GDPR

For website visitors, enquiries and our own accounts, Recrix is the controller. When a client company sends us candidates to interview, the client is the controller and Recrix acts as its processor, processing candidate data only on the client's documented instructions. A Data Processing Agreement (DPA) is available to clients on request.

• Contract: delivering interviews and reports to clients, and managing interviewer engagements.
• Legitimate interests: responding to business enquiries, platform security and interview integrity monitoring.
• Consent: non-essential analytics and marketing emails. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or disclose data.

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to processing, including profiling;
• data portability in a machine-readable format;
• withdraw consent at any time;
• not be subject to a decision based solely on automated processing. Recrix interview reports are written by human interviewers, and hiring decisions are made by the client.

Email info@recrix.com with the subject “GDPR request”. We respond within one month. If we process your data on behalf of a client, we will forward your request to them and help them respond.

Recrix is based in India and some of our providers operate in the US and other countries. Where personal data leaves the EEA or UK, we rely on Standard Contractual Clauses or equivalent safeguards offered by our providers.

Vercel (hosting and analytics), Convex (database), Clerk (authentication), Stream (video and recordings), Resend (email), FormSubmit (form relay) and Google (Analytics). Clients can ask for the current list and be notified of changes.

We keep personal data only as long as needed for the purposes above or as instructed by the client controller, then delete or anonymise it. Data is encrypted in transit, access is role-restricted, and personal data breaches are reported to the controller and, where required, the supervisory authority within 72 hours.

You can complain to the data protection authority in your country of residence. We would appreciate the chance to resolve your concern first.