Privacy Policy

Last updated: 2026-08-02

Document version: 2026-07-01

1. Data Controller

The controller of your personal data is Punkt X Sp. z o.o. based in Warsaw, Poland. Contact: kontakt@hi-po.pl.

2. Data We Collect

We collect data provided during registration (name, surname, email), CV data (work experience, education), AUDIO recordings of AI Interview sessions with transcripts (interviews are not recorded on video) and technical data (IP address, User-Agent, cookies).

3. Purpose of Processing

We process your data to: carry out the recruitment process, conduct AI Interview, generate competency assessment (4K scoring), prepare feedback, and ensure service security.

4. Legal Basis

We process data based on: Art. 6(1)(b) GDPR (contract/service), Art. 6(1)(a) (consent — especially for recording and AI profiling) and Art. 6(1)(f) (legitimate interest — security).

5. Retention Period

Account data is stored until account deletion. Audio interview recordings are deleted 90 days after the recruitment process ends. CV and scoring data are anonymized 12 months (365 days) after the process ends — the data remains in anonymized form for statistical purposes only. Security-related server logs (including IP address and browser) are kept for up to 5 years, in line with the accountability obligation under Art. 5(2) GDPR; other operational logs — up to 12 months.

6. Recipients of Data and Transfers Outside the European Economic Area

We use service providers (processors) to whom we entrust processing of your data to the extent necessary to provide the service: Google Cloud (Vertex AI) — CV analysis and interview assessment. Text content (CV, interview transcript) is processed in the London (United Kingdom) region, which constitutes a transfer of data outside the European Economic Area — this takes place on the basis of the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR), without requiring your additional consent. The audio recording of the interview is processed exclusively in the Warsaw (Poland) region, entirely within the European Economic Area. Cloudflare — storage of CV files and audio recordings (object storage). LiveKit — infrastructure for conducting the voice call; it runs on our own infrastructure and is not a processor within the meaning of GDPR.

7. Your Rights

You have the right to access, rectify, erase (right to be forgotten), restrict processing, port data, and object to profiling. You may withdraw consent at any time. To exercise your rights, contact us or use the options in your account panel.

8. Automated Decision-Making and Profiling (Art. 22 GDPR)

Your interview is conducted by an artificial intelligence system, and your CV and answers are automatically analysed to produce a competency assessment across four areas (4K scoring). This constitutes profiling within the meaning of Art. 4(4) GDPR. The assessment is based solely on the content of your answers against the role requirements and on the information in your CV — the system does not assess your emotions, tone of voice, or personality traits. The result is compared against thresholds set by the employer running the recruitment. A decision to reject your application is NEVER made automatically: the system may advance you to the next stage on its own (a favourable decision), whereas every rejection is withheld and requires a human decision on the employer's side. The legal basis for this processing is your explicit consent to AI profiling, which you may withdraw at any time. You have the right to obtain human intervention, to express your point of view, and to contest the assessment or the decision — you can exercise these rights by writing to the address given in section 9 or by using the “Your data” link in the messages you receive from us.

9. Contact

For data protection matters, contact us at: kontakt@hi-po.pl. You have the right to lodge a complaint with the supervisory authority (UODO in Poland).