Platform: VSPL SaaS Platform
Organization: Vibrant Screens Private Limited (VSPL)
Version: 1.0
Effective Date: 01/10/2026 | Last Updated: 01/10/2026
1. Purpose
This End User Acceptable Use, Security, Privacy and Data Protection Policy ("Policy") establishes the terms, responsibilities, security requirements and acceptable-use standards applicable to all users accessing or using the VSPL SaaS Platform ("Platform"). The purpose of this Policy is to ensure that the Platform is used securely, lawfully, responsibly and only for authorized business purposes. By accessing, registering for, logging into, or using the Platform, the End User acknowledges that they have read, understood and agreed to comply with this Policy. Where applicable, the End User may also be required to accept additional contractual terms, privacy notices, client-specific policies, service-specific terms or other applicable agreements.
2. Definitions
For the purpose of this Policy:
2.1 "VSPL": Means Vibrant Screens Private Limited, including its authorized representatives, employees, contractors and service providers.
2.2 "Platform": Means the VSPL-hosted SaaS application, including its web applications, APIs, databases, dashboards, workflows, integrations, reports, files, supporting infrastructure and related services.
2.3 "End User" or "User": Means any individual authorized to access or use the Platform.
2.4 "Customer": Means the organization, client or business entity that has subscribed to or otherwise authorized use of the Platform.
2.5 "Customer Data": Means information, documents, records, files, personal information and other data submitted, uploaded, generated or processed through the Platform on behalf of the Customer.
2.6 "Personal Data": Means information relating to an identified or identifiable individual, as defined under applicable data protection and privacy laws.
2.7 "Authorized User": Means an individual who has been expressly authorized by the Customer or VSPL to access the Platform.
2.8 "Confidential Information": Means non-public information relating to VSPL, the Customer, End Users, candidates, business operations, systems, processes, technology, security controls or data.
3. Acceptance of the Policy
By selecting "I Accept", "Agree", "Continue", or an equivalent option, or by accessing or using the Platform where acceptance is otherwise legally permitted, the End User confirms that:
- They have read and understood this Policy.
- They agree to comply with the requirements contained in this Policy.
- They will use the Platform only for authorized and legitimate business purposes.
- They will protect their login credentials and authentication mechanisms.
- They will not misuse, disrupt, compromise or attempt to circumvent the security of the Platform.
- They will comply with applicable laws, regulations and organizational policies.
- They understand that Platform activity may be logged, monitored and audited for security, operational, compliance and troubleshooting purposes.
- They will immediately report suspected security incidents, unauthorized access or misuse.
- They understand that violation of this Policy may result in suspension or termination of access and may lead to further action where applicable.
4. Authorized Use
The Platform shall be used only for legitimate business purposes and within the scope of access granted to the End User. The End User shall: Use the Platform only for authorized activities; Access only those modules, records, cases, reports, documents and information for which they have permission; Use Customer Data only for the purpose for which access has been granted; Follow the Customer's internal policies and procedures applicable to Platform usage; Follow VSPL security and operational requirements; Ensure that information entered into the Platform is accurate and appropriate to the extent reasonably possible; Maintain the confidentiality of information accessed through the Platform; Cooperate with reasonable security, audit and compliance requirements. Access rights shall be based on the user's assigned role and permissions. The existence of technical ability to access information does not constitute authorization to access or use that information.
5. User Account and Access Management
Each End User shall use their own individual account unless an explicitly approved shared or service account is provided. Users shall not: Share usernames or passwords; Allow another person to use their account; Transfer their account to another individual; Attempt to obtain another user's credentials; Create unauthorized accounts; Circumvent role-based access controls; Attempt to elevate their privileges without authorization; Use another user's session or authentication token. Users are responsible for all activities performed through their account unless they promptly report suspected unauthorized access.
6. Password and Authentication Security
Where password-based authentication is provided, users shall: Maintain passwords in confidence; Use strong and reasonably unique passwords; Not reuse Platform passwords for unrelated services where avoidable; Not store passwords in publicly accessible documents; Not communicate passwords through unsecured channels; Change credentials when compromise is suspected; Comply with applicable password and multi-factor authentication requirements. Where Multi-Factor Authentication (MFA) is enabled or required, users shall not share OTPs, authentication codes, recovery codes or authentication devices with another person. Users must immediately report suspected credential compromise.
7. Data Access and Confidentiality
The Platform may contain sensitive business information, personal information, background verification information, candidate information, documents, reports and other confidential data. Users shall: Access only data required for their assigned responsibilities; Maintain confidentiality of information accessed through the Platform; Not disclose confidential information to unauthorized persons; Not copy, export, download or transmit information unless authorized; Not use Customer Data for personal purposes; Not use Platform information for unauthorized commercial purposes; Not publish or distribute Platform information without authorization. Confidentiality obligations continue after the End User's access to the Platform has been revoked or their association with the Customer has ended.
