Privacy Policy — Correct Context Sp. z o.o. Job Portal

Correct Context Sp. z o.o. is the data controller for all personal data submitted through this Portal. Correct Context Sp. z o.o. determines the purposes and means of processing your personal data and is the entity to whom you must address all GDPR / RODO requests — access, rectification, erasure, portability, objection, restriction of processing, and withdrawal of consent.

Correct Context sp. z o.o. (KRS 0000699600, NIP 9532727782, REGON 368514828, ul. Joachima Lelewela 27, 85-652 Bydgoszcz, Poland) provides the Ceevee recruitment software that hosts this Portal and acts solely as a data processor on behalf of Correct Context Sp. z o.o. under Article 28 GDPR. Correct Context sp. z o.o. processes personal data only on the documented instructions of Correct Context Sp. z o.o., does not use your personal data for its own purposes, does not sell or share it with unrelated third parties, and does not use it to train AI models.

Identification data: name, email, phone number, city / location.

CV / résumé content: work history, education, skills, qualifications, certifications.

Application data: cover letter, salary expectations, links (LinkedIn, portfolio, repositories).

Photo (only if you choose to provide one).

AI-generated profile data: extracted skills, assessment results, personality profile, candidate-job match score.

Communication preferences and consent records.

Technical metadata: IP address, browser type, timestamps, page interactions.

Recruitment process and candidate evaluation — Art. 6(1)(b) (steps prior to entering into a contract at the data subject's request) and/or Art. 6(1)(f) (legitimate interest of Correct Context Sp. z o.o. in selecting candidates for open roles).

Automated AI voice calls, SMS, and automated emails about the recruitment process — Art. 6(1)(a) consent given through the consent form on the application page.

AI-based analysis of CV and application data — Art. 6(1)(a) consent and/or Art. 6(1)(f) legitimate interest of Correct Context Sp. z o.o. in efficient recruitment. AI outputs are recommendations only and do not constitute automated decision-making within the meaning of Art. 22 GDPR.

Compliance with applicable legal obligations — Art. 6(1)(c).

Personal data is accessible to:

• Correct Context Sp. z o.o. (data controller) and authorised members of its recruitment team;

• Correct Context sp. z o.o. (data processor, hosting and software provider);

• Sub-processors of Correct Context sp. z o.o.: Supabase (database, authentication, storage), Vercel (application hosting), Anthropic (AI processing), Resend (transactional email). Each is bound by a data processing agreement that prohibits using your data for purposes other than providing the service and that prohibits training AI models on your data.

For the current sub-processor list see the master Ceevee Privacy Policy at https://www.ceevee.cc/privacy.

Some sub-processors operate in the United States. Transfers outside the European Economic Area are safeguarded by Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914) and, where applicable, by the EU-US Data Privacy Framework. Copies of the relevant transfer mechanisms are available on request.

Correct Context Sp. z o.o. defines retention periods for your personal data based on its recruitment needs and applicable law. Correct Context sp. z o.o. deletes candidate data within 30 days of Correct Context Sp. z o.o.'s deletion instruction or termination of Correct Context Sp. z o.o.'s account on the Ceevee platform. Backup copies are purged within 90 days of deletion from primary storage.

Correct Context sp. z o.o. implements technical and organisational measures appropriate to the risk under Art. 32 GDPR, including: TLS 1.2+ encryption in transit, AES-256 encryption at rest, row-level security policies isolating data between organisations, bcrypt password hashing, multi-factor authentication for production system access, audit logging, and regular security patching.

You have the right to: access your data (Art. 15); rectification (Art. 16); erasure / "right to be forgotten" (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); objection (Art. 21); withdraw consent at any time (Art. 7(3)) without affecting the lawfulness of processing carried out before withdrawal; not be subject to a decision based solely on automated processing (Art. 22 — Correct Context Sp. z o.o. does not make such decisions through this Portal).

To exercise any of these rights regarding personal data submitted through this Portal, contact Correct Context Sp. z o.o. directly. If you contact Correct Context sp. z o.o., your request will be forwarded to Correct Context Sp. z o.o. as the data controller.

You also have the right to lodge a complaint with the supervisory authority. In Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Correct Context sp. z o.o. will notify Correct Context Sp. z o.o. (the data controller) without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting candidate data. Correct Context Sp. z o.o. is responsible for notifying the supervisory authority within 72 hours and affected data subjects where required (Art. 33-34 GDPR).

Ceevee master Privacy Policy: https://www.ceevee.cc/privacy

Ceevee Terms of Service: https://www.ceevee.cc/terms

Ceevee GDPR / RODO compliance: https://www.ceevee.cc/gdpr

Article 28 Data Processing Agreement: https://www.ceevee.cc/dpa

For privacy questions or to exercise your rights regarding personal data submitted through this Portal, contact Correct Context Sp. z o.o. directly. For questions about the Ceevee platform contact duke.vu@correctcontext.com.