Privacy Policy

This Privacy Policy explains how Correct Context sp. z o.o. ("we", "us", "our") collects, uses, stores, and protects personal data when you use the Ceevee platform ("Service").

1. Data Controller

The data controller for the Service is:

• Company: Correct Context sp. z o.o.
• KRS: 0000699600
• NIP: 9532727782
• REGON: 368514828
• Address: ul. Joachima Lelewela 27, 85-652 Bydgoszcz, Poland
• Contact: duke.vu@correctcontext.com

2. Data We Collect

Account Data

When you register, we collect:

• Full name and email address
• Organization name and details
• Password (stored securely hashed)
• User role within the organization

Usage Data

We automatically collect:

• Pages visited, features used, and actions taken within the Service
• Browser type, device information, and IP address
• Usage statistics (e.g., number of CV scans, candidates added)

Candidate Data

When you upload CVs or receive applications through the job portal, we process candidate personal data on your behalf. This may include:

• Name, email, phone number, and address
• Work experience, education, and skills
• Assessment results and personality profiles
• CV documents and attachments

3. How We Use Your Data

We use the data we collect to:

• Provide, maintain, and improve the Service
• Process CV scans and generate AI-powered candidate insights
• Manage your account and enforce usage limits
• Send transactional emails (account confirmations, notifications)
• Provide customer support
• Detect fraud and ensure platform security
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process personal data based on the following legal grounds:

• Contract performance: Processing necessary to provide the Service (Article 6(1)(b) GDPR)
• Legitimate interest: Improving the Service, security, and analytics (Article 6(1)(f) GDPR)
• Legal obligation: Compliance with applicable laws (Article 6(1)(c) GDPR)
• Consent: Where required, such as for marketing communications (Article 6(1)(a) GDPR)

5. Candidate Data & Data Processor Role

When you upload candidate information to the Platform, you act as the data controller for that candidate data, and we act as the data processor. This means:

• You are responsible for having a lawful basis to collect and process candidate data
• You must ensure candidates are informed about how their data is used
• We process candidate data only on your instructions and for the purpose of providing the Service
• We do not use candidate data for our own purposes or sell it to third parties

If you require a formal Data Processing Agreement (DPA), please contact us at duke.vu@correctcontext.com.

6. AI Processing

The Service uses artificial intelligence to scan CVs, extract candidate information, and generate assessment profiles. When AI processes personal data:

• Data is sent to our AI processing partners (Anthropic) in encrypted form
• AI outputs are suggestions and should be reviewed by a human before making hiring decisions
• We do not use your data to train third-party AI models
• AI processing is subject to the same data protection standards as all other processing

7. Data Sharing

We share personal data only with:

• Infrastructure providers: Supabase (database and authentication), Vercel (hosting) — both with appropriate data processing agreements
• AI providers: Anthropic — for CV scanning and assessment processing
• Email providers: For sending transactional notifications
• Legal authorities: When required by law or to protect our rights

We do not sell personal data to third parties.

8. Data Storage & Security

Your data is stored securely using industry-standard measures:

• Data is stored in EU-based data centers where possible
• All data in transit is encrypted using TLS
• Database access is restricted with row-level security policies
• Passwords are hashed and never stored in plain text
• Access to production systems is limited to authorized personnel

9. Data Retention

• Account data: Retained while your account is active and for 30 days after deletion
• Candidate data: Retained as long as your account is active; deleted within 30 days of account termination
• Usage logs: Retained for up to 12 months for security and analytics
• Backups: Removed within 90 days of data deletion

10. Your Rights (GDPR)

As a data subject under GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request limitation of processing in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent

To exercise any of these rights, contact us at duke.vu@correctcontext.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

11. Cookies

We use cookies and similar technologies for:

• Essential cookies: Required for authentication and core functionality
• Analytics cookies: To understand how the Service is used and improve it

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

12. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will take steps to delete it.

13. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact

For any privacy-related questions or requests, please contact us:

• Email: duke.vu@correctcontext.com
• Address: Correct Context sp. z o.o., ul. Joachima Lelewela 27, 85-652 Bydgoszcz, Poland