Privacy Policy

This Privacy Policy explains how Itrinova ("Itrinova", "we", "us") collects, uses and shares personal data when you:

• visit or use our website at https://itrinova.com (the "Site");
• interact with Lia, our autonomous recruiting agent, or any related demos or early‑access features we make available; or
• communicate with us (for example, by email or through forms such as "Get Lia on Your Team").

This Privacy Policy does not replace any separate data processing agreement we may enter into with our business customers for the provision of our products and services. In case of conflict, the terms of that agreement will prevail.

1. Who we are and contact details

The controller responsible for processing your personal data as described in this Privacy Policy is:

If we appoint a Data Protection Officer (DPO), their contact details will be published here.

2. Scope of this Privacy Policy

This Privacy Policy applies to:

• visitors to our Site;
• representatives of our customers and prospective customers (e.g. HR leaders, recruiters, founders);
• individuals who participate in product demos, pilots, or our design partner programme; and
• to the extent described in Section 4, candidates whose data is processed by Lia in connection with services we provide to our business customers.

If your data is processed in connection with a role you have applied for with one of our customers, that customer is typically the "controller" of your Candidate Data, and we process it on their behalf as a "processor" or "service provider". In those cases, you should first refer to the customer's own privacy notice and contact them to exercise your rights. We will assist them in responding, where required.

3. Personal data we collect

The personal data we collect depends on how you interact with us. It may include:

a) Information you provide directly

• Contact details: name, email address, phone number, job title, company name, country.
• Business information: company size, industry, hiring priorities, interests in our products.
• Communications: your messages, questions and feedback (for example, via forms, email or calls).
• Demo / pilot data: configuration details, prompts, test job descriptions or other content you provide when evaluating Lia or the Itrinova platform.

b) Candidate data (processed on behalf of customers)

When a customer uses Lia with their own systems, we may process Candidate Data such as:

• resume / CV information (education, work history, skills, etc.);
• application answers, assessments and other candidate inputs;
• communication history (emails, messages, scheduling information);
• recruiter notes and status updates;
• metadata like application date, job applied for, and interview outcomes.

As noted above, this data is typically controlled by our customer (your employer or prospective employer), not by Itrinova.

c) Automatically collected data

When you visit our Site, we may automatically collect:

• Device and log information: IP address, browser type and version, operating system, referral URLs, pages visited, links clicked, and timestamps.
• Usage data: information about how you interact with our Site and Services.
• Approximate location information derived from your IP address.

d) Cookies and similar technologies

We use cookies and similar technologies to:

• make the Site function properly;
• remember your preferences; and
• understand how visitors use the Site (analytics).

You can control cookies through your browser settings. If we use non‑essential cookies (such as for analytics or marketing) in jurisdictions where consent is required, we will ask for your consent via a cookie banner or similar mechanism.

4. How we use personal data and legal bases

We use personal data for the following purposes and, where required, rely on the following legal bases under the GDPR:

1. Providing and improving our Site and Services

• To operate, maintain and secure the Site and Services.
• To provide demos, pilots and design partner access.
• Legal basis: performance of a contract or steps taken at your request; and our legitimate interests in providing secure and useful services.

2. Responding to enquiries and managing our relationship with you

• To respond to contact requests, demo requests and other queries.
• To manage our relationships with customers and partners.
• Legal basis: performance of a contract or steps taken at your request; and our legitimate interests in developing our business.

3. Supporting autonomous recruiting (for customers)

• To process Candidate Data on behalf of our customers: screening applications, prioritising candidates, generating outreach, scheduling interviews and maintaining recruiting pipelines.
• Legal basis: performance of our contract with the relevant customer and our legitimate interests in providing and improving our services; for candidates, the legal basis is usually determined by the customer acting as controller.

4. AI‑based analysis, scoring and automation

• To use machine learning and AI models to analyse resumes, job descriptions and communications in order to support screening, matching, outreach and scheduling.
• Where applicable law treats this as profiling or automated decision‑making, we implement measures to protect individuals' rights, including appropriate human oversight and the ability to obtain human review where required by law. Under GDPR, individuals have, in certain cases, a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects.
• Legal basis: performance of a contract; our legitimate interests in supporting effective recruiting; and, where required, consent or other lawful grounds as determined with our customers.

5. Analytics and product improvement

• To analyse usage of the Site and Services and improve their performance and user experience.
• To develop new features and capabilities, including improvements to Lia and our models (in a way that does not identify you or candidates where required by law).
• Legal basis: our legitimate interests in understanding and improving our business; where required, your consent for analytics cookies.

