Privacy Policy
Learn how HireNix ATS safeguards candidate records, manages enterprise tenant isolation, and complies with GDPR, CCPA, and global data privacy standards.
Zero AI Model Training
Resumes are processed ephemerally and never used to train public AI foundational models.
Row-Level Security
Strict PostgreSQL multi-tenant isolation ensures data is permanently sandboxed per workspace.
1-Click PII Scrubbing
Instant Right to Erasure execution across all active databases and cloud storage buckets.
Introduction & Scope of Policy
Babylon Resources Limited, operating the HireNix ATS platform ("Company", "we", "our", or "us"), is committed to the highest global benchmarks of personal data privacy, cryptographic security, and regulatory compliance.
This Privacy Policy articulates our practices regarding the collection, transmission, storage, processing, and disclosure of personal data across:
- The HireNix ATS Cloud Platform, recruiter portals, and administrative dashboards;
- Candidate-Facing Portals, including Public Job Application Pages, Online Examination & Proctoring Suites, Interview Scheduling & Reschedule Request Portals, and Digital Offer Letter Acceptance Pages;
- Embedded Career Page Widgets integrated onto our Customers' websites; and
- Marketing websites, sales inquiry channels, and customer support ticketing interfaces.
Statutory Legal Roles: Controller vs. Processor
Under the EU General Data Protection Regulation (GDPR Regulation (EU) 2016/679 ), the UK Data Protection Act, the California Consumer Privacy Act (CCPA / CPRA ), and international privacy frameworks:
The employers, staffing agencies, or corporate entities utilizing HireNix ATS act as Data Controllers. You determine the lawful basis for collecting candidate data, specify hiring criteria, conduct candidate communications, and decide when applicant profiles should be archived or purged.
We act as the Data Processor under GDPR Art. 28. We provide the multi-tenant SaaS infrastructure, resume parsing models, proctored assessment environments, calendar pipelines, and encryption systems to execute your hiring instructions strictly on your organization's behalf.
Categories of Data We Collect & Process
3.1 Information from Customers & Authorized Users
When Customer provisions an organization Workspace or invites team members:
- Account & Identity Data: Full name, professional work email, telephone number, job title, and organization department.
- Authentication Credentials: Passwords (salted and hashed using bcrypt) or OAuth 2.0 / SSO tokens (Google Workspace, Microsoft Entra ID).
- Billing & Corporate Metadata: Company name, registered address, VAT/tax IDs, and payment transaction tokens (processed securely through PCI-DSS certified gateways including SSLCommerz).
3.2 Information from Job Applicants & Candidates
When candidates apply or participate in recruitment workflows:
- Application Documents: Resumes, CVs, cover letters, portfolios, certifications, and educational credentials.
- Parsed AI Attributes: Skills, previous employer history, tenure length, language proficiency, and calculated JD Match Scores (0–100).
- Assessment & Proctoring Telemetry: Online exam answers, code submissions, test completion times, focus-loss strike events, and fullscreen toggle timestamps.
- Evaluation & Interview Records: Panel scorecard grades (1–4 scale), interviewer notes, live candidate chat logs, and interview audio/video recordings (where authorized).
- Reschedule Request Data: Candidate-submitted reschedule justifications (e.g., medical, scheduling conflict) and proposed counter-time slots.
- Offer Letter Metadata: Salary acceptance, digital confirmation tokens, IP address, and timestamp records.
- Voluntary EEO Demographics: Anonymous demographic markers collected solely for compliance reporting, strictly decoupled from candidate evaluation cards.
Lawful Bases for Processing
Under Article 6 of the GDPR , we process personal data strictly under valid statutory legal justifications:
- Contractual Performance (Art. 6(1)(b) ): Delivering the ATS platform, authenticating user accounts, routing job applications, and processing subscription invoices.
- Legitimate Interests (Art. 6(1)(f) ): Mitigating recruitment fraud, safeguarding multi-tenant database isolation, preventing unauthorized proctoring circumvention, and diagnosing platform latency.
