Privacy Policy

Last updated: 18 June 2026

1. INTRODUCTORY PROVISIONS

This Policy governs the terms and conditions for the collection, processing, use, storage, protection and transfer of the Personal Data of users of the Platform operated by Nimatron d.o.o., Sprečka ulica 19, Zagreb, Croatia, Personal Identification Number (OIB): 27887722834 (hereinafter: “Nimatron”, “we”, “us” or “our”).

This Policy complies with the GDPR, the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/18) and other applicable laws and regulations of the Republic of Croatia.

By using the Platform, the User confirms that they have read and understood this Policy.

The entire recruitment and selection process takes place exclusively through the Platform. Each Employer recruitment campaign has its own publicly accessible job advertisement page. Candidates access the questionnaire directly through the Platform. The Employer neither publishes nor hosts the questionnaire or job advertisement on its own infrastructure; instead, the entire application process and the collection of Candidates’ Personal Data take place on the Platform. Through its user interface, the Employer can review submitted applications and use tools to manage the recruitment and selection process.

Accordingly, Nimatron acts as a Processor of Candidates’ Personal Data on behalf of the Employer and as a provider of the job advertisement publication service through which advertisements are displayed on the Platform. In relation to the Personal Data of Employer Employees who use the Platform (e.g. account, access and Platform activity data), Nimatron acts as the Controller in accordance with Section 3.1 of this Policy.

2. DEFINITIONS

For the purposes of this Policy, the following capitalised terms shall have the meanings set out below:

“GDPR”

means the General Data Protection Regulation, Regulation (EU) 2016/679.

“Processor”

means a legal or natural person that processes Personal Data on behalf of and in accordance with the instructions of the Controller.

“Candidate”

means a natural person who applies through the Platform for a job advertised by an Employer, completes a questionnaire and provides their Personal Data for the purpose of participating in a recruitment and selection process.

“User”

means a Candidate and/or an Employer Employee. The provisions of this Policy relating to a User apply to both categories of Data Subjects unless a particular provision expressly states otherwise.

“Nimatron”

has the meaning given in Section 1 of this Policy.

“Personal Data”

means any information relating to an identified or identifiable natural person who, for the purposes of this Policy, is considered a Candidate and who may be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

“Platform”

means the website www.talentq.io and the TalentQ platform.

“Policy”

means this Privacy Policy.

“Special Categories of Personal Data”

means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

“Employer”

means a legal or natural person that conducts a recruitment and selection process through the Platform, publishes a job advertisement and to whose process the Candidate applies.

“Consent”

means any freely given, specific, informed and unambiguous indication of the Candidate’s wishes by which, through a statement or clear affirmative action, the Candidate signifies agreement to the processing of Personal Data relating to them.

“Controller”

means a legal or natural person that, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

“Employer Employee”

means a natural person who is employed by or otherwise engaged under contract with the Employer and who, on behalf of the Employer and based on assigned authorisations, uses the Platform to manage the recruitment and selection process (e.g. creating job advertisements and questionnaires, reviewing applications and communicating with Candidates).

3. WHO IS RESPONSIBLE FOR YOUR DATA

3.1. Controller and Processor

For the Personal Data of Candidates who complete a questionnaire on the Platform, the Employer is the Controller. The Employer independently determines the purposes and means of processing Personal Data within its recruitment and selection process.

In relation to Candidates’ Personal Data, Nimatron acts as the Processor and processes Personal Data on behalf of and in accordance with the instructions of the Controller, pursuant to the provisions governing the processing of Personal Data on behalf of the Employer set out in Article 11 of the Terms of Use, which the Employer accepts when creating a user account.

By way of exception, Nimatron acts as the Controller in the following cases:

• for account data relating to Employers and Employer Employees who use the Platform;
• for technical data concerning use of the Platform (logs and security data); and
• for data collected for Nimatron’s own business communications, marketing purposes (subject to Consent) and service improvement.

4. WHAT DATA WE COLLECT AND FOR WHAT PURPOSE

4.1. Candidate Data

When a Candidate completes a questionnaire on the Platform, we collect the information entered by the Candidate, which must include:

• first and last name;
• email address; and
• mobile phone number.

Depending on the content of the questionnaire defined by the Employer, we may also collect:

• information about education, qualifications and work experience;
• information about skills, language proficiency and other professional competencies;
• information provided in a CV; and
• other information professionally relevant to the specific position.

We do not collect Personal Data beyond what is necessary to conduct the relevant recruitment and selection process (the data minimisation principle).

We do not collect Special Categories of Personal Data.

We use Personal Data collected through the questionnaire exclusively for the purpose of conducting the Candidate recruitment and selection process, including communicating with the Candidate regarding their application and processing job applications.

Candidates’ Personal Data is accessible exclusively to the Employer that created the questionnaire on the Platform for the position to which the Candidate is applying.

As the Platform provider, we reserve the right to use anonymised and aggregated data for market research and statistical purposes in order to improve our services.

