Privacy Policy

Information you provide directly: When you submit our contact form or footer enquiry form, we collect your name, work email address, company name, job role, company size, sector, timeline, country, and any message you choose to include.

Information from job applications: When you apply for a role via our careers page, we collect your name, email, mobile number, gender, date of birth, current and expected compensation, joining availability, and your uploaded resume/CV. Gender and date of birth are collected solely for recruitment administration purposes and are not used for any other purpose.

Information collected automatically: When you visit our website and you have accepted analytics cookies, we collect standard log data including your IP address (immediately hashed — the raw IP is never stored), browser type, operating system, referring URL, and pages visited. This data is collected via our own server-side analytics system.

Newsletter subscriptions: If you subscribe to our newsletter, we collect your email address and, optionally, your name. Subscription requires explicit consent and email confirmation (double opt-in).

Cookies: We use cookies to improve your experience and analyse site traffic only with your consent. See Section 7 for full details.

We use the information we collect for the following purposes:

• To respond to your enquiries and schedule discovery calls
• To send you information relevant to your enquiry (not unsolicited marketing)
• To process and evaluate job applications
• To improve our website content and user experience (only with consent)
• To comply with legal obligations
• To send our newsletter if you have explicitly subscribed and confirmed via double opt-in (you may unsubscribe at any time)

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

For visitors in the European Economic Area and United Kingdom, we process your personal data under the following legal bases:

• Legitimate interests: Responding to business enquiries and evaluating job applications
• Consent: Newsletter subscriptions and non-essential analytics cookies (you may withdraw consent at any time)
• Contract: Processing data necessary to deliver our consulting services
• Legal obligation: Retaining records as required by applicable law

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Contact enquiries: Up to 2 years from last contact
• Job applications: Up to 12 months from submission date, unless you become a client or employee
• Newsletter subscribers: Until you unsubscribe or request deletion
• Analytics data: Page view data is automatically deleted after 12 months. Visitor identifiers are SHA-256 hashed and are not reversible to a real IP address.

We share your data with the following named third-party service providers, solely to operate our website and business:

• Email delivery: Resend (resend.com) — for transactional and newsletter emails
• File storage: Resumes, application files and assessment proctoring photographs are stored on our own server infrastructure (see Hosting below). They are not uploaded to any third-party storage provider, and are accessible only to authenticated Kresto staff.
• Geo-location lookup: ip-api.com — used server-side to determine the approximate country of a visitor from their IP address for the purpose of displaying region-relevant content. The IP address is sent to ip-api.com over HTTPS and is not stored by us. ip-api.com's privacy policy is available at ip-api.com/docs/legal.
• Hosting: Contabo (contabo.com) — our website hosting and infrastructure provider

All third-party providers are required to handle your data in accordance with applicable privacy laws. We do not transfer your data outside of your region without appropriate safeguards.

If you are invited to complete a first-round assessment as part of a job application, that assessment is proctored using your device camera. This section explains exactly what that involves. You are told the same before you begin, and you may decline.

What we capture

• A single still photograph from your camera approximately every three minutes, only while the assessment page is open.
• We do not record video, we do not record audio, and we do not capture or monitor your screen, your keystrokes, or any other application on your device.
• Capture begins only after you have agreed on screen, and stops the moment you submit the assessment or close the page. A visible indicator is shown throughout.
• We also record how many times the assessment tab loses focus. This is recorded for context only and is never used on its own to reject an application.

Why we do this, and our legal basis

The sole purpose is to confirm that the person completing the assessment is the applicant. Our legal basis is your explicit consent, given on screen before the assessment starts. You may decline, in which case the assessment is not started and no photograph is taken; please reply to the email that invited you and we will discuss an alternative.

What we do not do

• We do not use facial recognition, biometric matching, emotion detection, or any automated analysis of these photographs.
• No hiring decision is made automatically. Photographs are reviewed by a person, only where there is a specific reason to, and always alongside your actual answers.
• We do not share these photographs with any third party, and they are never used for training, marketing or any purpose other than the one stated above.

