Zeder LLC ("selenios.com"), registered in the State of Delaware, United States, with its registered office at 16192 Coastal Highway, Lewes, DE 19958, is responsible for the processing of personal data we collect and process through our website and application.

selenios.com is an AI-assisted recruitment platform that offers sourcing, automated screening, interview scheduling, video call recording and analysis, and analytics associated with selection processes.

This Policy regulates the collection, processing, storage and deletion of personal data in connection with the use of selenios.com services. It applies to candidates, users of our clients, and any data subject whose data is processed through our platform.

We are committed to complying with the privacy and data protection laws in force in the jurisdictions where we operate, as well as with the Data Protection Principles of the Ibero-American Data Protection Network (RIPD).

selenios.com has appointed an internal contact responsible for coordinating privacy and data protection matters, handling data subject inquiries, and serving as the point of communication with clients and authorities.

• Contact: dpo@selenios.com

Responsibilities include:

• Overseeing compliance with applicable data protection regulations.
• Coordinating the exercise of data subject rights (access, rectification, deletion, objection, portability, restriction).
• Advising the team on good practices in handling personal data.
• Acting as the point of contact with authorities and clients.
• Coordinating the management of data security incidents.

We process personal data exclusively for the following purposes:

• Candidate sourcing: identifying and contacting potential candidates for selection processes.
• Automated screening: analyzing and evaluating candidates through artificial intelligence tools.
• Interview scheduling: coordinating meetings between candidates and clients via calendar synchronization.
• Interview recording and analysis: capturing, transcribing and summarizing video calls to assist the client in decision-making.
• Analytics and reporting: generating metrics and reports on selection processes.
• Service improvement: internal analysis aimed at optimizing the platform.
• Legal compliance: meeting legal obligations and responding to requests from competent authorities.

We do not use personal data for purposes other than those informed without prior notice and, where applicable, without obtaining consent again.

We process the following categories of personal data:

• Identification and contact data: first name, last name, email, phone, location.
• Professional information: CV, work history, academic background, certifications, public professional profiles (e.g., LinkedIn).
• Platform interactions: messages, questionnaire responses, communications via WhatsApp and other enabled channels.
• Interview content: video and audio recordings, transcripts, interview notes.
• Derived data: candidate scoring, automated evaluations, AI-generated summaries.
• Technical data: IP address, device identifiers, platform usage data, cookies.
• Calendar data: availability, events, participants (when the user connects their Google Calendar).

We do not request sensitive data (health, political opinions, biometric data or other special categories). If, due to the nature of a selection process, a client incorporates such information, the client is responsible for having obtained the corresponding data subject's consent and we process that information with the same level of protection as the rest.

Personal data may be obtained from the following sources:

• Directly from the data subject: forms, platform responses, participation in interviews or calls.
• Through our clients: clients may upload to the platform information about candidates they have previously contacted or who have applied to their openings.
• Integrations with third-party services: Google Calendar (when the user authorizes the connection), videoconferencing platforms and messaging tools enabled by the client.
• Public sources: professional profiles and other publicly available information, used solely for sourcing purposes.

We obtain data only from sources we reasonably understand to be lawful. When data comes from the client, we assume the client has obtained the data subject's consent in accordance with its own legal obligations.

• Data controller: when we interact directly with the data subject and obtain their consent (e.g., website registration, subscription to communications).
• Data processor: when we process data on behalf of a client. In that case, the client is the controller and we process the data following its instructions and the terms of the contract.

When consent is required:

• Before collecting personal data directly from the data subject.
• Before activating integrations that access the data subject's data (e.g., Google Calendar).
• Before using data for new purposes not previously informed.
• When, exceptionally, sensitive information is collected, by means of explicit and separate consent.

Data subject choices:

• Choose not to provide certain data. If the data is necessary to provide the service, we will inform you of the consequences (for example, being unable to participate in a selection process).
• Withdraw consent at any time by writing to dpo@selenios.com. Withdrawal does not affect the lawfulness of prior processing but may limit further use of the service.
• Disconnect integrations (for example, revoke access to Google Calendar from your Google Account).

Client responsibility: when we act as processors, the client is responsible for obtaining informed consent from candidates and end users before incorporating their data into the platform and for informing them how to exercise their rights.

We share personal data only with third parties strictly necessary to provide the service. We work with providers that have their own recognized security standards and, where appropriate, data processing agreements (DPAs) that govern the use of the information.

Our main subprocessors are listed in our Trust Center: https://trust.selenios.com/subprocessors

We do not sell personal data. We do not use it for targeted advertising or marketing profiling. We only disclose data to other third parties where there is (a) data subject consent, (b) client instruction under contract, or (c) legal obligation.

