Your data

Privacy policy

ReRoot is operated by ReRoot Global Private Limited, a company based in India. We are committed to protecting the privacy and security of the personal data entrusted to us through the ReRoot website, apps and services.

Last updated 11 September 2026

01

Who we are

ReRoot Global Private Limited is an India-based company and the controller responsible for personal data processed through ReRoot.

Privacy enquiries may be sent to privacy@onestep.global. General enquiries may be sent to hello@onestep.global.

02

Personal data we collect

  • Identity and contact data, including name, email address, telephone number, location, institution and employer.
  • Candidate data, including education, qualifications, skills, CV or resume, employment history and application information.
  • Opportunity, application and interview data created through use of the platform.
  • Communications, preferences and support enquiries.
  • Technical and usage data, including IP address, browser, device, time zone, operating system and product activity.
03

How we collect data

  • Directly from you when you register, complete a profile, apply for a role, contact us or use ReRoot tools.
  • From partner universities, employers and service providers where they are authorised to provide it.
  • Automatically through necessary storage, cookies and similar technologies.
  • From public or professional sources where lawful, including LinkedIn and institutional directories.
04

How and why we use data

  • Provide accounts, candidate profiles, opportunity matching, applications and interview services.
  • Verify education and other candidate information with authorised partners.
  • Support university employability and graduate-outcome services.
  • Enable employers to publish roles and manage recruitment.
  • Operate, secure, analyse and improve ReRoot.
  • Send service messages and, where permitted, relevant opportunities and product communications.
  • Meet contractual, legal, regulatory, accounting and safeguarding obligations.
05

Legal bases

Depending on the activity and applicable law, we rely on performance of a contract, steps taken before entering a contract, legitimate interests, consent and compliance with legal obligations. Consent may be withdrawn at any time without affecting earlier lawful processing.

06

How we share data

We do not sell personal data.

  • Universities and employers participating in the ReRoot service, where needed for the relevant candidate journey.
  • Our affiliated entities and authorised delivery partners.
  • Hosting, authentication, email, analytics, support and other technology providers.
  • Professional advisers, insurers, authorities and regulators where required.
  • A successor organisation in connection with a merger, acquisition or business transfer.
07

International transfers

ReRoot Global Private Limited is based in India and works with universities, employers and service providers in other markets. Data may be transferred to, stored in or accessed from another country. We use appropriate contractual and legal safeguards for these transfers.

08

Retention and security

We keep personal data only for as long as necessary for the purposes for which it was collected and for applicable legal, accounting, regulatory and reporting requirements. When it is no longer required, it is deleted or anonymised.

We use appropriate technical and organisational safeguards against unauthorised access, accidental loss, alteration, disclosure and destruction. No internet transmission method can be guaranteed as completely secure.

09

Your rights

We may need to verify your identity before acting on a request.

  • Request access to and correction of your personal data.
  • Request deletion, restriction or objection where applicable.
  • Request data portability where applicable.
  • Withdraw consent and change marketing preferences.
  • Nominate another person to exercise rights in the event of death or incapacity where provided by law.
  • Make a complaint to the relevant data protection authority.
10

Children and third-party links

ReRoot is intended primarily for graduates, higher-education institutions and professional audiences. Where data relating to minors is processed, we follow applicable law and obtain parental or guardian consent where required.

Our services may link to third-party sites and services. Their privacy practices are governed by their own policies.

11

Changes and contact

We may update this policy as ReRoot develops or legal requirements change. Significant changes will be communicated appropriately.

To exercise your rights or ask a privacy question, contact ReRoot Global Private Limited at privacy@onestep.global. General enquiries may be sent to hello@onestep.global or made by telephone on +91 85889 99799.