Privacy Policy for EU Residents

Effective Date: July 3, 2025

Welcome to Octopot. This Privacy Policy explains how we collect, use, share, and protect your personal data when you interact with our services, in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP).

This policy applies to individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland who access or use Octopot's services. Please read this document carefully to understand how we handle your personal data.

1. Who We Are

Octopot is operated by Baytech BV, a Netherlands-based technology company focused on AI-powered HR solutions. For GDPR purposes, Baytech BV acts in two roles. When companies use Octopot to recruit, the company you apply to (or that adds you to its talent pool) is the Data Controller of your candidate data, and Baytech BV processes that data on its behalf as a Data Processor (GDPR Art. 28). When you use Octopot's candidate tools with your own account (CV creation and optimisation, cover letters, interview preparation), and for the accounts of our business clients' users, our website and our sales communications, Baytech BV is the Data Controller. You can reach us at:

Email: privacy@octopot.co

2. What Data We Collect

We collect the following categories of personal data:

a) Information You Provide

Account data: Name, email address and password of candidates; and name, email address, password, company, role and department of people who use Octopot on behalf of a business client.
Candidate tools content: CVs you create or upload, optimised CVs, cover letters, job preferences and interview preparation content.
Candidate data: CVs, contact details, answers to screening questions, documents, and audio/video recordings and transcripts of AI, phone or WhatsApp interviews, submitted when you apply to a client's job or are invited to an interview.
Communication data: Emails, support tickets, messages, or feedback you send us.

b) Information We Collect Automatically

Usage data: Logs of your interactions with our platform, pages visited, features used, and timestamps.
Device data: Browser type, operating system, device model, and IP address.
Cookies and analytics: Data collected via cookies and third-party analytics tools to improve our service.

c) Information from Third Parties

We may receive personal data from business partners, marketing tools, or integrations you authorize (e.g., LinkedIn or Google sign-in, a client's applicant tracking system), and our business clients may add candidates found in public professional profiles to their talent pool.

3. Why We Process Your Data

We use your data to:

Provide our recruitment platform to business clients: publishing jobs, receiving applications, CV analysis and job-fit scoring, screening, AI interviews and candidate management.
Provide candidate services: CV creation and optimisation, AI-generated cover letters, interview preparation and application tracking.
Share applications and interview results with the company you applied to, which makes the hiring decision.
Measure each business client's usage (credits/tokens) for billing.
Improve the service using anonymised and aggregated data. Client and candidate data is not used to train general AI models without the client's approval.
Comply with legal obligations and ensure the security of your account.

We process your data for the following purposes and legal bases under Article 6 of the GDPR:

To provide services: To run the recruitment platform for our business clients, provide candidate tools, and manage accounts and payments (Legal basis: Contractual necessity; for application data, the hiring company's instructions under Art. 28).
To evaluate applications: Score CVs against job requirements and evaluate interview answers on behalf of the hiring company (Legal basis: determined by the hiring company as controller).
To communicate with you: Respond to support requests, send system notifications, or service updates (Legal basis: Legitimate interest).
To improve the service: Use anonymised, aggregated data for product improvements (Legal basis: Legitimate interest).
To meet legal obligations: Comply with applicable laws and regulations (Legal basis: Legal obligation).

4. Cookies and Tracking Technologies

We use cookies to remember your preferences, analyze usage patterns, and improve our service. You can manage cookie settings in your browser or review our Cookie Policy for full details.

5. How We Share Your Data

We do not sell or rent your data. However, we may share it with:

Hiring companies: Your application and interview results are shared with the company you applied to and the users it authorises.
Sub-processors: Cloud hosting, AI services (OpenAI / Microsoft Azure OpenAI), speech services (Soniox, Cartesia), communication services (Mailgun, Twilio, WhatsApp/Meta), payments (Stripe) and error monitoring (Sentry).
Client integrations: Systems a business client connects itself, such as webhooks, calendars or mailboxes.
Legal authorities: If required to comply with laws, court orders, or defend our legal rights.
Corporate transactions: In case of mergers, acquisitions, or asset transfers.

6. International Transfers

Your data may be processed or stored outside the EEA. When we transfer your data internationally, we rely on legal safeguards such as Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful mechanisms as required by applicable law.

7. Data Retention

We keep your personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Retention durations depend on the nature of your use:

Account data: Retained for the lifetime of your account or until deletion request.
Candidate account and CV tools content: Retained while your account is active and deleted upon account closure or specific request.
Application data and interview recordings: Retained for the period set by the hiring company, and returned or deleted on its instruction or when its contract ends.
Transaction data: Retained for 7 years as required for financial and legal compliance.
Consent: Where required, for interview recordings and marketing communications.
Contract: To deliver the services our business clients sign up for.
Legitimate Interest: To improve product performance and prevent fraud.
Legal Obligation: To comply with applicable regulations.

8. Your GDPR Rights

Under the GDPR, you have the following rights:

Right to access – You can request a copy of the personal data we hold about you.
Right to rectification – You can request correction of inaccurate data.
Right to erasure – You can ask us to delete your personal data (“right to be forgotten”).
Right to restrict processing – You may limit how we use your data in certain cases.
Right to data portability – You can obtain a copy of your data in a structured, machine-readable format.
Right to object – You can object to processing based on our legitimate interests.
Right to withdraw consent – You can withdraw your consent at any time, where applicable.
Right to lodge a complaint – You can contact your local data protection authority if you believe we violated your rights.

9. How to Exercise Your Rights

You can make any privacy-related request by contacting us at privacy@octopot.co. We will respond to valid requests within 30 days. In some cases, we may need to verify your identity before acting on your request.

10. Data Security

We implement a range of security measures including encryption in transit, role- and department-based access control, audit logging, and secure development practices. However, no system is completely immune to risk, so we recommend using strong passwords and avoiding sharing account credentials.

11. Children’s Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect data from children. If you are a parent or guardian and believe your child has submitted personal data, contact us immediately and we will take appropriate steps to delete the data.

12. Automated Decision Making

Octopot uses AI to help candidates (CV, cover letter and interview suggestions that you review and can edit) and to support hiring companies: CV and job-fit scoring, screening against the company's rules, and evaluation of interview answers, transcripts and facial expressions in video interviews. Hiring decisions are made by the hiring company, not by Octopot's AI. You have the right to request human intervention and to contest decisions.

13. Changes to This Policy

We may update this Privacy Policy as needed to reflect changes in legal requirements or our services. When we do, we will post the updated version here and revise the “Effective Date” accordingly. If changes are significant, we will notify you via email or a prominent notice on our platform.

14. Contact

For any questions, concerns, or complaints about this Privacy Policy or how your data is handled, please contact:

Email: privacy@octopot.co

We are committed to resolving complaints in a timely and transparent manner, and will do our best to support you in exercising your rights.