- Explicit Consent (Art. 6(1)(a) ): Administering online assessments, recording interviews, or processing candidate applications where mandated by local statutes.
- Legal Compliance (Art. 6(1)(c) ): Fulfilling statutory tax accounting, audit logging, and lawful subpoena obligations.
AI Trust Engine & Zero-Retention Guarantee
HireNix ATS integrates enterprise AI models to compute semantic match scores, generate resume highlights, and draft interview questions. We enforce ironclad data isolation agreements with our enterprise AI sub-processors:
Candidate resumes and criteria prompts transmitted to our enterprise AI endpoints are processed ephemerally in-memory and permanently discarded immediately following score computation.
Candidate Portals & Reschedule Request Privacy
When candidates interact with HireNix self-service features—such as viewing interview invitations, requesting reschedule time slots, completing exams, or accepting digital offers:
- No Advertising Trackers: We never embed third-party advertising pixels, marketing cookies, or behavioral trackers on candidate-facing portals.
- Cryptographic Access Tokens: Candidate portals are accessed via single-use, time-delimited cryptographic tokens transmitted securely via email, preventing unauthorized public indexing.
- Confidential Reschedule Justifications: Candidate reasons for interview rescheduling are accessible strictly to the assigned interview panel and hiring managers for that specific job requisition.
Sub-processors & International Transfers
HireNix ATS partners exclusively with SOC-2 Type II and ISO-27001 certified cloud infrastructure vendors:
- Cloud Hosting & Storage:AWS (Amazon Web Services) & GCP (Google Cloud Platform) data centers featuring 24/7 biometric physical security.
- Payment Processing:SSLCommerz gateway providing encrypted PCI-DSS Level 1 compliance for card and electronic payments.
- Standard Contractual Clauses (SCCs) :All cross-border data transfers outside the European Economic Area (EEA) are governed by European Commission Standard Contractual Clauses.
Technical & Organizational Security (GDPR Art. 32 )
- Encryption Standards: AES-256 block-level encryption for all data at rest and TLS 1.3 cryptographic protocols for data in transit.
- Strict Tenant Partitioning: Logical Row-Level Security (RLS) guarantees that organizational data cannot be accessed across tenant boundaries.
- Role-Based Access Control (RBAC): Granular permissions enforce that Interviewers cannot access billing records or modify candidate hiring statuses.
- 72-Hour Breach Notification: Robust incident response protocol ensuring prompt statutory notification to Controllers within 72 hours of any verified security incident under GDPR Art. 33.
Candidate Data Subject Rights & Erasure (GDPR Chapter III )
Candidates in the EEA, UK, California, and other jurisdictions enjoy statutory rights over their personal data:
Right to Access & Portability (Art. 15 & 20)
Export complete machine-readable (JSON/CSV) profiles including parsed resumes and scorecard logs.
Right to Erasure (Art. 17 PII Scrubbing)
Permanent cryptographic purge of names, contact details, and resume files across all storage buckets.
Right to Rectification (Art. 16)
Recruiters can correct inaccurate candidate records or update contact credentials upon candidate request.
Right to Object & Restrict (Art. 18 & 21)
Candidates may withdraw consent for AI-assisted scoring or automated screening questionnaires at any time.
Note for Candidates: Because HireNix ATS operates as a Data Processor, candidate data requests should be addressed directly to the hiring company (the Data Controller). We provide controllers with 1-click automated tools to fulfill these requests immediately.
Data Retention & Workspace Purge Schedules
- Custom Retention Rules: Customers may define automated retention thresholds per job or department (e.g., automatically scrubbing rejected candidate resumes after 12 months in accordance with GDPR Art. 5(1)(e)).
- Post-Subscription Retention: Following workspace cancellation, candidate data is preserved in a frozen state for thirty (30) days for export, after which it is permanently purged.
Data Protection Officer (DPO) & Privacy Team
If you have inquiries regarding our GDPR compliance, sub-processor agreements, or wish to exercise candidate data subject rights, please contact our DPO.