8. Personal Data and Privacy
Users may encounter Personal Data while using the Platform. Users shall: Access Personal Data only where necessary for authorized business activities; Process Personal Data only for legitimate and authorized purposes; Avoid unnecessary downloading, copying or sharing of Personal Data; Not disclose Personal Data to unauthorized individuals or organizations; Not use Personal Data for personal, marketing or unrelated purposes; Follow applicable privacy and data protection requirements; Report accidental disclosure or suspected unauthorized access immediately. Users must exercise additional care when handling information such as: Identity information, Contact information, Government-issued identifiers, Employment information, Education information, Address information, Financial or credit-related information, Background verification information, Documents containing Personal Data, or any other information designated as confidential or sensitive.
9. Data Accuracy and Responsible Data Entry
Users are responsible for exercising reasonable care when entering, modifying or submitting information through the Platform. Users shall not knowingly: Enter false or misleading information; Alter records without authorization; Manipulate verification results; Create fraudulent records; Misrepresent the status of a case or transaction; Deliberately submit incorrect documents or information; Modify information for the purpose of bypassing a business or security control. Where an error is identified, users should follow the applicable correction or escalation process.
10. Document and File Upload Requirements
Where the Platform permits document uploads, users shall ensure that uploaded files: Are relevant to the intended business process; Are obtained and submitted through authorized means; Do not intentionally contain malicious software; Do not contain unauthorized or unrelated information; Do not violate applicable laws or third-party rights; Are uploaded only to the appropriate case, record or transaction. Users shall not knowingly upload malware, ransomware, viruses, malicious scripts or other harmful content. VSPL may apply technical security controls to uploaded files, including validation, scanning, processing, quarantine or rejection.
11. Prohibited Activities
The following activities are strictly prohibited unless expressly authorized by VSPL:
11.1 Unauthorized Access: Attempting to access accounts, systems, databases or records without authorization; Attempting to bypass authentication, authorization or access controls; Attempting privilege escalation; Attempting to access administrative functions without authorization.
11.2 Security Testing: Performing vulnerability scanning, penetration testing, port scanning, automated security testing, exploitation attempts, brute-force attacks, or denial-of-service testing against the Platform unless such activity has been expressly authorized in writing by VSPL.
11.3 System Disruption: Intentionally overloading the Platform, generating excessive automated requests, introducing malicious code, interfering with Platform availability, attempting to disrupt APIs or application services, or circumventing rate limits or technical restrictions.
11.4 Data Misuse: Extracting bulk information without authorization, selling or distributing Platform data, using Platform data for unauthorized profiling, sharing confidential reports externally without authorization, or using data obtained through the Platform for unrelated purposes.
11.5 Reverse Engineering: Reverse engineering the Platform, decompiling application components, attempting to obtain source code, modifying application code, circumventing technical protections, or reproducing proprietary application functionality.
12. API Usage
Where API access is provided, APIs shall be used only for approved business purposes. Users and Customers shall: Use only authorized API credentials; Protect API keys, tokens and secrets; Not share API credentials publicly; Not expose credentials in source code repositories or client-side applications where inappropriate; Follow applicable API rate limits; Not generate unnecessary or abusive traffic; Not attempt to circumvent API restrictions; Not use APIs to extract data beyond authorized access. Compromised API credentials must be reported immediately.
13. Automation and Integrations
Where the Platform supports integrations, workflows, bots or automated processing: Only authorized integrations may be configured; Automation must be used for legitimate business purposes; Automated workflows must not intentionally generate excessive traffic; Integration credentials must be securely maintained; Users must not configure workflows that intentionally interfere with Platform availability; Third-party integrations must comply with applicable privacy and security requirements. VSPL may suspend an integration that presents a material security, availability or compliance risk.
14. Monitoring, Logging and Audit
For security, operational, compliance, troubleshooting and service-management purposes, Platform activity may be logged and monitored. Depending on the Platform functionality and applicable requirements, logs may include: Login and logout activity, Authentication events, IP address information, User actions, API requests, Administrative activities, Data access activity, File upload/download activity, Configuration changes, Security events, and Error and diagnostic information. Monitoring shall be performed in accordance with applicable contractual, privacy and legal requirements. Users acknowledge that Platform activity may be subject to audit.
15. Security Incident Reporting
Users must promptly report suspected or actual security incidents. Examples include: Suspected account compromise, Lost or stolen authentication device, Unauthorized login, Unexpected password reset, Unauthorized data access, Accidental data disclosure, Suspicious files or links, Malware infection, Unusual Platform behavior, Unauthorized API activity, Suspected data leakage, or Security vulnerabilities discovered in the Platform. Users should report incidents through the Customer's designated security/support channel or the VSPL support channel. Users must not publicly disclose a suspected vulnerability before coordinating with the authorized security team.
