Privacy Policy

This Privacy Policy explains how Recruitable Software Inc, doing business as Recruitable, collects, uses, stores, and protects personal information when you visit our website at www.recruitablehr.com, use the Recruitable platform, apply for a job through a recruitment agency that uses Recruitable, or use a Recruitable-powered AI Resume Builder on any recruitment agency website.

We are committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the California Consumer Privacy Act (CCPA) as amended by the CPRA, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec Law 25, and all other applicable privacy legislation.

We are registered with the Information Commissioner’s Office (ICO) in the United Kingdom. Our ICO registration number is available on request.

If you have any questions about this Policy or wish to exercise your privacy rights, please contact us at privacy@recruitablehr.com.

1. WHO WE ARE AND HOW TO CONTACT US

For UK data subjects, Recruitable acts as a Data Controller in relation to information collected through the website and as a Data Processor in relation to candidate and client data processed on behalf of recruitment agencies using the platform.

2. WHAT PERSONAL DATA WE COLLECT AND WHY

2.1 Website Visitors

When you visit www.recruitablehr.com we automatically collect certain technical information through cookies and analytics tools including your IP address, browser type, operating system, pages visited, time spent on pages, and referring website. This data is collected to understand how people use our website and to improve it. We use Google Analytics, Facebook Pixel, and LinkedIn Pixel and potentially other 3rd party tools for this purpose. For more information on cookies see Section 7.

2.2 Demo Requests and Contact Forms

When you submit a demo request, contact form, or book a call through our website, we collect your name, company name, email address, phone number, company headquarters, agency type, and any other information you choose to provide. We use this information to respond to your enquiry, schedule demonstrations, and follow up with you about the Recruitable platform. We may also add you to our marketing communications list with your consent.

2.3 Platform Users (Recruiters and Agency Staff)

When a recruitment agency subscribes to Recruitable and creates User accounts, we collect and process information about those Users including name, email address, phone number, job title, and login activity. This data is used to provide access to the platform, deliver customer support, send billing communications, product updates, and security notifications. This processing is necessary for the performance of our contract with the agency customer.

2.4 Candidate Data

When a candidate applies for a job posted by a recruitment agency using Recruitable, or when a recruiter uploads a candidate’s details to the platform, we collect and store candidate personal data including name, email address, phone number, home address, resume, work history, education, skills, interview transcripts, and any notes added by recruiters. This data is processed on behalf of the recruitment agency as Data Controller. Candidates who provide consent through the Recruitable Candidate Consent Agreement additionally agree to their data being retained in the Recruitable platform and made available to recruiters on the platform for recruitment matching purposes. See Section 6 for full details of candidate data rights.

2.5 AI Resume Builder Users

When a candidate uses a Recruitable-powered AI Resume Builder, which may be hosted on a recruitment agency’s website under the agency’s own branding, we collect the candidate’s name, email address, phone number, work history, education, and skills entered during the resume creation process. Candidates are informed at the point of use that the resume builder is powered by Recruitable and that their data is subject to Recruitable’s Privacy Policy and Candidate Consent Agreement. This data is treated in the same way as candidate application data described in Section 2.4.

2.6 Payment Information

Recruitable uses Stripe to process all subscription payments. We do not store, process, or have access to payment card numbers, bank account details, or other sensitive financial information. All payment data is handled directly by Stripe in accordance with their PCI-DSS compliance obligations. You can view Stripe’s privacy policy at stripe.com/privacy.

2.7 VoIP and Call Recording Data

Where recruitment agencies enable VoIP integrations with providers such as RingCentral, Aircall, Dialpad, Zoom Phone, 8×8, or Vonage, call recordings and transcripts from calls made through those providers may be automatically imported into the Recruitable platform and stored against the relevant candidate or client profile. Recruiters are responsible for ensuring appropriate consent is obtained from call participants in accordance with applicable telecommunications laws.

2.8 SMS Communications

Where recruiters use the SMS feature within the platform to contact candidates or clients, we process the recipient’s phone number and the content of the message on behalf of the recruitment agency. Recipients who have not consented to SMS communications should contact the recruitment agency directly.

