New: candidate self-scheduling with Google and Microsoft calendars →
Skip to content
OneATS

Data Processing Agreement

Last updated: 30 October 2026

This Data Processing Agreement (“DPA”) forms part of the OneATS Terms of Service between OneATS Technologies Private Limited (“OneATS”) and the Customer. It applies where OneATS processes personal data on the Customer’s behalf.

1. Roles

  • For personal data of candidates, new hires and the Customer’s users entered into OneATS (“Customer Personal Data”), the Customer is the data fiduciary (controller) and OneATS is the data processor, within the meaning of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and, where applicable, UK GDPR and EU GDPR.
  • OneATS acts as an independent data fiduciary for account authentication and billing contacts necessary to administer the account.

2. Scope and Processing Details

  • Subject matter and purpose: Providing the OneATS recruitment software and employee onboarding services—publishing jobs, receiving and managing applications, parsing resumes, scheduling interviews, candidate scoring, and onboarding.
  • Data subjects: Job applicants, passive talent pool candidates, newly hired employees, and Customer users/interviewers.
  • Categories of personal data: Contact details, educational background, work experience, resumes, screening questions, compensation details, interview feedback notes and scorecards, offer letters, and statutory onboarding verification documents (PAN, Aadhaar/ID proof, certificates).
  • Duration: The active term of the Customer subscription plus the deletion retention window.

3. Documented Instructions

OneATS processes Customer Personal Data solely in accordance with documented instructions from the Customer, including configuration choices made within the service, this DPA, and statutory requirements under applicable law.

4. Confidentiality

OneATS ensures that personnel authorized to access Customer Personal Data are subject to strict contractual confidentiality obligations and access records only on a need-to-know basis.

5. Technical and Organizational Security Measures

OneATS implements enterprise-grade technical safeguards, including:

  • Encryption in transit using TLS 1.3 with HTTP Strict Transport Security (HSTS);
  • Symmetric encryption at rest (AES-256-GCM) with automated key rotation for credentials and sensitive attachments;
  • Fail-closed multi-tenant scoping enforcing absolute data isolation between customer workspaces;
  • Role-based access controls (RBAC) restricting candidate data visibility to assigned recruiters and admins;
  • Audit logging of sensitive events, including candidate data exports and administrative impersonation;
  • Daily encrypted automated backups with disaster recovery failover.

6. Sub-processors

The Customer provides general authorization for OneATS to engage the infrastructure and sub-processing providers listed on our Sub-processors page. OneATS provides at least 30 days’ advance written notice of new sub-processors, maintaining full responsibility for sub-processor performance.

7. Incident Response and Breach Notification

In the event of a confirmed personal data breach impacting Customer Personal Data, OneATS notifies the affected Customer without undue delay and within 48 hours of confirmation, providing necessary diagnostic details for statutory notification requirements.

8. Candidate Rights and Self-Serve Erasure

OneATS provides self-service capabilities to support Data Principal rights. Candidates receive a secure, one-click deletion link in every application receipt email, enabling instant erasure of CVs and personal data from customer databases.

9. Data Retention and Return

Upon subscription termination, Customers may export their data within 30 days. Following this export window, OneATS irreversibly purges Customer Personal Data from active production databases within 90 days.

10. Data Location and Cross-Border Transfers

Customer data is hosted and stored in India (AWS Mumbai region, ap-south-1). Any international data transfers for global integrations comply with standard contractual clauses (SCCs) and statutory data protection transfer mechanisms.

11. Contact

For questions regarding this agreement or data protection inquiries, contact our Privacy and Security Team at [email protected].