We maintain an internal list of subprocessors and review at least annually the current security certifications of the main ones (for example, their SOC 2 reports or equivalents).

Because we use global infrastructure, personal data may be transferred to and processed in countries other than that of the data subject. Any international transfer is carried out with contractual and technical safeguards that ensure an adequate level of protection.

Retention criteria: we retain personal data only for as long as necessary to fulfill the informed purposes, meet legal obligations or resolve disputes.

General timeframes:

• Active account data: retained while the client maintains an active subscription.
• Data after contract termination: retained for up to 90 days after the contract ends, unless the law requires a different period.
• Google OAuth tokens: revoked upon deactivating the integration; synced data is deleted within 30 days (rotating backup copies are purged within a maximum of 90 days).
• Deletion requests: are processed and logged. Information identified for destruction is securely deleted or anonymized to prevent loss, theft, misuse or unauthorized access.

Protection during retention: while data remains stored, we apply controls to prevent accidental deletion or destruction.

We guarantee data subjects the exercise of the following rights:

• Access: know what personal data we hold about the data subject and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Deletion: request deletion of the data.
• Objection: object to certain processing.
• Portability: receive the data in a structured, commonly used format.
• Restriction: restrict processing under certain circumstances.
• Withdrawal of consent.

How to exercise these rights:

1. Send a request to dpo@selenios.com.
2. We will confirm the requester's identity through a reasonable means (typically, validating that the request comes from the email associated with the account).
3. We will respond within up to 30 days, extendable when complexity requires it, in a comprehensible format.
4. If the request is denied (for example, because a law requires us to retain the information or because the client is the data controller), we will inform the reason in writing and, where applicable, how to appeal.
5. Where applicable, we will communicate corrections or deletions to the third parties with which we had shared the data.

When the data subject is a candidate of a client, we will refer the request to the corresponding client if the client is the data controller.

We strive to keep personal data up to date, complete and relevant to the purposes for which it is processed. Data subjects and users are responsible for:

• Providing truthful information at the time of collection.
• Keeping the information they upload to the platform up to date.
• Notifying us when they detect incorrect or outdated information.

Data subjects are notified:

• At the time of (or as soon as possible after) the collection of their personal data.
• Before or at the time of significant changes to this Policy.
• Before using data for new purposes not previously informed.

The usual means of notification are: in-platform notices, email to the data subject or the responsible client, and publication of the updated version on our website. Previous versions of this Policy are kept internally to document prior communications.

We use cookies to operate the site, analyze traffic, remember preferences and improve the user experience.

Types of cookies:

• Essential: necessary for basic operation.
• Performance: help us understand site usage.
• Functionality: remember preferences.
• Marketing: deliver relevant content or ads.

The user can accept, block or delete cookies from their browser settings. Disabling certain cookies may affect site functionality.

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest (AES-256).
• Access control with least-privilege principle.
• Two-factor authentication on critical accounts (AWS, MongoDB, sensitive internal systems).
• Continuous infrastructure monitoring and an incident response process managed by the engineering team.
• Periodic security reviews and vulnerability testing when significant changes are introduced to the platform.
• Initial training and periodic refreshers on security and privacy practices for the entire team.

Additional details are described in our Information Security Policy.

We have an internal process to detect, manage and respond to privacy incidents, including unauthorized access, loss or improper disclosure of personal data.

In the event of an incident:

1. We log it and assess its scope and impact.
2. We determine whether notification is required (to the client, to affected data subjects or to authorities) and the applicable timeframe.
3. We notify by email or another appropriate means, with the information necessary for each party to take action.
4. We keep a record of detected or reported incidents, as well as the corrective actions implemented.

Where agreements with our providers provide for it, we require them to report any actual or suspected unauthorized disclosure of personal data we have transferred to them. If a provider fails to comply, we take the corresponding corrective measures.

Anyone may contact us regarding privacy inquiries, claims or disputes by writing to dpo@selenios.com.

We have an internal process to:

• Receive and log each inquiry or claim.
• Investigate and resolve within a reasonable timeframe.
• Document the resolution and communicate it to the requester.
• Report the results of compliance reviews to management and implement remediation plans when issues are identified.

Management reviews compliance with this Policy and the associated controls at least annually to verify their effectiveness, adapt them to regulatory changes and keep them aligned with our operations. Significant findings are documented and action plans are executed within reasonable timeframes.

This Policy may be modified to reflect updates in our services or regulatory changes. Significant changes are notified to users with reasonable advance notice through the usual channels (email and publication on the site). Continued use of the service after the effective date implies acceptance of the updated version.

Previous versions are kept internally.

For any inquiries about this Policy or about the processing of your personal data:

Zeder LLC
16192 Coastal Highway, Lewes, DE 19958, USA
Email: dpo@selenios.com