6. Marketing and communications

• To send you product updates, invitations to events, and other marketing communications, subject to your preferences.
• You can opt out at any time by using the unsubscribe link in our emails or by contacting us.
• Legal basis: our legitimate interests in promoting our services to business contacts; and/or your consent, where required by law.

7. Security, fraud prevention and legal compliance

• To protect the Site and Services from abuse or unauthorised access.
• To comply with legal obligations, respond to legal requests, or protect our rights and the rights of others.
• Legal basis: compliance with legal obligations and our legitimate interests in protecting our business.

5. How we share personal data

We may share personal data with:

• Service providers and vendors that help us operate the Site and Services (for example, hosting providers, cloud infrastructure, email and calendar providers, analytics tools, and CRM systems). These service providers act as our processors and are bound by contractual obligations to protect your data.
• Customers, where you are a candidate or user associated with that customer (for example, we provide Candidate Data and related insights back to the customer's recruiting team).
• Professional advisors, such as lawyers, auditors and insurers, where necessary in the course of the professional services they provide to us.
• Authorities and third parties where required by law, to protect our rights or the rights of others, or in the context of a business transaction such as a merger, acquisition or asset sale.

We do not sell personal information in the ordinary sense of "selling" and do not share personal information with third parties for their own independent marketing purposes.

6. International data transfers

We may transfer personal data to countries outside your own, including countries outside the European Economic Area (EEA) where data protection laws may be different.

When we transfer personal data out of the EEA, we do so in accordance with applicable law, for example by:

• relying on an adequacy decision of the European Commission; or
• using standard contractual clauses approved by the European Commission or other appropriate safeguards.

You can contact us for more information about these safeguards.

7. Data retention

We retain personal data for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, including to comply with legal, regulatory, tax, accounting or reporting requirements, and to resolve disputes.

In general, we aim to:

• retain contact and business information for prospects and customers for a reasonable period after the last meaningful interaction, unless you ask us to delete it sooner and we are able to comply;
• retain log and analytics data for a limited period, unless shorter or longer periods are needed for security or legal reasons;
• retain Candidate Data in accordance with our agreements with our customers, who determine the relevant retention periods for their recruiting processes.

We may anonymise data so that it can no longer be linked to an identifiable individual. We may use such anonymised data for longer periods for analytics, benchmarking and product improvement.

8. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration. These measures may include access controls, encryption in transit, backup and recovery procedures, and regular security assessments.

However, no system can be completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

9. Your rights (EEA, UK and similar jurisdictions)

If you are located in the EU/EEA, UK or another jurisdiction that grants similar rights, you may have the following rights in relation to your personal data, subject to applicable law:

• Right of access – to obtain confirmation whether we process your personal data and to receive a copy.
• Right to rectification – to have inaccurate or incomplete data corrected.
• Right to erasure – to request deletion of your personal data in certain circumstances ("right to be forgotten").
• Right to restriction – to request that we restrict processing in certain situations.
• Right to data portability – to receive your personal data in a structured, commonly used and machine‑readable format and transmit it to another controller, where technically feasible.
• Right to object – to object to processing based on our legitimate interests, including profiling, and to direct marketing at any time.
• Rights related to automated decision‑making – where applicable, to obtain human review of certain decisions that are based solely on automated processing and have legal or similarly significant effects on you.

To exercise your rights, please contact us using the details in Section 13. We may ask you for additional information to verify your identity.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU/EEA member state where you live or work, or where you consider that your rights have been infringed.

10. Additional information for California residents

If you are a resident of California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, may give you additional rights regarding your personal information.

Subject to certain limitations, you may have the right to:

• request to know the categories and specific pieces of personal information we have collected about you, the categories of sources, business or commercial purposes, and categories of third parties with whom we share it;
• request deletion of personal information we hold about you;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell personal information as that term is defined under the CCPA); and
• not receive discriminatory treatment for exercising your rights.

To exercise these rights, you can contact us at privacy@itrinova.com with "CCPA Request" in the subject line. We may need to verify your identity before fulfilling your request.

11. Children's privacy

The Site and Services are not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and may provide additional notice where appropriate.

Your continued use of the Site or Services after the updated Privacy Policy becomes effective means you acknowledge the changes.

13. Contact us

If you have any questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact us at: