Privacy Statement

1. Data we collect

1.1 Data you provide to us

We process personal data you submit voluntarily, including:

• Name
• Phone number
• Email address
• Sign-in details (such as password and authentication data)
• Application documents (such as CV, cover letter and supporting information)
• Other data provided by the applicant or the employer

Special categories of personal data

We ask candidates and employers not to include special categories of personal data in application documents unless strictly necessary. Application documents may nonetheless contain such information (for example health, religion or ethnicity).

For application data we generally act as a processor and process that data solely on the instructions of the employer (the controller). The employer is responsible for the applicable legal bases, including any exemptions from the prohibition on processing under Article 9 GDPR.

Where technically possible we apply data minimisation. We take measures to prevent special categories of personal data being used in the analysis, including (i) explicit instructions to the AI model to ignore such information and not repeat it in the output, and (ii) post-processing checks on the output. Special categories of personal data should play no part in generating scores or signals.

1.2 Payment data

Payments are processed by Stripe. Privacy policy: https://stripe.com/privacy

We do not receive full payment card details; we only receive the information needed for invoicing and administration (for example a transaction ID, the last digits of a card, and invoice details).

2. Data collected automatically

We automatically collect technical data when you use our website and services, including:

• IP address
• Browser type and version
• Device and system information (model, operating system, language settings)
• Usage data (pages viewed, actions, timestamps)
• Approximate location (based on IP address)

We use cookies and similar techniques. You can find more information in our cookie statement: https://www.selectwiser.nl/cookies

3. How we use your data

We process your personal data for:

• Creating and managing accounts
• Delivering and supporting our services
• Automated analysis of application documents (AI-supported)
• Communication (such as emails about your account, applications and status updates)
• Payments, invoicing and financial administration
• Security, fraud prevention and error analysis
• Improving and developing our platform
• Complying with legal obligations
• Protecting vital interests in exceptional situations

4. Legal bases under the GDPR

We base our processing on the following legal bases, depending on the purpose and on our role:

Legal basis per purpose (summary)

For more detail on our role per processing activity, see section 5 "Our role: controller and processor".

5. Our role: controller and processor

Controller

We are the controller for, among other things:

• Accounts and authentication
• Invoicing and payment administration
• Security, logging and platform monitoring
• Our own communication and (limited) marketing towards customers and interested parties

Processor

For application data collected by employers through our environment, we act as a processor. The employer (or the recruitment agency) is then the controller.

• We process application data solely on the employer's instructions.
• We enter into a data processing agreement with employers in accordance with Article 28 GDPR.
• Employers remain independently responsible for any further processing of applicant data outside SelectWiser.

6. Sharing data

We share personal data with third parties only where necessary to deliver our services, for security, or to comply with legal obligations. This includes:

Hosting and infrastructure

• Aiven (EU) or a comparable European database provider — hosting our databases and storing application data.
• Render Services, Inc. (US) — hosting backend services, workers and cron jobs.
• Vercel Inc. (US) — hosting our front end and technical logs.

AI analysis

• OpenAI (US) — analysis of application documents (such as CV and cover letter) to generate scores, summaries and insights.

We have contractually established that data is used only to carry out our instructions and not to train general-purpose models, unless this is explicitly and separately permitted.

Email and communication

• Resend / PLUS FIVE FIVE, Inc. (US) — sending system and transactional email (for example acknowledgements, status updates, invitations and rejections).
• Our business email and office environment (for example Google Workspace) — for general communication and customer service.

Payments

• Stripe Payments Europe Limited (IE) and the Stripe group — processing payments, invoicing and financial administration.

Other third parties

• Analytics and monitoring services for performance, security and error analysis
• Any accountants, legal advisers or other service providers who help us meet our obligations

With all these parties we enter into data processing agreements or equivalent contracts establishing that:

• personal data is treated confidentially
• appropriate security measures are taken
• data is processed only on our instructions and in accordance with the GDPR (insofar as they act as a processor)

Some parties (such as Stripe and certain hosting providers) also act as independent controllers for part of the processing, for example to meet their own legal obligations (such as anti-money-laundering law, tax obligations or security requirements). In those cases their own privacy statements apply as well.

We do not sell personal data to third parties.

7. AI processing and automated analysis

For detailed information about how SelectWiser uses AI and which safeguards are built in, see our AI Governance document.

SelectWiser uses AI technology for, among other things:

• Analysing application documents
• Summarising and structuring CVs and cover letters
• Generating scores and signals (such as technical match and how well the cover letter fits the role's requirements, based on textual content)

The analysis may qualify as profiling (for example scoring or signalling). Where appropriate we provide meaningful information about the logic involved and the expected consequences of such processing.

Outline of the analysis (summary)

• The analysis looks at (i) the presence of the requested skills and experience, (ii) supporting examples, (iii) how the cover letter fits the role's requirements, and (iv) inconsistencies or gaps in the text.
• The analysis is used to support decisions; no automatic rejection or invitation takes place (Article 22 GDPR).
• The analysis may influence prioritisation or the order of review, but it does not make decisions on its own.
• The analysis is indicative and may contain errors; the employer always weighs the outcome together with the original documents.

No decisions based solely on automated processing

Within SelectWiser no decisions are taken based solely on automated processing that produce legal effects or similarly significant effects for candidates. The AI provides advice; employers make the final decision themselves, for example on invitation, rejection or next steps (Article 22 GDPR).

Your rights in relation to AI analysis

Insofar as applicable, you have among others:

• The right to human intervention (from the employer)
• The right to express your point of view
• The right to contest a decision
• The right to object to AI analysis being used for your application

8. International data transfers

Our main servers and databases are located in the European Union.

Some of our service providers are located outside the European Economic Area (EEA) or process data outside the EEA, for example in the United States. This applies in particular to:

• OpenAI (US)
• Resend / PLUS FIVE FIVE, Inc. (US)
• Render Services, Inc. (US)
• Vercel Inc. (US)
• The Stripe group outside the EU (for certain payments and fraud prevention)
• Google (insofar as data in Google Workspace is processed outside the EEA)

When personal data is transferred to countries outside the EEA, we put appropriate safeguards in place in accordance with Chapter V of the GDPR. Per service provider we use one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and/or
• use of the EU–US Data Privacy Framework (DPF) or comparable adequacy decisions, and
• additional technical and organisational measures (such as encryption, access restriction and data minimisation).

Safeguards per service provider (overview)

A copy or overview of the relevant safeguards per service provider can be requested at privacy@selectwiser.com.

Contracts with these parties establish, among other things, that:

• personal data is not used to train general-purpose AI models, unless this is explicitly and separately permitted
• personal data is processed only to deliver the services we have requested
• appropriate security measures are applied

Where we have data processed outside the EEA, we do so only where necessary for our services and in accordance with the rules in Chapter V of the GDPR.

9. Retention periods

We do not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is legally required or permitted.

Application data (candidates)

• By default: up to 4 weeks after the application procedure has been completed.
• With the applicant's explicit consent (such as a talent pool): up to 12 months, for future vacancies.
• On withdrawal of consent: data is deleted (or anonymised) as soon as possible, insofar as we are able to act as a processor.
• On being hired: the employer becomes the controller; we remove the application data from our active system once the transfer is complete, save for limited logging and backup purposes.

Other data

• Invoicing and administrative data: 7 years (statutory retention obligation).
• Platform and security logs: usually up to 90 days, unless longer is needed to investigate incidents or abuse.
• Customer and company data (employers): for the duration of the contractual relationship plus any period required by law or contract (for example limitation periods).

After the retention periods expire we delete or anonymise data, unless we must keep it longer because of a legal obligation or a legitimate interest (for example in a legal dispute).

Our processors (such as hosting providers, email services and AI service providers) may keep certain log or system data slightly longer where necessary for their own legal obligations, security or fraud prevention. This always happens within the limits of the GDPR and our data processing agreements.

10. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. These measures include:

• Encrypted connections (TLS) for data transfer
• Encryption of data on our hosting providers' servers (encryption at rest)
• Restricted access rights to systems and data (need-to-know principle)
• Authentication and authorisation mechanisms
• Logging and monitoring of access attempts and system activity
• Regular updates of systems and security measures

Although we work towards a high level of security, complete security can never be guaranteed.

11. Information about minors

Our services are aimed primarily at applicants aged 16 and over.

We do not knowingly collect data from children under 16 without the involvement of a parent, guardian or employer.

If we discover that we have processed personal data of a child under 16 without a valid legal basis, we delete that data as soon as possible.

If you suspect that we have collected data about a minor without consent, please contact us at privacy@selectwiser.com.

12. Your privacy rights

Under the GDPR you have, insofar as applicable, the following rights:

• Right of access: you can request which personal data we process about you.
• Right to rectification: you can have inaccurate or incomplete data corrected.
• Right to erasure: you can request deletion of your personal data, for example when it is no longer needed.
• Right to restriction of processing: in certain cases you can ask for processing to be restricted, temporarily or otherwise.
• Right to object: you can object to processing based on legitimate interest or to direct marketing (Article 21 GDPR). Where we process on the basis of legitimate interest, you can always object.
• Right to data portability: you can request your data in a structured, commonly used and machine-readable format.
• Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time. This does not apply retroactively.
• Right to human review of AI analysis: you can ask the employer for a person to look at your situation, so that the decision is not based solely on AI analysis.

For requests or objections concerning the processing of application data (including the use of AI analysis), the employer is the primary point of contact as controller; SelectWiser supports the employer as a processor wherever reasonably possible (Article 28 GDPR).

For other processing where SelectWiser is itself the controller (such as account management and invoicing), you can contact us directly.

To exercise your rights you can send a request to privacy@selectwiser.com.

We normally respond within one month of receiving your request. This period can be extended if necessary, and we will inform you if it is.

13. Do Not Track signals

Our website does not currently respond to "Do Not Track" signals in browsers.

Please see our cookie statement for more information about how we use cookies and similar techniques.

14. Changes to this statement

We may update this privacy statement from time to time.

For significant changes we will communicate clearly, for example through our website or by email where appropriate. The "Last updated" date at the top of this statement is then adjusted.

15. Contact

16. Accessing or deleting your data

Would you like to access, change or delete your data? Send your request to privacy@selectwiser.com. Include enough information to identify you and to understand your request. We may ask for further information to prevent misuse.

Handling of requests: In accordance with the GDPR, erasure requests are handled within 30 days. If an employer does not respond in time to an applicant's erasure request, the request is approved automatically after 30 days and the personal data concerned is deleted. The applicant receives confirmation of this by email.

17. About this privacy statement

This privacy statement has been drawn up to meet the information obligations under the GDPR (including Article 13) and aligns with our AI governance framework. We also continuously assess compliance through internal procedures, contracts and security measures.

GDPR compliance depends not only on providing this information, but also on how we are actually set up (data processing agreements, DPIAs, logging, human intervention, security, contracts and internal procedures), in line with the accountability principle (Article 5 GDPR).