3. HEADHUNTED AND IMPORTED CANDIDATES

Recruitment agencies that use Recruitable frequently source, headhunt, and import candidate data into the platform without the candidate having applied directly for a role. This is a standard and legitimate part of how professional recruitment works. A recruiter may find your profile on LinkedIn, a professional network, a job board, or through a referral, and import your name, contact details, and career history into the Recruitable platform to consider you for a role they are working on.

If your personal data has been added to the Recruitable platform by a recruitment agency in this way, the following applies to you:

3.1 You Have Full Rights Over Your Data

Even if you did not apply for a role and did not sign anything, you have full rights over any personal data held about you in the Recruitable platform. You can request access to your data, request its correction, or request its deletion at any time by emailing privacy@www.recruitablehr.com with the subject line Candidate Data Request. We will respond within thirty (30) days.

3.2 The Recruitment Agency Is Responsible

The recruitment agency that imported your data is the Data Controller for that data. They are responsible for ensuring they have a lawful basis to hold your information, which in a recruitment context is typically legitimate interests in considering you for relevant job opportunities. Recruitable stores and processes that data on their behalf as Data Processor. If you want to know why a specific agency holds your data or wish to exercise your rights directly with them, you should contact that agency directly.

3.3 You Can Opt Out at Any Time

If you do not wish your data to be held in the Recruitable platform, email privacy@www.recruitablehr.com at any time. We will remove your data from the platform within thirty (30) days. This will not automatically remove any data held by the recruitment agency outside of Recruitable, which you should request separately from the agency.

3.4 Your Data May Be Stored in the United States

Recruitable hosts its platform in the United States. If your personal data was imported by a recruitment agency based in the UK, EU, Canada, Australia, or any other country, that data may be transferred to and stored in the United States. This transfer is made in accordance with applicable data transfer mechanisms including the UK International Data Transfer Agreement, Standard Contractual Clauses, and individual consent where applicable. You have the right to obtain information about these transfer mechanisms by contacting privacy@recruitablehr.com.

4. AI RESUME BUILDER

Recruitable provides a white-labeled AI Resume Builder that recruitment agencies can offer on their own branded websites. When you use a resume builder on a recruitment agency website, it may be powered by Recruitable even if the Recruitable name is not prominently displayed.

4.1 Transparency Notice

In accordance with our transparency obligations under applicable data protection law, we disclose that if you use an AI Resume Builder on any recruitment agency website, the underlying technology is operated by Recruitable and your data is collected, stored, and processed by Recruitable subject to this Privacy Policy. The recruitment agency has licensed this technology from Recruitable and is also a Data Controller for the purposes of your job application.

4.2 What We Collect

When you use the AI Resume Builder we collect your name, email address, phone number, work history, education, qualifications, skills, and any other information you enter during the resume creation process. Your completed resume is stored in the Recruitable platform and is sent to the recruitment agency on whose website the builder is hosted.

4.3 How We Use It

Your resume builder data is used to generate your resume, to submit your profile to the recruitment agency, and where you have consented through the Candidate Consent Agreement, to store your profile in the Recruitable candidate database for ongoing recruitment matching and to make your contact details available to recruiters through the platform data enrichment feature.

4.4 Your Rights

Your rights in relation to resume builder data are the same as all other candidate data described in Section 6 of this Policy. You may request access, correction, or deletion at any time by emailing privacy@recruitablehr.com.

• We use Google user data only to provide and improve the user-facing features described to you when you grant access.
• We do not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition, and then only under confidentiality and data-protection obligations.
• We do not use Google user data to serve advertising of any kind, including personalized, retargeted, or interest-based advertising.
• We do not allow humans to read your Google user data unless (a) you have given affirmative consent to view specific data, (b) it is necessary for security purposes or to comply with applicable law, or (c) the data has been aggregated and anonymized for internal operations.

