Juridique
Politique de confidentialité
HCIA – Human Capital Intelligence Agent Website: hcia.ai Last Updated: May 31, 2026
1. Who We Are
HCIA – Human Capital Intelligence Agent (referred to as "we", "us", or "our") operates hcia.ai, a platform connecting recruiters and job candidates using AI-assisted hiring tools.
Data Controller: HCIA – Human Capital Intelligence Agent Zone franche d'Ajman, sous Eliqua F.Z.E, licence numéro 19584, adresse B.C. 1303067, Ajman Contact our legal team
Data Protection Officer (DPO): [If applicable: Name and contact details of your DPO. If not required, state: "We have assessed our processing activities and determined that the formal appointment of a Data Protection Officer is not required under Article 37 GDPR at this time. For all data protection enquiries, please use our legal contact form."]
2. What Information We Collect
Information You Provide to Us
For Recruiters:
- Full name and email address
- Company name and number of employees
- Account credentials and profile information
- Messages and communications sent to us
For Candidates:
- Full name, email address, and phone number
- CV / Résumé
- Responses to recruiter questionnaires, which may include current salary, expected salary, work history, qualifications, or any other questions a recruiter chooses to submit
- Messages and communications sent to us
Note on Special Category Data: Some information candidates provide — for example within a CV or questionnaire — may constitute special category data under Article 9 GDPR (e.g., health information, disability, or other sensitive characteristics). We process such data only where strictly necessary and in accordance with applicable law. We recommend that recruiters limit questionnaire questions to what is lawfully necessary and proportionate for the role.
Information Automatically Collected
When you use our platform, we automatically collect:
- IP address
- Browser type and version
- Device identifiers
- Pages visited, time spent on those pages, and referring URLs
- Cookies and similar tracking technologies (see Section 8)
Information Received from Third Parties
We may receive personal data about you from third parties, including:
- Social media login providers (e.g., LinkedIn, Google) — when you use a third-party login
- Analytics providers — aggregated or pseudonymous usage data
- Payment processors — transaction confirmation data
Where we receive data about you from a third party, we will inform you of the source and whether that source is publicly accessible, to the extent required by law.
3. How We Use Your Information
We use the information we collect for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account; matching candidates to recruiter requirements | Contract performance (Art. 6(1)(b)) |
| Processing payments for recruiter subscriptions | Contract performance (Art. 6(1)(b)) |
| Responding to support requests and enquiries | Contract performance / Legitimate interests |
| Sending essential service notifications (e.g. account changes, security alerts) | Contract performance (Art. 6(1)(b)) |
| Sending marketing communications and product updates | Consent (Art. 6(1)(a)) |
| Security monitoring, fraud prevention, and platform integrity | Legitimate interests (Art. 6(1)(f)) |
| Analytics and platform improvement | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Legal Basis for Processing
We rely on the following lawful bases under the GDPR:
Contract Performance (Art. 6(1)(b))
Processing necessary to provide the services you have requested — including operating recruiter and candidate accounts, facilitating hiring workflows, and managing subscriptions.
Legitimate Interests (Art. 6(1)(f))
We process certain data based on our legitimate interests, which include:
- Platform security and fraud prevention – protecting users and the platform from unauthorised access and misuse
- Analytics and service improvement – understanding how the platform is used to make it better
- Direct marketing to existing users – where we have an existing relationship and you have not opted out
We have assessed these interests and determined they do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 7).
Consent (Art. 6(1)(a))
Where we rely on your consent — for example for optional cookies or email marketing — you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Legal Obligation (Art. 6(1)(c))
Where we are required to process data to comply with applicable laws or respond to lawful requests from authorities.
5. Automated Decision-Making and Profiling
HCIA uses AI-assisted tools to help recruiters identify and rank candidates based on professional suitability.
How We Protect Your Privacy in AI Processing
Before any CV or questionnaire response is submitted to our AI models, all directly identifying personal information is stripped out. This includes, but is not limited to:
- Full name
- Phone number
- Email address
- Home address
- Any other directly identifying details
Only professional and skills-related content — such as work experience, qualifications, and role-relevant answers — is processed by the AI. This means our AI evaluates candidates on merit, not identity, and your PII is never exposed to the AI layer.
