PrivacyPolicy

1. Introduction

Welcome to hiNext. This Privacy Policy explains which of your data we use, what for, on what legal basis, how long we keep it, who we share it with and what rights you have. If anything is unclear, write to us at mail@hinext.io.

Who is responsible. The data controller is Hilarios Software & Consulting S.A.S., CUIT 30-71820425-5, based in Córdoba, Argentina ("hiNext"). We decide how and why your data is used. When we share your profile with a company, that company is responsible for what it does with it, under its own policy.

Which laws we comply with. Argentina's Personal Data Protection Law No. 25,326 and, when we process data of people in Europe, the United Kingdom or the United States, the rules of those places (GDPR, UK GDPR, CCPA/CPRA). Where a law gives you more rights, we apply that one.

Definitions:

• "User": any individual or entity using hiNext's services (for example, hiring companies).
• "Candidate": a person who applies to a search or whose profile we evaluate for a search.

2. What data we collect

For Candidates:

• Contact information: name, email, phone, city, LinkedIn or other professional network profile.
• CV (the file and its text): experience, education, skills, languages, expectations.
• Answers to screening questions.
• The search's test, when the search includes one: answers recorded on video or audio, their transcript and the evaluation of their content.
• Communications: the emails you exchange with us and their delivery status.
• Data we generate: fit score against the search, summary of your profile, recruiter notes, stage of the process.
• Technical data: IP address, browser, date and time the form was submitted.

Where it comes from: from you, when you fill in our form, or from the job board where you applied (LinkedIn, Indeed or others). We record the channel each application came through.

For Users:

• Company name and contact information of the people who represent it.
• Campaign details (job descriptions, hiring preferences) and billing data.

We do not ask for sensitive data (health, ethnic origin, religion, political opinions, trade union membership, sexual orientation, biometric or genetic data). If you include it in your CV, we do not use it as a criterion, and we recommend you leave it out. We do not analyze your video or audio to obtain biometric data or to infer emotions, personality or mood. Our services are for people aged 18 and over.

3. How we use the data

For Candidates:

• Evaluation: reading your CV, scoring your fit with the search, reviewing your test and deciding whether you move forward.
• Communication: email interaction during the process, partly AI-assisted and supervised by a person.
• Profile sharing: if you applied to a role and a recruiter decides you are a fit, we share your CV, your test and our evaluation with the company running that search. Until then, the company does not see your profile.
• Other searches: we may consider your profile for other similar searches we manage. If you don't want us to, write to mail@hinext.io and we will stop.
• Legal compliance and defense: keeping the records the law requires and defending ourselves against a claim.

3.1 Artificial intelligence and who decides. We use our own AI systems to work faster, not to decide for us:

• They read your CV and organize it into a structured profile. They do not make up data you didn't provide.
• They calculate a fit score between your profile and the search's requirements. They do not use age, gender, nationality, photo or sensitive data as a factor.
• They evaluate the content of your test answers (what you say, transcribed). They do not analyze your voice, your face, your gestures or your tone.
• They help draft the emails we send you and classify the tone of the ones you send us to alert the recruiter. This does not affect your evaluation.

No decision that affects you is made by the machine alone: before an application is discarded because of its score, it stays visible to the recruiter for several days and they can approve it; the recommendation on your test only ranks, the decision is made by a person; and your profile is shared with the company by a person on our team. You can ask for a person to review any decision and give your point of view by writing to mail@hinext.io. The AI providers we use process the data on our behalf and under contract; we do not use your data to train models.

Important notes: Your data is never sold or used for advertising. Your data is stored in the United States (see section 11).

For Users: running recruitment campaigns, billing and internal analytics. Not sold or shared with third parties outside this context.

4. Legal basis for processing (GDPR and Argentina)

Applying does not require you to "accept" anything: it requires you to be informed. That is what this policy is for.

• Candidates (Europe and the United Kingdom): our legitimate interest in providing the recruitment service you applied to (Art. 6(1)(f) GDPR): evaluating you, communicating with you, sharing your profile with the company and considering you for similar searches. You can object at any time.
• Candidates (Argentina): we inform you of the purpose before you send us your data, and sending it is your decision (Sections 5 and 6, Law No. 25,326).
• Legal obligations and defense of claims: legal obligation and legitimate interest.
• Users: performance of the contract and provision of the agreed service.

5. Data retention

For Candidates: we keep your application while the search is active and for up to 12 months after it closes; the test video and audio, for up to 6 months after it closes. Once those periods expire, we delete them in our periodic review. If you were hired, we keep the file for up to 24 months and after that only what is needed for billing. If you ask for deletion earlier, we do it (section 7).

For Users: for the duration of the business relationship and the legal retention periods (billing: 10 years, Section 328 of the Argentine Civil and Commercial Code).

6. Data sharing

• With the company running the search: your CV, your test and our evaluation, only if a recruiter decides you are a fit.
• With the providers that render services to us (hosting, email, AI models, error monitoring): what each service needs, under contracts that forbid them from using the data for any other purpose. List in the annex.
• With authorities, courts or legal advisors: what the law or a claim requires.

We do not sell, rent or share data with third parties for marketing or advertising.

7. Your rights (GDPR and Argentina)

Free of charge and without having to justify the request, by writing to mail@hinext.io from the email you applied with:

• Access: knowing what data we hold, where it comes from, what we use it for and who we share it with, and getting a copy. We answer within 10 calendar days (Argentina) or 1 month (Europe/UK).
• Rectification and Erasure: within 5 business days (Argentina) or 1 month (Europe/UK).
• Objection: having us stop processing your data or stop considering you for other searches. To stop receiving emails, reply to any of them asking to unsubscribe.
• Restriction and Portability: within 1 month.
• Human review: having a person review any decision (section 3.1).
• Complaint to the authority: the AAIP in Argentina, your country's authority in the EU, the ICO in the United Kingdom.

The data subject has the right to exercise the right of access to their personal data free of charge at intervals of no less than six months, unless a legitimate interest is proven to that effect, as set forth in Section 14, subsection 3 of Law No. 25,326. The Agency for Access to Public Information, Control Body of Law No. 25,326, has the authority to address complaints and claims filed in relation to non-compliance with personal data protection rules.

8. California residents (CCPA/CPRA)

Right to know what information we collect and for what purpose; to request its deletion or correction; and not to be discriminated against for exercising your rights. We do not sell or "share" personal information for advertising purposes. You may designate an authorized agent. Requests: mail@hinext.io.

9. Cookies and tracking technologies

The application form and the test only use the technical cookies they need to work. The hinext.io site uses Google Analytics to measure site usage in aggregate; you can reject those cookies from the site's cookie notice or block them in your browser. We do not use advertising cookies.

10. Security measures

Encryption in transit (TLS) and at rest, private file storage, role-based access, backups with 7-day retention and review of our providers. No system is 100% secure; if an incident affects your data, we notify the authority when required and you without delay if it poses a risk to your rights.

11. International data transfers

hiNext operates from Argentina and hosts its systems in the United States (Amazon Web Services). Your data may be processed in Argentina, the United States and the country of the company running the search.

• Europe and the United Kingdom → Argentina: Argentina has an adequacy decision from the European Commission and the United Kingdom.
• → United States: the European Commission's Standard Contractual Clauses (Decision 2021/914) with our providers and, where they are certified, the EU-US Data Privacy Framework.
• From Argentina: Section 12 of Law No. 25,326 and the AAIP's model contracts (Provision 60-E/2016).

You can ask us for a copy of the safeguards at mail@hinext.io.

12. Changes to this policy

We publish each version on hinext.io with its date. If a change reduces your rights or adds a purpose, we will notify you by email before it takes effect.

13. Contact

Hilarios Software & Consulting S.A.S. · CUIT 30-71820425-5 · Córdoba, Argentina · Email: mail@hinext.io

Annex · Providers that process data on behalf of hiNext