16. Data Download, Export and Local Storage
Users should download or export information only when necessary for authorized business purposes. Downloaded information must be: Stored securely; Accessible only to authorized persons; Protected against unauthorized disclosure; Deleted or securely disposed of when no longer required, subject to applicable retention requirements. Users should avoid storing confidential or Personal Data on unmanaged or publicly accessible devices.
17. Use of Company and Personal Devices
Users accessing the Platform from organizational devices must comply with their organization's device-security requirements. Where personal devices are permitted, users should ensure that: The device is protected by authentication; Operating system security updates are installed; Security software is maintained where applicable; The device is not intentionally compromised or rooted/jailbroken; Platform data is not unnecessarily stored locally; Unauthorized persons cannot access Platform sessions. Users must log out of the Platform when using a shared device.
18. Session Security
Users should: Lock their workstation when unattended; Log out after completing their work session where appropriate; Avoid using the Platform from untrusted public computers; Avoid accessing confidential information over unsecured networks where appropriate security controls are unavailable; Never leave an authenticated session unattended on an accessible device.
19. Intellectual Property
The Platform, including its software, interfaces, designs, workflows, documentation, trademarks, logos and underlying technology, may contain intellectual property owned by VSPL or its licensors. Nothing in this Policy grants the End User ownership of VSPL intellectual property. Users shall not reproduce, distribute, modify or commercially exploit VSPL intellectual property except as expressly authorized. Customer Data remains subject to the applicable Customer agreement and data ownership arrangements.
20. Third-Party Content and Services
The Platform may integrate with or depend on third-party services, APIs, databases, verification providers, cloud infrastructure or other external services. Third-party services may have their own: Terms of use, Privacy policies, Availability limitations, Security requirements, and Processing conditions. Users shall use such services only for authorized business purposes. VSPL may depend on third-party service availability and may not control the availability or functionality of external services.
21. Availability and Business Continuity
VSPL will operate the Platform using commercially reasonable operational and security practices appropriate to the service. However, users acknowledge that SaaS services may occasionally experience: Planned maintenance, Emergency maintenance, Network interruptions, Infrastructure failures, Third-party service interruptions, Security incidents, or Unforeseen technical issues. Where appropriate, VSPL may notify Customers regarding material service interruptions or maintenance activities.
22. Backup and Data Recovery
VSPL may maintain backup, recovery and disaster-recovery mechanisms appropriate to the Platform and applicable service requirements. Backups are intended to support service continuity and recovery and should not be interpreted as unrestricted archival storage for End Users. Customers and End Users remain responsible for following their organization's approved data-retention and business-continuity requirements.
23. Data Retention and Deletion
Data retention and deletion shall be governed by applicable Customer contractual requirements, data retention schedules, legal and regulatory requirements, VSPL operational policies, and applicable privacy requirements. Users shall not intentionally retain unnecessary copies of confidential or Personal Data. Where a user receives a legitimate request to delete, correct or restrict data, the request must be processed through the applicable authorized workflow rather than through unauthorized direct database or system manipulation.
24. Data Segregation and Access Boundaries
The Platform may support multiple Customers, entities, business units, users and cases. Users must not attempt to access information belonging to another Customer, entity, business unit or user unless explicitly authorized. Users must not attempt to manipulate identifiers, URLs, API parameters, case numbers, record IDs or other application inputs to access unauthorized information. Any suspected cross-tenant or cross-entity data exposure must be reported immediately.
25. Use of AI and Automated Processing
Where the Platform uses artificial intelligence, machine learning, OCR or automated processing: Users shall provide information only for authorized business purposes; Users shall not intentionally submit unrelated confidential information; Users shall review AI-generated or automatically extracted information where human validation is required; Automated results should not be treated as infallible; Users remain responsible for following applicable business approval and verification procedures; Users shall not attempt to manipulate AI systems to bypass security, authorization or business controls. Where applicable, AI processing shall be subject to Customer contractual arrangements and applicable privacy requirements.
26. Prohibited Content
Users shall not knowingly upload, transmit, store or distribute through the Platform content that: Is unlawful; Infringes intellectual property rights; Contains malicious software; Facilitates unauthorized access; Contains fraudulent information; Is intended to compromise Platform security; Violates applicable laws or regulations; Violates the Customer's authorized business-use requirements.
27. Compliance with Laws and Regulations
Users shall comply with all applicable laws and regulations when using the Platform. This includes, where applicable: Data protection and privacy laws (e.g. DPDP Act), Cybersecurity requirements, Intellectual property laws, Employment-related requirements, Information-security requirements, Applicable contractual obligations, and Applicable regulatory requirements. Where multiple requirements apply, users should follow the applicable Customer and VSPL compliance processes.