6. LEGAL BASIS FOR PROCESSING

We rely on the following legal bases to process personal data:

• Processing Activity
• Website analytics and cookies
• Demo requests and contact forms
• Platform user accounts
• Candidate data on behalf of agencies
• Candidate consent for enrichment
• AI Resume Builder data
• Billing and invoicing
• Security and fraud prevention
• Marketing communications Legal Basis
• Consent (cookie consent)
• Legitimate interests (respond to enquiry)
• Performance of contract
• Instructions from Data Controller (agency)
• Consent (Candidate Consent Agreement)
• Consent (Candidate Consent Agreement)
• Legal obligation and contract
• Legitimate interests
• Consent (opt-in at point of collection)

7. HOW WE USE PERSONAL DATA

We use personal data collected through the website and platform for the following purposes:

• To provide, operate, maintain, and improve the Recruitable platform and website
• To create and manage User accounts and deliver subscription services
• To process payments and manage billing through Stripe
• To send transactional communications including account confirmations, invoices, security alerts, and product updates
• To send marketing communications to people who have opted in to receive them

• To respond to enquiries, support requests, and demo requests
• To enable recruitment agencies to manage candidate pipelines, submit candidates to clients, and conduct interviews
• To power the data enrichment feature within the platform, making verified candidate contact details available to recruiters, where candidates have provided consent through the Candidate Consent Agreement
• To comply with legal obligations including tax, accounting, and regulatory requirements
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To enforce our Terms of Service and Master Subscription Agreement

8. WHO WE SHARE DATA WITH

We do not sell personal data to third parties. We share personal data only in the following circumstances:

8.1 Subprocessors

We use trusted third-party service providers who process data on our behalf to help us deliver the Service. A full and current list of our subprocessors is available at www.recruitablehr.com/legal/subprocessors. Current categories of subprocessors include cloud infrastructure providers, payment processors, SMS delivery providers, VoIP integration providers, analytics providers, and email delivery services. All subprocessors are bound by data processing agreements and are required to maintain security standards consistent with ours.

8.2 Recruitment Agencies on the Platform

Candidate data submitted through job applications or the AI Resume Builder, where the candidate has consented to the Candidate Consent Agreement, may be made available to recruitment agencies that use the Recruitable platform in connection with live recruitment mandates. This is the core function of the data enrichment feature. Only recruitment agencies with active Recruitable subscriptions can access this data, and only in the context of legitimate recruitment activity.

8.3 Legal Requirements

We may disclose personal data where required to do so by law, court order, or regulatory authority. Where legally permitted we will notify the relevant individual or organization before making such a disclosure.

8.4 Business Transfers

If Recruitable undergoes a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the acquiring entity. We will notify affected individuals and ensure the new entity maintains equivalent data protection standards.

9. CANDIDATE AND RESUME BUILDER USER RIGHTS

If your personal data has been collected through a job application or an AI Resume Builder powered by Recruitable, you have the following rights regardless of which country you are in:

9.1 Right to Access

You have the right to request a copy of the personal data we hold about you. We will respond to access requests within thirty (30) days. To make a request email privacy@www.recruitablehr.com with the subject line Data Access Request and include your full name, email address, and the recruitment agency or website through which you applied or used the resume builder.

9.2 Right to Deletion

You have the right to request that we delete your personal data from the Recruitable platform at any time. To request deletion email privacy@www.recruitablehr.com with the subject line Data Deletion Request. We will process your request within thirty (30) days. Note that deletion from the Recruitable platform does not automatically delete data held by the recruitment agency that is the Data Controller for your application. You should contact the recruitment agency directly for that.

9.3 Right to Withdraw Consent

If your data is processed based on your consent through the Candidate Consent Agreement, you may withdraw that consent at any time by emailing privacy@www.recruitablehr.com. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

9.4 Right to Correction

You have the right to request correction of inaccurate personal data we hold about you. Email privacy@recruitablehr.com with the subject line Data Correction Request.

9.5 UK and European Rights

If you are located in the UK or European Economic Area, you have additional rights under UK GDPR including the right to data portability, the right to object to processing, and the right to restriction of processing. You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk if you believe we have not handled your data appropriately.

9.6 California Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect about you, the right to delete your personal information, the right to opt out of the sale or sharing of your personal information, and the right to non-discrimination for exercising your privacy rights. Recruitable does not sell personal data. To exercise your California privacy rights contact privacy@www.recruitablehr.com.

