Roles and instructions

You decide which personal data of candidates, employees and your users is kept in HR CRM and why, and you are responsible for having a legal basis and for informing these people.

HR CRM processes this data only to provide the service and only on your instructions: the features your team uses and the settings it chooses. We do not use the data for our own purposes, do not sell it and do not show ads.

What is processed

People: candidates, employees and the users of your organization.

Data: names, contacts, CVs and documents, work history, notes, interviews and evaluations, offers, leave and survey records, messages sent through HR CRM, and the data the AI assistant extracts from Telegram chats if a team member connects it.

Processing: storage, search and display, sending the emails and messages your team starts, scheduling interviews, AI extraction of candidate data, backups.

Duration: while your organization's account exists, plus the deletion periods below.

Do not add data the purpose does not need — for example, diagnoses in sick-leave notes.

Confidentiality

Only the people who run and support HR CRM have access to its infrastructure, and they are bound by confidentiality. Nobody at HR CRM reads your records unless you ask us to for support, or it is needed for security or required by law.

Security measures

Traffic is encrypted with TLS.

Passwords are stored only as bcrypt hashes. Telegram sessions, Google tokens and job-board keys are encrypted with AES-256-GCM; the key is kept outside the database.

Every request is limited to the data of one organization; a query without an organization is rejected.

Two-factor sign-in with an authenticator app, limits on failed sign-in attempts, and an additional access gateway in front of the service administration.

An activity log of sign-ins and changes, available to your organization's head.

Daily database backups, kept for 14 days.

Sub-processors

HR CRM uses these providers to run the service: the hosting provider of our servers; Cloudflare (network, TLS, protection against attacks); Resend (system emails: email confirmation and password reset); Anthropic (AI models — only if a team member connects the Telegram AI assistant; Anthropic does not use this data to train models).

Each provider receives only the data it needs for its task and processes it under its own data processing terms. Some providers are located outside Ukraine and the EU.

Google and Telegram accounts that your team connects are your own services: HR CRM works with them on your instructions.

We publish changes to this list on this page with a new date. If you disagree with a change, you can download your data and delete your organization.

Requests from people and incidents

Your team can view, correct, export (to Excel or as the full archive) and delete records in the app at any time. If a candidate or employee writes to us directly, we forward the request to you.

If we become aware of a breach affecting your data, we notify the owner of your organization by email without undue delay and no later than 72 hours, with what we know and what we are doing about it.

End of use and deletion

The organization owner can download all data with every CV and document in Settings → General, and delete the organization there. Deletion takes effect immediately: records, files and users are removed, and Telegram and Google connections are revoked.

Copies in backups are overwritten within 14 days. Payment records are kept as the law requires.

Compliance

On request to [email protected] we provide the information needed to show that this DPA is followed. This DPA is written to cover the processor obligations of Article 28 GDPR and of the Law of Ukraine “On Personal Data Protection”.

Contact

Questions about this agreement: [email protected].