Privacy Policy

Introduction

Thank you for using CV Manager (the "Service", "Platform", "we", "us", or "our"). We are committed to protecting your privacy and personal data in full compliance with the EU General Data Protection Regulation ("GDPR") and applicable data protection laws.

This Privacy Policy explains how we collect, use, process, store, and protect your personal information when you apply for positions through our recruitment platform or use our services.

1. Data Controller Information

For the purposes of data protection legislation, the data controller responsible for your personal data is:

• Controller Name: CV Manager
• Legal Entity: [Company Legal Name]
• Registered Address: [Complete Address]
• Contact Email: privacy@cvmanager.tech
• Data Protection Officer: dpo@cvmanager.tech (if applicable)

If you have any questions or concerns about how we handle your personal data, please contact us using the details above.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide Directly

• Identification Information: Full name, date of birth, email address, phone number, postal address
• Professional Information: CV/resume, work history, employment references, educational qualifications, job positions of interest, language proficiencies
• Application Data: Information about restaurants/locations of interest, employment status, work experience details, professional references (name, position, company, contact details)
• Communication Data: Any comments, feedback, or information you provide during the recruitment process
• Documents: CV/resume files (PDF), profile pictures (optional)

2.2 Information We Collect Automatically

• Technical Data: IP address, browser type and version, device information, operating system
• Usage Data: Information about how you interact with our Service, pages visited, time spent on pages, access times
• Application Metadata: Application submission dates, state transition history, manager assignments

2.3 Special Categories of Personal Data

We do not intentionally collect special categories of personal data (sensitive data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless you voluntarily include such information in your CV or application materials. If you do provide such data, we will process it only with your explicit consent and in accordance with GDPR Article 9.

3. Legal Basis and Purposes for Processing

We process your personal data only where we have a lawful basis to do so:

4. Data Recipients and Disclosure

We may share your personal data with the following categories of recipients:

• Internal Recipients: HR personnel, hiring managers, restaurant managers, general managers, head chefs, and administrators who are involved in the recruitment process and have a legitimate need to access your information.
• Service Providers: Third-party service providers who process data on our behalf, including cloud hosting providers, email service providers, and IT support services. These providers are contractually bound to protect your data in accordance with GDPR Article 28.
• Professional Advisors: Lawyers, accountants, and other professional advisors when necessary for legal or business purposes.
• Legal Authorities: Law enforcement, regulatory bodies, or other authorities when required by law or to protect our legal rights.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

5. International Data Transfers

Your personal data is processed within the European Economic Area (EEA). If we transfer your data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries deemed to provide an adequate level of data protection by the European Commission
• Other legally recognized transfer mechanisms under GDPR Chapter V

You have the right to request information about the safeguards we have in place for international transfers by contacting us at privacy@cvmanager.tech.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy and to comply with our legal obligations:

• Active Applications: Data is retained for the duration of the recruitment process and for a reasonable period thereafter to defend against potential legal claims.
• Unsuccessful Applications: If you are not hired, we retain your data for up to 12 months after the completion of the recruitment process, unless you consent to remain in our talent pool for longer.
• Talent Pool: If you consent to join our talent pool, we retain your data for up to 24 months from your last interaction with us, or until you withdraw your consent.
• Hired Candidates: If you are hired, your application data becomes part of your employee records and is governed by our employee privacy policy.
• Legal Requirements: We may retain certain data for longer periods where required by law, such as for tax, accounting, or legal purposes.

After the retention period expires, we will securely delete or anonymize your personal data.

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data. These rights are not absolute and may be subject to certain limitations:

To exercise any of these rights, please contact us at:
Email: privacy@cvmanager.tech
Subject line: "GDPR Data Subject Request"

We will respond to your request within one month, or inform you if we need additional time (up to three months for complex requests). You will not be charged for exercising your rights unless your request is manifestly unfounded or excessive.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access controls and authentication mechanisms (role-based access control)
• Regular security assessments and updates
• Employee training on data protection and security practices
• Secure data storage with reputable cloud service providers
• Incident response and data breach notification procedures

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. If you become aware of any security incident, please notify us immediately at security@cvmanager.tech.

9. Automated Decision-Making and Profiling

We do not use fully automated decision-making or profiling that produces legal effects or similarly significantly affects you.

While we may use automated systems to help organize and manage applications (such as filtering by job position or location preferences), all final recruitment decisions are made by human recruiters and hiring managers who review applications individually.

If our practices change in the future, we will update this policy and obtain your explicit consent where required by law.

10. Cookies and Similar Technologies

Our Service uses essential cookies and similar tracking technologies to ensure proper functionality. These include:

• Essential Cookies: Required for authentication, session management, and security features
• Functional Cookies: Remember your preferences and settings

We do not use third-party advertising or tracking cookies without your explicit consent. You can control cookies through your browser settings, but please note that disabling essential cookies may affect the functionality of our Service.

11. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe we have collected data about a child under 16, please contact us immediately at privacy@cvmanager.tech, and we will take steps to delete such information.

12. Data Breach Notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33 and 34.

13. Updates to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational needs. The "Effective Date" and "Last Updated" dates at the top of this policy indicate when it was last revised.

If we make material changes that significantly affect your rights, we will notify you by email (if you have provided your email address) or by displaying a prominent notice on our Service before the changes take effect.

We encourage you to review this Privacy Policy regularly to stay informed about how we protect your personal data.

14. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

For a list of EU data protection authorities, please visit: https://edpb.europa.eu/about-edpb/board/members_en

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

We aim to respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, we may need additional time and will inform you accordingly.