PRIVACY NOTICE

1. Introduction

AIVALS Pte. Ltd. and its affiliated entities (“AIVALS”, “we”, “us”, or “our”) collect and process your personal data when you participate in an AI-assisted video or voice interview via our AIVALS AI Interview platform. This Privacy Notice explains what data we collect, why we collect it, how we protect it, and your rights under applicable data protection laws, including:

• Singapore’s Personal Data Protection Act 2012 (PDPA);
• The EU General Data Protection Regulation (GDPR), where applicable;
• Malaysia’s Personal Data Protection Act 2010 (PDPA MY);
• Indonesia’s Personal Data Protection Law No. 27 of 2022 (PDPL ID);
• And other relevant national or regional privacy regulations.

By using our service, you acknowledge this Notice.

2. What Data Do We Collect?

We collect the following categories of personal data:

• Identity Information: Full name, email address, phone number, postal address.
• Recruitment Data: Résumé/CV, job ID applied for, name of the recruiter or hiring organization.
• Interview Content: Video recording, audio track, AI-generated transcript, text responses, and multiple-choice answers.
• Technical Data: IP address, device type, browser version, operating system, referring URLs, pages visited, session duration, clicks, and other usage analytics.
• Special Category Data (only with explicit consent): Requests for disability accommodations, biometric voiceprints (used solely for re-identification in repeat interviews), or other sensitive information.

3. Purposes of Processing & Legal Bases

We process your data for the following purposes:

Where required by law (e.g., under GDPR), we rely on your explicit consent for processing special category data or cross-border transfers lacking adequacy decisions.

4. Who Receives Your Data?

• Hiring Organizations: The employer or recruiter who invited you receives your interview responses and recordings.
• Sub-processors: Trusted vendors providing cloud hosting (e.g., AWS, Google Cloud), video streaming, analytics, and integration with applicant tracking systems (ATS). All sub-processors are bound by data processing agreements compliant with PDPA and GDPR standards.
• Legal Authorities: We disclose data if required by law, court order, or regulatory request.

Our infrastructure is global. When transferring data internationally (e.g., from Singapore to the U.S.), we implement safeguards such as Standard Contractual Clauses (SCCs), binding corporate rules, or obtain your explicit consent, as required by PDPA MY, PDPL ID, or GDPR.

5. Data Retention

• Candidate Account Data: Retained for the duration of your engagement plus up to 24 months.
• Interview Recordings & Responses: Stored per instructions from the enterprise client. For direct candidates (not invited by a client), retained for up to 12 months, unless extended by legal requirement or your explicit agreement.
• After retention periods, data is securely deleted or irreversibly anonymized.

6. Security Measures

We implement industry-standard safeguards:

• Encryption in transit (TLS 1.3+) and at rest (AES-256);
• Role-based access controls and multi-factor authentication;
• Regular penetration testing and vulnerability assessments;
• Audit logs and vendor security assessments aligned with PDPA and ISO 27001 principles.

7. Data Breach Notification

In the event of a personal data breach likely to result in significant harm, we will:

• Notify the Personal Data Protection Commission (PDPC) of Singapore within 72 hours (if required);
• Inform affected individuals without undue delay;
• Take remedial actions to mitigate impact.

8. Children’s Data

The Service is not intended for individuals under 18. We do not knowingly collect or process their data. If discovered, such data will be deleted immediately.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of your personal data;
• Correct inaccurate or incomplete information;
• Withdraw consent (note: this may disqualify your job application);
• Object to processing based on legitimate interests;
• Request erasure before standard retention expiry;
• Data portability (where applicable under GDPR).

To exercise these rights, email legal@AIVALS.com. We will respond within 30 days (or as required by local law).

10. Updates to This Notice

We may revise this Notice to reflect changes in our practices or legal obligations. The “Last Updated” date will be modified accordingly. For material changes, we will provide prominent notice (e.g., via email or banner). Continued use constitutes acceptance.

11. Contact Us

For privacy inquiries or to contact our Data Protection Officer: