Cookie and Consent Management Policy
| Platform Name | Gulf Return |
| Policy Owner | Data Protection Officer Gulf Return |
| Applicable Laws | Digital Personal Data Protection Act, 2023, Digital Personal Data Protection Rules, 2025, Information Technology Act, 2000, IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 |
PART A: COOKIE POLICY
1. INTRODUCTION
1.1 Purpose of This Policy
This Cookie and Consent Management Policy ("Policy") explains how Gulf Return managed by Sheruh ("Company", "we", "us", or "our") uses cookies, web beacons, pixels, local storage, and similar tracking technologies (collectively referred to as "Cookies") on our website, mobile applications, and digital platforms. This Policy also sets out our framework for obtaining, managing, recording, and honouring User consent in compliance with applicable Indian data protection laws. As part of our vision, we are committed to transparency regarding the technologies we use to collect information about you and your activities. This Policy should be read together with our Privacy and Data Protection Policy www.gulfreturn, which provides comprehensive information about how we process your personal data. Our cookie practices and data processing methods may vary depending on your location, device type, and the data protection laws applicable to you. We adapt our practices to comply with regional legal requirements while maintaining service functionality.
1.2 Legal Framework
This Policy has been developed in accordance with the requirements of:
- The Digital Personal Data Protection Act, 2023 ("DPDP Act")
- The Digital Personal Data Protection Rules, 2025 ("DPDP Rules")
- The Information Technology Act, 2000 ("IT Act")
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
- And other guidelines and directions issued by the Data Protection Board of India and other relevant authorities.
1.3 Scope
This Policy applies to all users who access our website, mobile applications, registered members including job seekers, employers, and recruiters, visitors who browse without creating an account, and any other digital touchpoints where cookies or similar technologies are deployed. For the purposes of this Policy, "Platform" shall have the same meaning as assigned under the User Agreement, Terms of Service, other associated Policies including our website, mobile application, and other digital touchpoints.
PART B: CONSENT MANAGEMENT POLICY
6. CONSENT FRAMEWORK UNDER DPDP ACT, 2023
6.1 Our Approach to Consent
As a Data Fiduciary under the Digital Personal Data Protection Act, 2023, we are committed to implementing a robust consent management framework that respects your autonomy and control over your personal data. Our approach is guided by the following principles:
- Consent is the primary legal basis for processing your personal data
- Consent must be free, specific, informed, unconditional, and unambiguous
- Consent must be given through a clear affirmative action
- Withdrawing consent must be as easy as giving consent
- We maintain comprehensive records of consent for accountability
Withdrawing consent shall be made as easy as giving consent, in accordance with the DPDP Act, 2023 and as reflected across our Privacy and Data Protection Policy.
6.2 Legal Basis for Processing
Under the DPDP Act, 2023, we process your personal data based on consent and certain legitimate uses. Consent is required for most processing activities, including account creation, job applications, profile visibility, marketing communications. In limited circumstances, as provided under Section 7 of the DPDP Act, we may process personal data without consent for certain legitimate uses, including when you have voluntarily provided personal data, for compliance with court orders, for responding to medical emergencies, and for employment-related purposes.
7. OBTAINING CONSENT
7.1 Requirements for Valid Consent
For consent to be valid under the DPDP Act, 2023, it must be free (given voluntarily without coercion), specific (obtained for specific, clearly defined purposes), informed (provided after receiving clear information about processing), unconditional (not tied to unfair conditions), and unambiguous (obtained through clear affirmative action). We do not rely on silence, pre-ticked boxes, or inactivity as consent.
7.2 Privacy Notice Requirements
In accordance with the DPDP Act, 2023 and DPDP Rules, 2025, our privacy notices are written in clear and plain language, presented independently and not buried in lengthy terms of service, made available in English and in any of the 22 languages specified in the Eighth Schedule of the Constitution of India, provided at the time of collection or before processing commences, and easily accessible throughout your use of our platform.
7.3 Consent for Sensitive Personal Data
For processing of Sensitive Personal Data or Information as defined under the SPDI Rules, 2011, we obtain explicit consent through written communication (letter, fax, or email) that specifically identifies the categories of sensitive personal data being collected, the purpose of collecting and using such data, the intended recipients, and the fact that data may be transferred outside India where applicable. We generally do not collect Sensitive Personal Data unless you voluntarily provide such information as part of job applications or resume uploads. Any Sensitive Personal Data voluntarily submitted is processed strictly in accordance with this Policy and the SPDI Rules, 2011.
7.4 Granular Consent Options
We provide granular consent options allowing you to consent to different processing activities separately. This includes separate consent for core platform functionality, profile visibility to employers, marketing communications via email and SMS, personalized job recommendations, sharing data with third-party partners, and analytics and research activities.
8. WITHDRAWAL OF CONSENT
8.1 Right to Withdraw
You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. We ensure that withdrawing consent is as easy as giving consent.
