This Privacy Policy explains how RecruFY collects, uses, and protects your personal data in accordance with the Law of Georgia on Personal Data Protection. Please read it together with our Terms of Service.
1. Introduction
RecruFY ("we", "us", "our") is committed to protecting the privacy and personal data of everyone who uses our platform. This Privacy Policy describes what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.
This Policy applies to all users of recrufy.ge and our related services, including Companies, Candidates, and survey respondents.
2. Data Controller
The data controller responsible for your personal data is:
- Company: [COMPANY LEGAL NAME, LLC]
- Registration ID: [REGISTRATION ID]
- Address: [REGISTERED ADDRESS]
- Data protection contact: [DPO / CONTACT EMAIL]
For surveys created by Companies or individuals, the survey creator is the data controller for the responses they collect, and RecruFY acts as a data processor.
3. Data We Collect
Information you provide
- Account information: name, email address, password, role (Company or Candidate);
- Profile information: company name and details, professional background, profile data;
- Application data: positions you apply to, cover notes, and related information;
- Payment information processed by our payment provider (we do not store full card numbers);
- Communications you send to us.
Information generated through use
- Assessment responses, scores, and results;
- Survey responses;
- Usage data such as pages visited, features used, and timestamps;
- Technical data such as IP address, browser type, and device information.
4. How We Use Your Data
We process personal data to:
- Provide, operate, and maintain the Services;
- Create and manage your account;
- Administer assessments and deliver results;
- Enable Companies to evaluate Candidates who apply to their positions;
- Process payments and manage subscriptions;
- Communicate with you about the Services;
- Improve and secure the platform;
- Comply with legal obligations.
5. Legal Basis for Processing
We process personal data on the following legal bases under Georgian data-protection law:
- Consent — where you have given clear consent, for example to share assessment results with a specific Company;
- Contract — where processing is necessary to provide the Services you have requested;
- Legal obligation — where we must process data to comply with the law;
- Legitimate interests — where processing is necessary for our legitimate interests, such as securing and improving the platform, provided these do not override your rights.
6. Assessment & Psychometric Data
Assessment results, including cognitive and personality-related data, are treated with heightened care. This data is generated when you take an assessment and is associated with your account.
Your assessment results are shared with a Company only when you apply to that Company's position or otherwise consent to the sharing. You may view your own results in your dashboard. We do not sell assessment data to third parties.
Depending on how your assessments are classified, some results may constitute special categories of data under Georgian law. Confirm the correct classification and safeguards with your legal advisor.
8. Companies & Candidates
For Candidates: When you apply to a position, the relevant Company receives your application and assessment results connected to that application. The Company becomes an independent controller of that data for its recruitment purposes and is responsible for its own handling of it.
For Companies: You must process Candidate data lawfully, use it only for legitimate recruitment, and comply with all applicable data-protection obligations, including responding to data-subject requests where required.
9. Survey Data
When you create a survey, you act as the data controller for the responses you collect, and RecruFY processes that data on your behalf as a processor. You are responsible for informing respondents how their data will be used and for obtaining any required consent.
Respondents should direct privacy requests regarding survey responses to the survey creator.
10. Third-Party Processors
We use trusted third-party providers to operate the Services, including:
- Supabase — database and authentication infrastructure;
- Vercel — hosting and deployment;
- [PAYMENT PROVIDER] — for payment processing;
- Analytics providers — to understand and improve usage.
These providers process data under contractual obligations consistent with this Policy and applicable law.
11. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements.
Specific retention periods: [INSERT RETENTION PERIODS — e.g. account data retained while account is active; assessment results retained for X; deleted within Y of account closure]. When data is no longer needed, we delete or anonymize it.
12. Your Rights
Subject to Georgian data-protection law, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request deletion of your data ("right to be forgotten"), subject to legal limits;
- Restrict or object to certain processing;
- Withdraw consent at any time, where processing is based on consent;
- Request a copy of your data in a portable format;
- Lodge a complaint with the supervisory authority.
To exercise these rights, contact us using the details in Section 17.
13. International Data Transfers
Some of our service providers may process data outside Georgia. Where personal data is transferred internationally, we take steps to ensure an adequate level of protection consistent with Georgian data-protection law, including appropriate safeguards where required.
15. Children's Privacy
The Services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will take steps to delete it promptly.
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice where appropriate. Please review this Policy periodically.
17. Contact & Complaints
For privacy questions or to exercise your rights, contact us:
- Email: [CONTACT EMAIL]
- Address: [REGISTERED ADDRESS]
You also have the right to lodge a complaint with the Personal Data Protection Service of Georgia if you believe your data has been handled unlawfully.