9.7 Canadian Rights (PIPEDA and Quebec Law 25)

If you are located in Canada, you have the right to access your personal information, to challenge its accuracy, and to withdraw consent to its collection, use, or disclosure subject to legal or contractual restrictions. Quebec residents have additional rights under Law 25 including the right to data portability and the right to be informed of automated decision-making. To exercise these rights contact privacy@recruitablehr.com.

10. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar tracking technologies to operate, analyze, and improve the site experience. A cookie is a small text file stored on your device when you visit a website.

10.1 Types of Cookies We Use

• Strictly necessary cookies: These are required for the website and platform to function. They cannot be disabled. They include session cookies, authentication cookies, and security tokens.
• Analytics cookies: We use Google Analytics to understand how visitors use our website, which pages are most popular, and how people find us. Google Analytics uses cookies to collect this information in an anonymized form. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• Marketing and advertising cookies: We use Facebook Pixel and LinkedIn Insight Tag to measure the effectiveness of our advertising campaigns and to reach people who have visited our website with relevant advertising. These cookies collect information about your online activity to deliver targeted advertisements.
• Preference cookies: These cookies remember your settings and preferences to improve your experience.

10.2 Cookie Consent and Cookie Banner

When you first visit www.recruitablehr.com you will be shown a cookie consent banner powered by our cookie consent management platform. No non-essential cookies are set until you actively accept them through the banner. You can accept all cookies, reject all non-essential cookies, or manage your preferences by category. You can change your cookie preferences at any time by clicking the cookie settings link in the footer of our website. Your consent choices are stored and respected on future visits. For UK visitors, this cookie consent mechanism is operated in compliance with the Privacy and Electronic
Communications Regulations 2003 (PECR). For EU and EEA visitors, this mechanism complies with the EU ePrivacy Directive and applicable GDPR requirements.

10.3 Third-Party Cookies

Some cookies on our website are set by third parties including Google, Facebook, and LinkedIn. These third parties have their own privacy policies governing their use of that data. We recommend reviewing their policies directly. We do not control these third-party cookies.

11. HOW LONG WE KEEP YOUR DATA

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes.

• Website visitor analytics data: 26 months in Google Analytics, then automatically deleted
• Demo requests and contact form data: 3 years from last contact, or until you request deletion
• Platform User account data: For the duration of the subscription plus 7 years for billing and tax records
• Customer Data (candidate and client records uploaded by agencies): 60 days after contract termination then deleted, unless the agency exports data during the retention period
• Candidate data collected under Candidate Consent Agreement: Retained indefinitely until the candidate submits a valid deletion request to privacy@recruitablehr.com. For UK and EU data subjects, Recruitable will periodically review candidate records that have been inactive for more than three (3) years and where appropriate will contact those individuals to confirm they wish to remain in the database, in accordance with data minimisation principles under UK GDPR and EU GDPR.
• AI Resume Builder data: Treated the same as candidate consent data above
• Call recordings and transcripts: Retained for the duration of the subscription and for 60 days following contract termination
• Free trial data: 60 days after trial expiry if no paid plan is activated

12. INTERNATIONAL DATA TRANSFERS

Recruitable is headquartered in the United States and hosts its platform in the United States. Because Recruitable operates globally and its customers recruit candidates in countries around the world, personal data from individuals located in many different jurisdictions is collected, transferred,
and stored in the United States. This section explains what that means for individuals in each major region.

12.1 United Kingdom

For transfers of personal data from the UK to the United States, Recruitable relies on the UK International Data Transfer Agreement (IDTA) and where applicable, consent obtained at the point of data collection. Recruitable is registered with the Information Commissioner Office in the United Kingdom. UK data subjects have full rights under UK GDPR as described in Section 8 of this Policy.

12.2 European Union and European Economic Area

For transfers of personal data from the EU or EEA to the United States, Recruitable relies on Standard Contractual Clauses approved by the European Commission. EU and EEA data subjects have full rights under EU GDPR. If you are located in the EU and have a complaint about how your data is handled, you may contact the data protection authority in your country of residence.