28. Customer Responsibilities
The Customer is responsible for: Authorizing End Users; Assigning appropriate user roles; Removing access when users no longer require it; Maintaining appropriate internal access-management procedures; Ensuring users receive applicable organizational policies; Ensuring that Customer Data is submitted and processed lawfully; Notifying VSPL of relevant security incidents; Managing Customer-side integrations and credentials appropriately.
29. End User Responsibilities
The End User is responsible for: Protecting their credentials; Using the Platform only for authorized purposes; Protecting confidential information; Protecting Personal Data; Following security requirements; Reporting incidents promptly; Maintaining the confidentiality of information accessed through the Platform; Ensuring that their actions do not compromise the Platform or other users.
30. Suspension or Restriction of Access
VSPL or the Customer may suspend or restrict access where reasonably necessary to: Protect Platform security; Prevent unauthorized access; Investigate suspected misuse; Address a security incident; Prevent data leakage; Protect Platform availability; Comply with legal or contractual requirements; Address a material violation of this Policy. Where reasonably practicable, appropriate communication may be provided to the relevant Customer or authorized contact.
31. Policy Violations
Violation of this Policy may result in one or more of the following, depending on the nature and severity of the violation: Warning or corrective action; Temporary suspension of access; Removal of specific permissions; Termination of Platform access; Notification to the Customer; Security investigation; Preservation of relevant audit information; Further action as permitted by applicable law or contractual arrangements. Nothing in this section limits any rights or remedies available under applicable agreements or law.
32. Reporting Misuse
Users who become aware of suspected misuse, unauthorized access, data leakage or security violations should report the matter promptly through the applicable support or security channel. Reports should contain sufficient information to enable investigation, such as: Date and time, Relevant case or record reference, Description of the issue, Screenshots or evidence where appropriate, Affected user/account, and Steps already taken. Users should not intentionally modify or destroy relevant evidence during an investigation.
33. Policy Updates
VSPL may periodically update this Policy to reflect: Changes to the Platform; Security improvements; Changes in applicable laws or regulations; Changes in operational processes; Changes in industry practices; New functionality or integrations. Where material changes are applicable, VSPL or the Customer may provide appropriate notification. Continued use of the Platform following the effective date of an updated Policy may constitute acceptance where permitted by applicable law and contractual arrangements.
34. Electronic Acceptance
The End User acknowledges that electronic acceptance of this Policy is intended to constitute confirmation that the End User has reviewed and agreed to the applicable requirements. The acceptance record may include: User identification, Customer/organization, Date and time of acceptance, Policy version, IP address and/or relevant technical information, Authentication/session information, and other audit information necessary to demonstrate acceptance. The acceptance record may be retained in accordance with applicable retention requirements.
35. No Waiver of Legal or Contractual Obligations
This Policy does not replace or override: Applicable law; Customer agreements; Data processing agreements; Privacy notices; Service agreements; Information-security agreements; Employment obligations; or Other binding contractual requirements. Where requirements conflict, the applicable contractual and legal framework shall govern to the extent required.
36. Contact and Support
For Platform-related issues, users should use the support mechanism provided by their organization or the VSPL support channel designated for the applicable service. For security incidents, suspected unauthorized access or data-security concerns, users should use the designated security incident reporting channel without unnecessary delay.
37. End User Declaration and Acceptance
By selecting "I Accept", I confirm that:
- I have read and understood this Policy.
- I agree to comply with the requirements contained in this Policy.
- I will use the VSPL SaaS Platform only for authorized business purposes.
- I will protect my username, password, MFA credentials and other authentication information.
- I will maintain the confidentiality of information accessed through the Platform.
- I will access only information and functionality for which I am authorized.
- I will comply with applicable privacy, security and data protection requirements.
- I will not attempt to bypass security or access controls.
- I will not misuse, disrupt or compromise the Platform.
- I will promptly report suspected security incidents or unauthorized access.
- I understand that Platform activities may be logged, monitored and audited for legitimate security, operational and compliance purposes.
- I understand that violation of this Policy may result in suspension or termination of my Platform access and may result in further action where applicable.
- I confirm that I am authorized to use the Platform for the intended business purpose.
Electronic Acceptance Record Details:
Pursuant to Section 34, user electronic acceptance is recorded with Timestamp, Policy Version (1.0), IP Address, and User Agent for audit and compliance.
38. Recommended Login/Onboarding Acceptance Text
Application Consent Text:
"I confirm that I have read and agree to the VSPL SaaS Platform End User Acceptable Use, Security and Data Protection Policy. I understand that my access and activities may be subject to security controls, monitoring and audit, and I agree to use the Platform only for authorized business purposes and in compliance with applicable security, privacy and data protection requirements."