4.2. Technical Data Relating to Use of the Platform

When the Platform is used, we automatically collect:

• the IP address and device information (device type, operating system and browser);
• timestamps of access to and activity on the Platform; and
• usage data (pages visited, time spent and clicks).

This data is used for system security, fraud prevention, technical support and functionality improvements.

4.3. Employer and Employer Employee Data

For Employer accounts, we collect:

• information about the legal entity (name, Personal Identification Number (OIB), address and contact details);
• information about Employer Employees who use the Platform (first name, last name, email address and role); and
• information about use of the services and business communications with Nimatron.

5. LEGAL BASES AND PURPOSES OF PROCESSING

The following table sets out the principal categories of Personal Data we process, the purposes of processing, the legal bases and the applicable retention periods:

Upon expiry of the applicable retention periods, Personal Data is permanently deleted or permanently anonymised.

6. AUTOMATED PROCESSING AND PROFILING

Nimatron uses automated tools, including artificial intelligence-based tools, for the following purposes:

• structuring and analysing Candidates’ questionnaire responses;
• calculating a score reflecting the Candidate’s alignment with the criteria defined by the Employer (AI assessment), whereby each question is assigned a fixed number of points multiplied by the predetermined weighting factor for that question;
• automatically categorising Candidates according to predetermined total-score thresholds;
• applying so-called disqualifying questions, whereby an incorrect answer to such a question automatically places the Candidate in a lower category, irrespective of their overall score;
• generating a bilingual (Croatian and English) AI summary of the Candidate’s application using a large language model (OpenAI GPT), including three strengths, two areas for development, recommendations, a list of skills and key responsibilities; and
• automatically selecting the five highest-scoring Candidates and displaying their percentage match with the Employer’s criteria and the Platform’s recommendation.

The criteria used for automated analysis derive exclusively from the Employer’s instructions contained in the job description and questionnaire. Nimatron does not independently determine the assessment criteria.

The final hiring decision is made by the Employer. The system is used solely as a supporting tool for ranking Candidates and providing recommendations and does not autonomously decide to reject a Candidate.

Such automated processing does not constitute automated individual decision-making within the meaning of Article 22 GDPR because it does not produce legal effects concerning the Candidate, is not the sole basis for a decision and is always subject to human review.

7. SHARING PERSONAL DATA

We process Personal Data confidentially. It is primarily accessible to the Employer that created the questionnaire and uses the Platform, and we share it with third parties only to the extent and in the circumstances expressly set out in this Section 7.

We share Personal Data with third parties exclusively in the following circumstances and only to the extent necessary for the stated purposes:

7.1. With the Employer (Controller)

When a Candidate completes and submits a questionnaire for a specific position, we forward their Personal Data (including questionnaire responses and contact details) to the Employer that commissioned the questionnaire. From the moment the Employer receives the Personal Data, it becomes an independent Controller of that Personal Data and must process it in accordance with its own privacy policy and the GDPR. Nimatron is not responsible for the manner in which the Employer uses Personal Data after receiving it.

7.2. With Service Providers (Sub-processors)

We use third parties acting as sub-processors to provide our services. We have entered into Personal Data processing agreements with all sub-processors, requiring them to comply with the GDPR and implement appropriate technical and organisational safeguards.

We currently use the following categories of service providers:

(a) Hosting/cloud infrastructure provider

Name: DigitalOcean, LLC
Purpose: Platform hosting, data storage and infrastructure services
Processing location: Germany

(b) Email delivery service provider

Name: Railsware Products Inc. (Mailtrap), with technical processing in the Czech Republic
Purpose: Sending emails (application confirmations and notifications) and, subject to Consent, marketing communications
Processing location: Czech Republic

(c) Automated text analysis service provider (LLM)

Name: OpenAI, L.L.C.
Purpose: Generating an AI summary of the Candidate’s application using the OpenAI GPT model
Processing location: United States of America

(d) Spam and automated attack prevention service provider

Name: Google LLC (Google reCAPTCHA v3 service)
Purpose: Protecting the public contact form against automated attacks (bots) and spam
Processing location: United States of America

(e) Analytics service provider

Name: Google LLC (Google Analytics 4 service)
Purpose: Platform usage analytics and advertising effectiveness measurement (subject to Consent)
Processing location: United States of America

(f) Database

Name: MySQL (database management system)
Purpose: Storing and managing Candidate, Employer Employee and Employer data within the Platform
Processing location: Germany

Nimatron updates the list of current sub-processors as changes occur.

7.3. With Competent Authorities

We may disclose Personal Data to competent authorities (including the police, courts and tax authorities) where:

• we are legally required to provide the Personal Data;
• there is a final and binding order or decision issued by a competent authority; or
• disclosure is necessary to protect our rights or the safety of Users.

Before disclosing Personal Data, we always verify the legal validity of the request. Unless prohibited by law, we will notify you of such a request.

