Privacy Policy

1. Data controller

2. Data collected

2.1 Recruiter account data

• Identity: last name, first name, title;
• Contact details: professional email address, phone number (optional);
• Credentials: password (stored in hashed form), authentication tokens;
• Professional data: company name, job title, size, sector of activity (optional);
• Preferences: language, time zone, notification settings.

2.2 Billing data

• Billing details: company name, address, VAT number;
• Billing history: invoices, amounts, dates, subscribed plans;
• Payment data: we never store your banking details. They are processed directly by our provider Stripe Payments Europe Limited, established in Ireland.

2.3 Connection and usage data

• IP address, device type, browser type, operating system;
• Connection logs (date, time, duration);
• Usage data: actions performed within the Platform, positions created, number of analyses, features used.

2.4 Data relating to communications

• Communications with our customer support (emails, tickets);
• Responses to satisfaction surveys if you take part in them;
• Newsletter subscriptions (with your explicit consent).

2.5 Cookies

See the Cookie Policy.

3. Purposes and legal bases

Legitimate interest is assessed by balancing the Client's reasonable expectations against the benefits for PreHire and the other users of the Platform. You may object at any time to processing based on legitimate interest (see article 8).

4. Retention periods

At the end of the periods above, the data is deleted or irreversibly anonymized.

When a Recruiter uses PreHire as part of a free trial period, the data of invited Candidates is processed under the same conditions as for a subscribed account. In the absence of a subscription at the end of the trial, this data is deleted within the time frames indicated above: interview videos within 30 days, analysis results and associated data within 12 months at the latest, with the starting point being the end of the trial period.

5. Recipients

The data is accessible, within the limits of their duties, to:

• The teams of Reach Technologies SAS (technical, support, sales, legal, accounting);
• PreHire's technical processors (hosting, payment, emailing, analytics) – detailed list: List of processors;
• Administrative or judicial authorities in the event of a legitimate request.

The data is never sold to third parties or used for advertising purposes outside the platform.

6. Processors and transfers outside the EU

PreHire relies on processors to provide the Services. The complete and up-to-date list is published on the website.

Some processors may be established outside the European Union, in particular in the United States. In such cases, PreHire governs the transfers through the mechanisms provided for by the GDPR:

• Adequacy decision of the European Commission (Data Privacy Framework for transfers to the United States);
• Failing that, signature of the Standard Contractual Clauses (SCCs) adopted by the European Commission on 4 June 2021;
• Additional technical and organizational measures where necessary (encryption, pseudonymization, access controls).

You may obtain a copy of the applicable safeguards by writing to dpo@pre-hire.com.

7. Security

PreHire implements appropriate technical and organizational measures to ensure the confidentiality, integrity and availability of the data:

• encryption of communications via TLS on all exchanges;
• encryption of data at rest by the hosting layer;
• hashing of passwords using a proven cryptographic function, with a unique salt per record;
• role-based access control, principle of least privilege;
• logging of connections and sensitive operations;
• regular backups of the databases;
• regular updating of dependencies and application of security patches;
• periodic internal reviews of the security posture.

In the event of a data breach likely to result in a risk to the rights and freedoms of the data subjects, PreHire notifies the CNIL within seventy-two (72) hours and informs the data subjects when the risk is high, in accordance with articles 33 and 34 of the GDPR.

8. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access, rectification, erasure, restriction, and portability;
• Right to object to processing based on legitimate interest or for direct marketing purposes;
• Right to withdraw your consent at any time;
• Right to set directives regarding the fate of your data after your death.

To exercise these rights: privacy@pre-hire.com or by post to the registered office address, for the attention of the DPO. Proof of identity may be requested in the event of reasonable doubt.

We respond within one (1) month, which may be extended by two (2) months in case of complexity.

If you consider that your rights are not being respected, you may lodge a complaint with the CNIL: www.cnil.fr.

9. Profiling and automated decision-making (concerning the recruiter account)

The artificial intelligence features of the Platform apply to Candidate data, and not to the Recruiter's personal data. The Recruiter account is not subject to any automated decision producing legal effects or significantly affecting the holder within the meaning of article 22 of the GDPR.

10. Minors

The Platform is not intended for minors. PreHire does not knowingly collect personal data relating to minors. If you are a parent or guardian and you discover that a minor has provided personal data, contact privacy@pre-hire.com to obtain its deletion.

11. Changes to the policy

PreHire may amend this Policy to reflect a change in legislation, case law or practices. Substantial changes are notified by email with reasonable notice. The date of the last update appears at the top of the document.

12. Contact

• DPO: dpo@pre-hire.com
• Privacy: privacy@pre-hire.com
• Support: support@pre-hire.com
• Phone: +33 9 80 40 06 22