processors
We engage Data Processors only under contract, as section 8(2) requires. They are listed in the Privacy Policy. We remain accountable to you for what our processors do — engaging one does not transfer our obligations to you.
8.Rights of the Data Principal
| Right | What it means |
|---|---|
| Access | A summary of the personal data we hold about you, the processing activities, and the identities of those we have shared it with |
| Correction and completion | Correction of inaccurate or misleading data, and completion of incomplete data |
| Erasure | Erasure where the purpose is served or you withdraw consent, unless retention is required by law |
| Grievance redressal | A readily available means of raising a grievance with us, before approaching the Board |
| Nomination | Nominating another individual to exercise your rights in the event of death or incapacity |
| Withdraw consent | At any time, as easily as it was given |
The Act also places duties on Data Principals — not to impersonate another person, not to suppress material information, and not to file a false or frivolous grievance.
9.How to exercise a right
- From the product. Access, correction and account deletion are available in your Profile. Deletion asks you to type a confirmation phrase, then permanently removes your data, your CV files and your sign-in.
- By email. Write to hello@caddiehq.in from the address on your account, saying which right you are exercising. Account deletion works this way too, and we confirm when it is done.
We may need to verify identity before acting, so that one person cannot reach another’s data by asking.
10.Grievance redressal
Grievance Officer: Radhika Itha
Email: hello@caddiehq.in
Post: OutsideIn Private Limited, No. 9, WeWork, Raheja Mindspace, Madhapur, Hyderabad 500081, Telangana, India
Response: within 90 days of receipt, as the DPDP Rules, 2025 require. In practice, far sooner.
11.The Data Protection Board
If our response does not satisfy you, or we do not respond in time, you may complain to the Data Protection Board of India, established under the Act. Raising a grievance with us first does not waive that right; it is simply the faster route to a fix.
12.Children and persons with disability
Caddie is not offered to anyone under 18. We do not knowingly process a child’s personal data, and we do no tracking, behavioural monitoring or targeted advertising directed at children — all of which section 9 prohibits.
Where a lawful guardian acts for a person with a disability, we process on the guardian’s verifiable consent.
13.Breach notification
In the event of a personal data breach we will notify each affected Data Principal and the Data Protection Board, in the form and within the time the DPDP Rules require, describing what happened, its likely consequences, what we have done, and what you can do.
14.Erasure and retention
We erase personal data when the purpose it was collected for is no longer being served and retention is not required by law — and we require our processors to erase it too. Retention periods are in the Privacy Policy.
15.Compliance status
The DPDP Rules, 2025 were notified on 13 November 2025 and commence in phases, with the substantive obligations — consent notices, Data Principal rights, breach reporting — taking effect on 13 May 2027.
We are not waiting for the deadline. The commitments on this page are how we operate now. Where the Rules later prescribe a specific form or timeline that differs from what is written here, the Rules govern and we will update this page.
This notice is offered in good faith and in plain language. It is not legal advice, and it does not limit any right you have under the Act.