Brondem Privacy Policy

Brondem is a SaaS platform for initial candidate screening. An HR user creates an interview, questions, and criteria, while a candidate completes the initial stage through the Telegram bot or Mini App. The service collects answers and related data and may generate an assistive AI report for HR.

This Policy applies to the Brondem public website, HR dashboard, Telegram bot, Mini App, and related service features. It should be read together with the Terms of Use and Public Offer.

1. Account and team. Registration, login, access recovery, user invitations, roles, and company settings.
2. Interviews and attempts. Storing questions and materials, conducting interviews through Telegram or Mini App, and collecting profile and contact details where requested by the HR company.
3. Analytics and reports. Generating assistive scores, AI reports, candidate lists, source statistics, exports, and manual HR decisions.
4. Company verification. Checking submitted information and granting, refusing, or revoking verification status without disclosing internal criteria.
5. Files and notifications. Storing attachments, CVs, reminders, invitations, and email or Telegram notifications and recording delivery results.
6. Payments and limits. Confirming payments, activating access, recording use, refunds, disputes, and financial compliance.
7. Support and security. Responding to requests, diagnosing errors, auditing, and protection against spam, fraud, attacks, and circumvention.
8. Legal compliance. Accounting, tax, and contractual obligations and responses to lawful requests.

Brondem primarily follows Ukrainian law on personal-data protection, electronic commerce, and contractual relations. Where the GDPR or other mandatory law applies to specific processing, Brondem takes its requirements into account.

The specific basis depends on Brondem's role, the processing purpose, and applicable law.

For candidate screening, the HR company or employer usually determines the purpose, vacancy content, questions, required fields, criteria, and subsequent use of results. In this context, the company is the data controller and Brondem processes data on its instructions to operate the service.

For HR accounts, company verification, payments, support, notifications, technical logs, and its own legal obligations, Brondem may act as an independent controller.

Questions, expected answers, candidate answers, and related completion signals may be used to generate a report. Brondem uses OpenAI services to provide certain artificial intelligence functionality. As part of this processing, OpenAI may receive data only to the extent necessary to provide the relevant AI functionality.

Risk signals are not proof of fraud or a violation. They only indicate a possible need for additional manual review. The HR company / employer is responsible for the legality of invitations, rejections, additional interviews, or hiring.

Brondem does not sell personal data. Data may be shared with providers only to the extent needed for a specific function, under a contract, lawful request, or other proper basis. The provider set may change provided this does not reduce user rights and protections.

• Data is stored through an infrastructure provider and, for attachments, in file storage.
• The processing location depends on provider settings. International transfers use lawful grounds and safeguards prescribed by law.
• Company data is logically separated so users of one company cannot access another company's data.
• Data may be temporarily processed by external providers for AI analysis, payments, notifications, Telegram, support, or security.
• Access is restricted by company, user role, and need to perform job duties.

Brondem retains data no longer than needed for processing purposes, plan terms, contract performance, legal compliance, protection of rights, and abuse investigations. Unless another period is set by a plan, contract, company settings, or law, reasonable retention periods appropriate to the data's purpose apply.

Depending on applicable law, a user or candidate may have rights to access, correction, deletion, restriction of processing, withdrawal of consent, objection, and information about data transfers.

A request may be sent to [email protected]. The requester should state their role and information that will help locate the record. Brondem may request additional identity verification to avoid disclosing data to a third party.

An HR company may delete or request deletion of interviews, candidate records, and materials available to it. A candidate may contact the HR company or Brondem directly. Depending on the grounds and technical status, data may be deleted, access may be restricted, or data may be anonymized.

During anonymization, Telegram identifiers, OAuth identifiers, email, name, contacts, profile, answer texts, files, AI content, and report content are removed. Minimal technical deletion evidence, security logs, and financial documents may remain for defined periods without candidate content. A deleted marker is not physical file deletion: storage cleanup is confirmed by a separate reliable task.

Brondem uses necessary cookies, localStorage, and sessionStorage for login, session maintenance and renewal, account protection, language selection, interface operation, and return after payment. Drafts, filters, onboarding state, service flags for payment or company checks, and short-lived cached profile data may also be stored locally.

Brondem applies organizational and technical safeguards, including role-based access control, logical separation of company data, logging of important events, access checks, and abuse-prevention measures. Details of security mechanisms are not published for security reasons.