8. INTERNATIONAL DATA TRANSFERS

We primarily store and process Personal Data within the European Union/European Economic Area (EU/EEA).

Where Personal Data is transferred to third countries outside the EU/EEA—which, in the context of our services, occurs when Candidate questionnaire responses and other Candidate data are transferred to OpenAI, L.L.C. (United States) to generate an AI summary, when technical data is transferred to Google LLC (United States) through reCAPTCHA, and when Platform usage data is transferred to Google LLC (United States) through Google Analytics following its activation—we carry out such transfers only subject to appropriate safeguards in accordance with Chapter V GDPR, including:

• European Commission adequacy decisions (e.g. the EU–US Data Privacy Framework, where applicable);
• the European Commission’s Standard Contractual Clauses (SCCs); and
• additional technical and organisational measures, where necessary.

9. YOUR RIGHTS

Under the GDPR, you have the following rights as a User:

9.1. Right of Access (Article 15 GDPR)

You have the right to request confirmation as to whether we process your Personal Data and, where we do, to obtain access to that data and information about the processing (including the purposes, categories, recipients, retention period and source of the data).

9.2. Right to Rectification (Article 16 GDPR)

You have the right to request the correction of inaccurate Personal Data and the completion of incomplete Personal Data.

9.3. Right to Erasure (“Right to Be Forgotten”) (Article 17 GDPR)

You have the right to request the erasure of your Personal Data, subject to an assessment of whether this right applies and any applicable exceptions (e.g. a legal obligation or legal claim justifying continued processing).

For Personal Data that has already been forwarded to the Employer, an erasure request must be submitted directly to the Employer as the Controller.

9.4. Right to Restriction of Processing (Article 18 GDPR)

You have the right to request the temporary restriction of processing in certain circumstances provided for by the GDPR.

9.5. Right to Data Portability (Article 20 GDPR)

You have the right to receive the Personal Data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.

9.6. Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your Personal Data.

9.7. Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on Consent, you have the right to withdraw your Consent at any time. The withdrawal of Consent does not affect the lawfulness of processing carried out before its withdrawal.

9.8. Right to Human Intervention in Automated Decision-Making (Article 22 GDPR)

In the event of automated decision-making that produces legal effects concerning you or similarly significantly affects you, you have the right to obtain human intervention, express your point of view and contest the decision.

9.9. Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

If you believe that the processing of your Personal Data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:

• Croatian Personal Data Protection Agency (AZOP)
• Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia
• Telephone: +385 1 4609 000
• Email: azop@azop.hr
• Website: www.azop.hr

9.10. How to Exercise Your Rights

You may submit any request relating to your rights as a User by emailing privacy@talentq.io.

10. DATA SECURITY

We implement appropriate technical and organisational measures to protect Personal Data, including in particular:

• data encryption;
• access controls based on the principle of least privilege;
• authentication using strong passwords and, where applicable, two-factor authentication;
• regular backups and recovery procedures;
• access logging (audit logs) and monitoring of suspicious activity;
• regular security patching;
• contractual confidentiality obligations for all persons with access to data; and
• regular GDPR and information security training for employees and contractors.

Users must keep their access credentials confidential and notify Nimatron without delay of any suspected account misuse.

11. COOKIES AND SIMILAR TECHNOLOGIES

The Platform uses cookies and similar tracking technologies to ensure that the Platform functions properly, enable usage analytics and, where applicable, measure advertising effectiveness.

We use the following types of cookies:

• Strictly necessary cookies — required for the operation of the Platform, user login and security.
• Analytics cookies — help us understand how Users use the Platform.
• Marketing cookies — used to measure advertising effectiveness and for personalisation.
• Security cookies — used to protect the Platform and its Users.

When you first visit the Platform, you will be shown a cookie banner through which you can select the categories of cookies you wish to accept. You may change your preferences at any time through the cookie settings on the Platform or through your browser settings.

A detailed list of the cookies we use is available in a separate Cookie Notice on our website at www.talentq.io.

12. MINIMUM AGE FOR USING THE PLATFORM

The Platform is intended exclusively for persons who are at least 18 years of age. We do not knowingly collect Personal Data from persons under the age of 18.

If we become aware by any means that a person under the age of 18 has submitted their Personal Data through the Platform, we will promptly cease processing, restrict access to and permanently delete their Personal Data.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Policy from time to time to reflect changes in our practices, legal obligations or new features.

We will notify Users of material changes to this Policy at least 30 days before they take effect by means of a prominent notice on the Platform and/or an email sent to the address provided when using the Platform.

Minor technical or editorial changes may take effect upon publication of a new version, with the revision date at the top of the document updated accordingly.

14. CONTACT

For any questions, complaints or requests relating to this Policy or the processing of your Personal Data, please contact us:

• Company: Nimatron d.o.o.
• Address: Sprečka ulica 19, Zagreb, Croatia
• Personal Identification Number (OIB): 27887722834
• Email: privacy@talentq.io
• Website: www.talentq.io

Zagreb, 18 June 2026