12.3 Canada

Recruitable complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, with Quebec Law 25. Transfers of Canadian personal data to the United States are made on the basis of contractual protections with data recipients and individual consent obtained at the point of collection. Quebec residents have additional rights under Law 25 including data portability rights.

12.4 Australia

Recruitable complies with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Transfers of Australian personal data to the United States are made on the basis of contractual protections ensuring equivalent protection and individual consent obtained at the point of collection. Australian individuals have the right to access and correct their personal data and to make a complaint to the Office of the Australian Information Commissioner at oaic.gov.au.

12.5 India

Recruitable acknowledges the Digital Personal Data Protection Act 2023 (DPDPA) of India and commits to complying with applicable obligations under this Act as they come into force. Transfers of Indian personal data to the United States are made on the basis of individual consent obtained at the point of data collection and contractual protections with data recipients. Indian data subjects have the right to access, correct, and erase their personal data by contacting privacy@recruitablehr.com.

12.6 Singapore

Recruitable complies with the Personal Data Protection Act 2012 (PDPA) of Singapore. Transfers of Singapore personal data to the United States are made under contractual arrangements ensuring data recipients maintain comparable standards of protection. Singapore data subjects may contact privacy@recruitablehr.com to exercise their access and correction rights.

12.7 United Arab Emirates

Recruitable acknowledges the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection. Transfers of UAE personal data to the United States are made on the basis of individual consent obtained at the point of data collection and contractual protections with data recipients. UAE data subjects may contact privacy@recruitablehr.com to exercise their rights.

12.8 Japan

Recruitable acknowledges the Act on the Protection of Personal Information (APPI) of Japan. Transfers of Japanese personal data to the United States are made on the basis of individual consent and contractual protections ensuring equivalent protection standards. Japanese data subjects may contact
privacy@recruitablehr.com to exercise their rights including the right to disclosure, correction, and deletion.

12.9 Other Countries

Recruitable serves customers and processes candidate data from countries across the world. For all other jurisdictions not specifically listed above, Recruitable commits to complying with applicable local data protection and privacy laws, implementing appropriate transfer mechanisms as required by each jurisdiction, and honoring individual rights requests submitted to privacy@recruitablehr.com. If you are located in a country not listed above and have questions about how your data is handled, please contact us directly.

Recruitable reserves the right to change the locations of its data centers and cloud infrastructure at any time, provided that appropriate transfer mechanisms remain in place and the overall level of data protection is maintained or improved. We will update this section as new data protection laws come into force in jurisdictions where we operate.

13. HOW WE PROTECT YOUR DATA

We take data security seriously and implement commercially appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:

• Regular independent security assessments and vulnerability testing
• End-to-end encryption of all data in transit and at rest
• Role-based access controls limiting data access to authorized personnel only
• Regular security assessments and penetration testing
• Secure, dedicated cloud storage infrastructure
• Zero data retention policy for AI training on personally identifiable data

In the event of a personal data breach, we will notify affected individuals and relevant regulatory authorities in accordance with our legal obligations, including within 72 hours for notifiable breaches under UK GDPR.

14. CHILDREN’S PRIVACY

The Recruitable platform and website are intended exclusively for business use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a person under 18 has provided personal data to us, please contact privacy@recruitablehr.com and we
will delete it promptly.

15. WE DO NOT SELL PERSONAL DATA

Recruitable does not sell, rent, or trade personal data to third parties for monetary or other consideration. Candidate data made available through the platform’s data enrichment feature is accessible only to recruitment agencies with active Recruitable subscriptions and only in the context of legitimate
recruitment activity. This does not constitute a sale of personal data under the CCPA or any other applicable privacy law.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes we will post the updated Policy on our website and update the Last Updated date at the top. We will notify registered platform users of material changes by email or in-platform notification with at least 30 days notice before the changes take effect. Your continued use of the website or platform after the effective date of any update constitutes your acceptance of the revised Policy.

HOW TO CONTACT US

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

If you are a UK data subject and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.

If you are a Canadian resident and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If you are a California resident and are not satisfied with our response, you may contact the California Privacy Protection Agency at cppa.ca.gov.