What This Means for You
The AI may generate suitability scores or rankings based on the de-identified content of your CV and questionnaire responses. Where this processing has a significant effect on whether your profile is surfaced to a recruiter, you have the right under Article 22 GDPR to:
- Request human review of the automated assessment
- Express your point of view
- Contest the outcome
To exercise these rights, contact us through our legal contact form.
We do not make fully automated final hiring decisions. All AI-generated outputs are reviewed by the recruiter before any hiring action is taken.
6. Sharing Your Information
We do not sell your personal data.
We may share your information with:
- Service providers – third parties who assist with hosting, infrastructure, payment processing, and analytics, acting as data processors under written agreements
- Recruiters – candidate data is shared with the relevant recruiter(s) on the platform as part of the core service
- Legal and regulatory authorities – when required by applicable law, court order, or regulatory request
We do not share your personal data with advertising networks or unrelated third-party business partners.
7. Data Retention
We retain your personal data for as long as your account is active and thereafter for the following periods, or as otherwise required to comply with legal obligations, resolve disputes, or enforce agreements:
| Data Type | Retention Period |
|---|---|
| Active account data (recruiter and candidate) | Duration of account + 24 months after closure |
| CV and questionnaire responses | Duration of recruiter engagement + 12 months |
| Transaction / billing records | 7 years (legal/tax compliance) |
| Support communications | 3 years |
| Analytics and log data | 12 months |
You may request deletion of your data at any time (see Section 8). Where deletion is requested, we will comply unless retention is required by law.
8. Your Rights
Depending on your location — and in particular if you are in the EEA, UK, or Switzerland — you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your personal data ("right to be forgotten") |
| Restriction | Request that we restrict processing in certain circumstances |
| Data portability | Receive your data in a structured, machine-readable format |
| Object to processing | Object to processing based on legitimate interests or for direct marketing purposes |
| Object to direct marketing | You have the specific right to object at any time to processing of your data for direct marketing, including profiling for that purpose. We will stop immediately upon request. |
| Withdraw consent | Withdraw consent at any time, without affecting prior processing |
| Automated decision-making | Request human review of automated decisions (see Section 5) |
| Lodge a complaint | File a complaint with your local data protection authority |
Obligation to provide data: Providing certain personal data is necessary to use HCIA's services. For candidates, this includes basic contact information and a CV. For recruiters, this includes name, company, and contact details. If you choose not to provide required data, we may not be able to provide the relevant service.
To exercise your rights, contact us through our legal contact form. We will respond within 30 days (which may be extended by a further 60 days for complex requests, with notice).
EU/EEA users may also lodge a complaint with the supervisory authority in their Member State of residence. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
9. Cookies
We use the following types of cookies:
| Type | Purpose |
|---|---|
| Essential | Required for the platform to function (cannot be disabled) |
| Functional | Remember your preferences and personalise your experience |
| Analytics | Help us understand how the platform is used (e.g. Google Analytics) |
We obtain your consent before placing non-essential cookies. You can manage or withdraw your preferences at any time through:
- Our cookie consent banner
- Your browser settings
For full details on the cookies we use, please see our Cookie Policy.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS/HTTPS)
- Access controls and authentication requirements
- Regular security assessments
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.
However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
11. Children's Privacy
Our platform is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 16 without appropriate consent, we will delete it promptly.
If you believe a child has provided us with personal data, please contact us through our legal contact form.
12. International Data Transfers
HCIA is operated from the United Arab Emirates (UAE). Our platform is accessible globally, including to users in the European Economic Area (EEA), United Kingdom, and Switzerland.
When your personal data is transferred outside the EEA or UK to a country that does not benefit from an adequacy decision, we rely on appropriate safeguards to protect your data, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreements (IDTAs) where applicable
You may request a copy of the relevant safeguards through our legal contact form.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will:
- Post the updated policy on this page
- Update the "Last Updated" date at the top of this document
- Notify you of material changes via email or a prominent notice on the platform
We encourage you to review this policy periodically.
For any questions about this Privacy Policy, please use our legal contact form.
Des questions sur cette politique ? Contactez notre équipe juridique.