Access, storage and retention

• Photographs are stored on our own server infrastructure, behind authenticated administrator access. They are not reachable by a public link.
• They are deleted automatically 30 days after a decision is made on your application.
• You may withdraw your consent or ask us to delete the photographs at any time, including before that period ends, by contacting us using the details in the final section. Withdrawing consent does not affect the assessment you have already submitted.

Depending on your location, you have the following rights regarding your personal data:

GDPR / UK GDPR rights: Access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with your supervisory authority (ICO in the UK; your national DPA in the EU).

CCPA (California) rights: The right to know what personal information is collected, the right to delete personal information, the right to opt-out of the sale of personal information (we do not sell data), and the right to non-discrimination.

India (DPDP Act 2023) rights: The right to access information about your personal data, the right to correction and erasure, the right to grievance redressal, and the right to nominate a person to exercise rights on your behalf. To raise a grievance, contact our Grievance Officer (see Section 12).

Australia (Privacy Act 1988) rights: Access to and correction of your personal information held by us. You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Canada (PIPEDA / CASL) rights: Access to your personal information, the right to challenge its accuracy, and the right to withdraw consent for commercial electronic messages at any time by using the unsubscribe link in any email we send.

To exercise any of these rights, email us at privacy@krestolabs.com or use our contact page. We will respond within one calendar month.

We use the following types of cookies and local storage:

• Strictly necessary: Required for the website to function (session management, security). These are always active and do not require consent.
• Analytics (opt-in): Used to understand how visitors interact with our website. We use our own server-side analytics system. Analytics data is only collected after you have explicitly accepted cookies. Visitor identifiers are hashed and no raw IP addresses are stored.

When you visit our website, a cookie consent banner appears. You may accept all cookies, accept only necessary cookies, or reject non-essential cookies. Your preference is stored in your browser's local storage along with a timestamp and can be changed at any time by clearing your browser data.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), hashed visitor identifiers, access controls, and secure cloud storage.

No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

Data breach notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (as required by GDPR Article 33). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Article 34). For Indian data principals, we will notify the Data Protection Board of India as required under the DPDP Act 2023.

Kresto Consulting actively serves clients and candidates in India. We process personal data of Indian data principals in accordance with the Digital Personal Data Protection Act 2023 (DPDP Act).

Purpose limitation: We collect and process personal data only for the specific, clear, and lawful purposes described in this policy.

Data minimisation: We collect only the personal data necessary for the stated purpose.

Grievance Officer: For any grievance related to the processing of your personal data under the DPDP Act, please contact our designated Grievance Officer:

Kumash Shah
Grievance Officer, Kresto Consulting
Email: privacy@krestolabs.com
Response time: Within 30 days of receipt of grievance

Kresto Consulting complies with Canada's Anti-Spam Legislation (CASL). We will only send commercial electronic messages (CEMs) to Canadian recipients where we have obtained express or implied consent as defined under CASL.

Express consent: When you subscribe to our newsletter, you provide express consent by completing a double opt-in process — submitting your email and then confirming via a link sent to that address.

Withdrawal of consent: You may withdraw consent at any time by clicking the unsubscribe link in any email we send, or by emailing privacy@krestolabs.com. We will process your withdrawal within 10 business days.

Identification: All commercial emails from Kresto Consulting clearly identify us as the sender and include a functional unsubscribe mechanism.

Our website and services are directed exclusively at business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately at privacy@krestolabs.com.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically. For material changes, we will make reasonable efforts to notify you.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to submit a data erasure request, please contact us:

Kresto Consulting
Email: privacy@krestolabs.com
Website: www.krestolabs.com
Contact form: krestolabs.com/contact

We will acknowledge your request within 5 business days and respond fully within one calendar month. For complex requests, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.