Privacy Policy

How Obizworks-HR collects, uses, stores, and shares personal data — in plain language, with the legal precision behind it.

Last updated: 2026-05-23 · Version 1.0 (draft — pending legal counsel review)

1. Who we are

Obizworks-HR is a recruitment-services platform operated by Obizworks (Pvt) Ltd, registered in Karachi, Pakistan. We help client organisations hire candidates by combining recruiter expertise with AI-assisted screening. We are the data controller for candidate, client-contact, and recruiter records on the portal.

Wherever this policy uses “we”, “us”, or “Obizworks-HR”, we mean Obizworks (Pvt) Ltd in its role as portal operator.

2. What data we collect

We collect three categories of personal data:

We do not collect or process protected attributes (race, religion, ethnicity, age, gender, sexual orientation, disability, or political affiliation) as features for screening. We monitor for proxy bias on inferred attributes per our AI Disclosure §7.

3. How we use your data

Our legal bases for processing are (i) your consent when you create a candidate account, (ii) contractual necessity when you apply to a specific role, and (iii) legitimate interests for platform security, fraud prevention, and audit compliance. We do not sell your data, and we do not use it for advertising.

4. Sub-processors

We use these third parties to operate the portal. All have signed Data Processing Agreements (DPAs) with us where applicable, and none use your data to train AI models.

An updated sub-processor list will always be available at this URL. Material additions (new vendor handling new data category) trigger governance re-review per our governance program.

5. Data residency & transfers

Your portal data is stored in Pakistan (our primary region) with encrypted backups in a secondary region per our continuity plan. AI vendor data flows are documented in our AI Disclosure §5.

If you are based in the EU/UK and your CV is processed by a cloud AI vendor (Gemini or Claude), that processing is governed by Standard Contractual Clauses (SCCs) under our DPA with that vendor. You can opt to use Ollama-only screening — contact us at [email protected] with the request.

6. Retention

Detailed retention windows for AI-related data are in AI Disclosure §6. Summary:

• Active profile + CV — while your account exists
• Application history + AI scores — 7 years (anonymised on erasure)
• Hash-chained audit log entries — 7 years, never user-deletable (compliance)
• Login sessions · IPs — 90 days
• Anonymised bias metrics — indefinitely (no PII)

7. Your rights

You have the right to access, correct, port, restrict, withdraw, and erase your personal data. The full mechanism — including service-level commitments — is in AI Disclosure §3.

If you have an account, the fastest way to exercise rights is from Sign in → Rights & Data in your candidate sidebar. Otherwise, email [email protected] from the address on your profile.

You can additionally object to processing for legitimate-interest grounds (e.g., security analytics) by contacting us at the same address. If you do, we will assess whether our interest is overridden by your specific situation.

8. Cookies & tracking

We use a small set of strictly necessary cookies for authentication, CSRF protection, session continuity, and load balancing. We do not use advertising or third-party analytics cookies on the portal.

We use Cloudflare for DDoS protection; Cloudflare sets necessary cookies (e.g., `__cf_bm`) for bot detection. These are first-party in effect and are not used for advertising.

9. Children’s data

Obizworks-HR is intended for use by adults aged 18 and over. We do not knowingly collect personal data from minors. If we learn that we have collected such data, we will delete it. If you are a parent or guardian and believe your child has provided us with personal data, contact us at [email protected].

10. Contact & complaints

If you are unhappy with our response, you may complain to a regulatory authority — for Pakistan residents, the authority depends on the data category; for EU residents, your country’s Data Protection Authority; for US residents, your state Attorney General. We can help you identify the right contact if needed.