8.2 Methods for Withdrawal
You may withdraw your consent through Account Settings (Settings > Privacy > Consent Management), the Cookie Preference Centre, email request to our Data Protection Officer, through a registered Consent Manager, or using unsubscribe links in marketing emails.
8.3 Processing of Withdrawal Requests
Upon receiving your withdrawal request, we shall acknowledge receipt within forty-eight (48) hours, cease processing based on the withdrawn consent within seven (7) days, notify any third parties with whom your data has been shared to cease processing, and confirm completion of the withdrawal to you.
8.4 Consequences of Withdrawal
We shall inform you of any consequences that may arise from withdrawal of consent before processing the request. Depending on the consent withdrawn, consequences may include inability to provide certain services, reduced personalization of content, loss of access to certain functionality, or in extreme cases, termination of the account if core functionality cannot be provided. Where withdrawal of consent prevents us from providing core Platform functionalities, your account may become partially or fully unusable, consistent with the Terms of Service.
9. CONSENT MANAGERS
9.1 Role of Consent Managers
The DPDP Act, 2023 introduces the concept of Consent Managers, entities registered with the Data Protection Board of India that act as intermediaries to enable Data Principals to give, manage, review, and withdraw their consent through an accessible, transparent, and interoperable platform.
9.2 Our Interaction with Consent Managers
We are committed to working with Consent Managers registered with the Data Protection Board of India. Our systems are designed to accept and process consent instructions received through registered Consent Managers, provide consent status information upon authenticated request, honour consent withdrawal requests received through Consent Managers, and maintain interoperability with Consent Manager platforms as per technical standards prescribed by the Data Protection Board.
10. CONSENT RECORDS AND ACCOUNTABILITY
10.1 Consent Record Keeping
We maintain comprehensive records of consent to demonstrate compliance with applicable laws. Our consent records include identity of the Data Principal, date and time consent was given or modified, method through which consent was obtained, specific processing activities consented to, version of the privacy notice presented, and any changes to consent status.
10.2 Retention of Consent Records
Consent records are retained for the following periods: active consent records for the duration of processing plus seven (7) years, withdrawn consent records for seven (7) years from the date of withdrawal, and records required for legal proceedings until conclusion of proceedings plus applicable limitation period.
11. SPECIAL PROVISIONS FOR CHILDREN
Our platform is intended for users who are eighteen (18) years of age or older. We implement age verification mechanisms to prevent minors from creating accounts. Users are required to represent and warrant that they are 18 years of age or older, as set out in our Terms of Service. If we become aware that we have collected personal data from a child, we shall immediately cease processing, attempt to obtain verifiable consent from the child's parent or lawful guardian, and delete the child's personal data if consent cannot be obtained. In accordance with Section 9 of the DPDP Act, 2023, tracking, behavioral monitoring, and targeted advertising directed at children is prohibited.
12. THIRD-PARTY DATA SHARING CONSENTS
When you apply for a job or make your profile visible to employers, you consent to sharing your profile information with prospective employers. This consent is specifically obtained at the time of making your profile searchable by employers, when submitting a job application, or when responding to recruiter outreach. We engage third-party service providers who process data on our behalf under data processing agreements. Where we share data with third-party partners who act as independent Data Fiduciaries, we obtain your specific consent before such sharing. You can manage these consents through Settings > Privacy > Data Sharing Preferences. All third-party service providers who process data on our behalf are bound by Data Processing Agreements that ensure compliance with the DPDP Act, 2023 and restrict processing to the purposes expressly authorised by us.
13. GRIEVANCE REDRESSAL
If you have any grievances relating to our cookie practices or consent management, you may contact our Grievance Officer or Data Protection Officer. Contact details are provided in our Grievance Redressal Policy www.gulfreturn.com. If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India.
14. UPDATES TO THIS POLICY
We may update this Cookie and Consent Management Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we shall notify you through email, in-app notification, or a prominent notice on our platform. We shall update the "Effective Date" at the top of this Policy. Where material changes affect processing based on consent, we shall seek fresh consent. We shall maintain an archive of previous versions for reference.
15. GOVERNING LAW
This Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Hyderabad, India, without prejudice to the jurisdiction of the Data Protection Board of India to adjudicate complaints under the DPDP Act, 2023.
16. CONTACT INFORMATION
For any questions, concerns, or requests regarding this Policy, please contact us at: **Gulf Return managed by Sheruh** [Registered Office Address] [City, State, PIN Code] Email: support@gulfreturn.com Phone: [-]
***AS SET OUT IN THIS POLICY*** By continuing to use our platform after reviewing this Policy, you acknowledge that you have read, understood, and agree to our use of cookies and our consent management practices as described herein. If you do not agree with any aspect of this Policy, please adjust your cookie preferences or refrain from using our services.