HRGates ("we," "us," or "our") operates the SaaS AI Interviewer platform and the website located at www.hrgates.com. We are committed to protecting the privacy, dignity, and personal data of our corporate customers ("Customers"), their system administrators ("Users"), and the job applicants undergoing evaluation ("Candidates").

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our Services. It has been meticulously structured to comply with the European Union General Data Protection Regulation (GDPR), the EU AI Act, and applicable global data protection frameworks.

1. Important Role Declarations (Data Controller vs. Data Processor)
To ensure regulatory clarity under the GDPR:
HRGates as a Data Controller: We act as a Data Controller for the personal data of our corporate Customers and Users (e.g., customer account details, billing info, marketing interactions, and website usage logs).
HRGates as a Data Processor: When providing our AI Interviewer services, we process Candidate personal data (e.g., video recordings, audio transcripts, resumes, and evaluation scores) strictly on behalf of and under the instructions of our Customers. The Customer is the Data Controller for Candidate data and is responsible for managing Candidate consent and data subject rights.

2. Categories of Data We Collect
A. Customer and User Data (Data Controller Context)
Identity & Contact Info: Name, business email address, phone number, job title, and company name.
Account Credentials: Usernames, encrypted passwords, and security tokens.
Financial & Transactional Data: Billing address, credit card fragments, or bank account details handled via secure, PCI-compliant third-party payment processors.

B. Candidate Data (Data Processor Context)
Application Data: Resumes, CVs, cover letters, and professional profiles uploaded by the Candidate or imported by the Customer.
Biometric & Multimedia Data: Video recordings, audio captures, and structural image frames generated during the AI interview process.
Text & Transcript Data: Verbatim transcripts of verbal responses and written text inputs from the interview questions.
AI-Generated Evaluation Metadata: Analytical outputs, behavioral indexing, scoring metrics, communication proficiency indicators, and feedback summaries compiled by our AI algorithms.

C. Technical and Analytics Data
IP addresses, device metadata, browser type, operating system version, and system event logs (e.g., timestamps of completed interviews).

3. Lawful Bases for Processing (GDPR Article 6 & 9)
We only process personal data when there is a legitimate, lawful basis to do so:
Performance of a Contract: Processing is necessary to fulfill our contractual obligations to our Customers or to execute requested actions prior to entering a contract.
Explicit Consent: For Candidate evaluation, especially involving video/audio analysis and automated assessment, processing relies on the explicit, freely given, informed, and unambiguous consent obtained by the Data Controller (Customer) from the Candidate.
Legitimate Interests: For running security protocols, detecting fraud, conducting internal billing, and monitoring platform technical stability.
Legal Compliance: For fulfilling regulatory reporting, tax obligations, or law enforcement mandates.

4. Specific Disclosures and Compliance Under the EU AI Act
The HRGates AI Interviewer utilizes sophisticated artificial intelligence models to screen and assess candidates. Under the EU AI Act, AI systems used in recruitment, workforce management, and candidate evaluation are categorized as High-Risk AI Systems. We fully comply with the rigorous demands associated with this classification:

A. Non-Discriminatory Design & Bias Mitigation
Our AI models are subjected to strict bias evaluation and testing routines. We regularly audit our natural language processing (NLP) and evaluation models to prevent algorithmic discrimination based on gender, race, accent, age, or socioeconomic variables.

B. Transparency and Notice (EU AI Act Article 52)
Candidates must be explicitly informed that they are interacting with an AI system. The interface will clearly display a disclosure notice prior to commencing any assessment session.

C. Human Oversight
The platform does not issue final, legally binding rejections or employment assignments autonomously. The tool generates analytical insights to optimize human decision-making. Customers are contractually obligated to maintain human oversight over all recruitment funnels.

D. Technical Documentation & Risk Management
HRGates maintains comprehensive log archives, version-control histories, and risk mitigation profiles for its AI models to comply with conformity assessment protocols mandated by European supervisory authorities.

5. Data Sharing and Sub-processors
We do not sell, rent, or trade personal data to third-party brokers. We share data only with authorized service providers (Sub-processors) who assist us in delivering the platform, subject to strict Data Processing Agreements (DPAs):
Cloud Infrastructure Hosting: Secure cloud server environments located within the European Economic Area (EEA) to ensure regional data sovereignty.
Transcription/NLP Engines: Specialized API utilities used to process audio transcripts under localized zero-data retention pipelines.
Billing/Payment Gateways: Secure merchant processors for corporate subscriptions.
All Sub-processors are stringently vetted to verify they enforce equivalent technical and organizational security standards.

6. International Data Transfers
While our primary data storage infrastructure is deployed within the European Economic Area (EEA), any cross-border transfer of data outside the EEA to third countries will only be executed via legally recognized mechanisms:
Countries recognized by the European Commission as providing an Adequate Level of data protection.
The implementation of the European Commission’s Standard Contractual Clauses (SCCs) alongside robust supplementary technical measures.

7. Data Security Measures
HRGates employs enterprise-grade technical and organizational security measures designed to safeguard data against accidental loss, unauthorized access, destruction, or disclosure:
Encryption: Data is encrypted at rest using industry-standard AES-256 frameworks and in transit via TLS 1.3 encryption protocols.
Access Controls: Strict Role-Based Access Control (RBAC) protocols limit employee data access to a strict need-to-know basis.
Vulnerability Assessments: Periodic penetration testing, code reviews, and threat monitoring cycles are conducted routinely.

8. Data Retention Policies
Customer Account Data: Kept for the duration of the active business relationship and deleted within a maximum of 12 months post-termination, except for records required for tax or audit compliance.
Candidate Data: Candidate profiles, videos, and AI assessment metrics are retained for a period determined by the Customer (Data Controller), typically matching the active duration of the recruitment cycle. Once the retention period expires, or upon explicit request by the Customer, Candidate data is completely purged or permanently anonymized.

9. Your Data Subject Rights (GDPR Rights)
As a Data Subject under the GDPR, you possess specific, legally enforceable rights regarding your personal information.
Candidate Note: If you are a Candidate whose data was collected during an interview hosted via HRGates, you must submit your rights requests directly to the Employer/Recruiter (the Data Controller) who invited you to the interview. If you contact us directly, we will forward your request to the appropriate Data Controller.

Your rights include:
- Right of Access: Request a comprehensive copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate, incomplete, or out-of-date personal data.
- Right to Erasure ("Right to be Forgotten"): Request that your personal data be permanently deleted from our active production systems.
- Right to Restrict Processing: Request limitation of data processing activities under certain disputed conditions.
- Right to Data Portability: Obtain a structured, machine-readable digital file containing your personal data to transmit to another service provider.
- Right to Object: Object to processing based on our legitimate interest pathways or direct marketing channels.
- Right to Withdraw Consent: Where processing is based entirely on consent, you maintain the right to withdraw that consent at any time without retroactive penalty.
- Right to Lodge a Complaint: You maintain the right to file a formal grievance with a recognized Data Protection Authority (DPA) within your jurisdiction.

10. Contact Our Privacy Team
If you have questions, comments, or wish to exercise your data protection rights, please contact our Data Protection Office:
Email: legal@hrgates.com or use the contact form below.