Privacy Policy

1. Data Controller

The controller of your personal data is:

For all data protection enquiries, please contact us at kontakt@nexthire.pl with the subject line "Personal Data".

2. What Data We Process

Depending on how you interact with us, we process the following categories of data:

Job Applicants

• Name, contact details (phone, email)
• CV information: work history, education, skills, language proficiency
• Nationality, country of origin (where required by employment law)
• Any other data voluntarily provided in application documents

Clients (Employers)

• Contact details of company representatives (name, job title, email, phone)
• Business details (company name, address, tax ID)

Website Users

• IP address, browser type, operating system
• Analytics data (Google Analytics) — only after cookie consent
• Data submitted through contact forms

We do not process special categories of personal data (sensitive data) as defined in Article 9 GDPR, unless explicitly required and consented to.

3. Purposes & Legal Basis for Processing

We process your data only for specified, explicit and legitimate purposes, in accordance with Article 6 GDPR:

4. Retention Periods

We store your data for the time necessary to fulfil the purposes for which it was collected:

• Applicant data (active recruitment): for the duration of the process, then up to 12 months after completion or until consent is withdrawn
• Applicant data (talent database): up to 24 months from consent, or until consent is withdrawn
• Contact form data: up to 12 months after reply
• Client data: for the duration of the business relationship plus 3 years after termination (for legal claims)
• Analytics data (cookies): per Google Analytics policy — up to 14 months

After the above periods, data is permanently deleted or anonymised.

5. Recipients of Personal Data

Your data may be shared with the following categories of recipients:

• Client companies (employers): only to the extent necessary for recruitment, and only after candidate consent
• IT service providers: hosting and email providers — under data processing agreements only
• Google LLC (USA): via Google Analytics — data transferred under Standard Contractual Clauses (SCC) approved by the European Commission
• Public authorities: only when required by law

We do not sell or share personal data with third parties for marketing purposes.

6. Your Rights

As a data subject, you have the following rights under GDPR:

• Right of access (Art. 15): you can obtain confirmation of whether and what data we hold about you
• Right to rectification (Art. 16): you can request correction of inaccurate or incomplete data
• Right to erasure — "right to be forgotten" (Art. 17): you can request deletion when data is no longer necessary
• Right to restriction of processing (Art. 18): you can request restriction in certain circumstances
• Right to data portability (Art. 20): you can receive your data in a structured, commonly used format
• Right to object (Art. 21): you can object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise your rights, email kontakt@nexthire.pl with the subject "Personal Data". We will respond within 30 days.

7. Cookies & Tracking

Our website uses cookies — small text files stored in your browser. We use the following categories:

You can manage cookies through your browser settings or via the cookie consent banner shown on first visit. You may withdraw consent at any time by clearing your browser cookies.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction, including:

• SSL/TLS encryption (HTTPS) on all pages
• Access controls on data processing systems
• Regular data backups
• CSRF token protection on all forms
• Limited storage of uploaded CV files (retained only for the duration of recruitment)

9. Use of Artificial Intelligence

We use artificial intelligence (AI) tools at certain stages of the recruitment process to make it faster and more efficient. Below we explain where and how AI is used.

Where We Use AI

• CV analysis: submitted CVs are automatically analysed by an AI model (Anthropic Claude), which extracts experience, skills, and provides an initial assessment of fit for a role
• Sofia — AI voice assistant: selected candidates may receive a call from Sofia, our AI-powered recruitment assistant, who conducts an initial screening conversation
• Website chatbot: an AI assistant available in the chat window on nexthire.pl helps answer questions and start the application process

In accordance with Article 50 of the EU AI Act, we disclose at the point of interaction (e.g. in the chat window header) when you are talking to an AI system rather than a human.

A Human Always Makes the Final Decision

No recruitment decision (such as rejecting an application or advancing to the next stage) is made solely through automated means. The output of any AI analysis (CV score, summary of a call with Sofia) is always reviewed by a recruiter, who makes the final decision. We do not use automated decision-making within the meaning of Article 22 GDPR that produces legal effects without human involvement.

Your Rights Regarding AI

• You have the right to know the general logic of the AI tools we use and their role in the recruitment process
• You have the right to request human intervention and to express your point of view on any matter related to an AI-generated assessment
• You have the right to contest the outcome of an AI analysis by contacting us at kontakt@nexthire.pl

Under the EU Artificial Intelligence Act (AI Act), AI systems used in recruitment may be subject to additional requirements as "high-risk" systems. We are implementing appropriate oversight, documentation, and quality-control measures in line with the applicable implementation timelines for this legislation.

10. Changes to This Policy

We reserve the right to update this Privacy Policy. For any material changes, we will notify you by:

• Updating the "Last updated" date at the top of this page
• Displaying a prominent notice on the homepage for 30 days after the change

We encourage you to review this page periodically. Continued use of our services after changes constitutes acceptance.

11. Data Protection Contact

For all matters relating to personal data processing and the exercise of your rights, please contact us: