Last updated: 4 August 2026
[ENTITY NAME — e.g. "GxPOrbis Consultancy"], registered at [REGISTERED ADDRESS / JURISDICTION] ("GxPOrbis", "we", "us") operates gxporbis.com and the associated candidate and employer services (the "Service"). This policy explains what personal data we collect, why, how we use and share it, and the rights you have — whether you are located in India, the United Kingdom, the European Union, or elsewhere.
Note to reader: bracketed text like [ENTITY NAME] is a placeholder to be filled in with your actual registered business details before this page is published.
GxPOrbis connects GxP pharmaceutical and healthcare professionals, primarily based in India, with employers across the UK and Europe, and hosts related recruitment events. For the purposes of UK/EU data protection law we act as the data controller of the personal data described below. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as the Data Fiduciary.
| Purpose | UK/EU GDPR basis | DPDP Act basis |
|---|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) | Consent (Sec. 6) |
| Sharing your registration & CV with an employer whose event you register for | Consent, given at the point of registration (Art. 6(1)(a)) | Consent, given at the point of registration (Sec. 6) |
| Site security, fraud prevention, keeping the service running | Legitimate interests (Art. 6(1)(f)) | Legitimate use as permitted under Sec. 7 |
| Communicating with you about your registrations or account | Performance of a contract | Consent |
We share candidate registration details (name, contact information, and CV) only with the specific employer hosting the event you register for, and only after you explicitly submit that registration. We do not sell personal data to third parties, and we do not share your data with employers you have not chosen to register with.
We also use a small number of service providers ("processors") to run the platform, currently including our database/authentication provider (Supabase) and our hosting provider (Vercel). These providers process data on our instructions and are bound by their own data protection obligations.
Our infrastructure is hosted in the European Union. If you are located in India, your data will be transferred to and processed in the EU; if you are located in the UK or EU, your data may be accessed by our India-based team in the ordinary course of providing the Service. We take reasonable technical and contractual measures to protect data in transit and at rest. Where required by UK/EU law, transfers rely on adequacy decisions or standard contractual clauses with our processors. Under the DPDP Act, cross-border transfer restrictions apply only to countries specifically restricted by the Indian government from time to time; we monitor this and will update our practices if restrictions are introduced.
We retain account and CV data for as long as your account remains active, and for a reasonable period afterward (currently up to 24 months of inactivity) in case you return, or as needed to resolve disputes or comply with legal obligations. You can request earlier deletion at any time — see Section 7.
If you are in the UK or EU (GDPR): you have the right to access, correct, erase, or restrict the processing of your data; to receive a copy of your data in a portable format; to object to processing based on legitimate interests; and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to complain to your national data protection authority (in the UK, the Information Commissioner's Office).
If you are in India (DPDP Act): as a Data Principal you have the right to obtain a summary of your personal data and processing activities, request correction or erasure of your data, withdraw consent at any time, nominate another individual to exercise your rights in the event of death or incapacity, and file a grievance with us (and, if unresolved, with the Data Protection Board of India).
To exercise any of these rights, contact us using the details in Section 10.
The Service is intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18.
We use industry-standard measures to protect your data, including encrypted connections, access controls that restrict which employer or staff member can see which records, and hashed password storage. No system is completely secure, and we encourage you to use a strong, unique password.
For any questions, requests, or complaints about your personal data — including under the DPDP Act's grievance redressal requirements — contact:
[GRIEVANCE OFFICER / DPO NAME — to be appointed]
Email: gxporbis@gmail.com
Note: the DPDP Act requires Significant Data Fiduciaries to appoint a formal Data Protection Officer based in India. Please confirm whether this applies to your current scale of operations and update this section accordingly.
We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date above, and, where required by law, we will seek fresh consent.