Cumino privacy notice for candidates

In brief

• Who we are. ALFERCOM SRL (hereinafter “ALFERCOM”) runs Cumino, the service that creates the CV with a virtual assistant on WhatsApp, Telegram, Instagram and in the mini-app, and that brings applications to companies.
• Two controllers, each for its own part.
  • The company (or agency) running the selection decides on its own selection campaign: it is the controller for that selection, and Cumino works on behalf of the company.
  • ALFERCOM is the controller for what Cumino does for you: the CV, the other hiring campaigns, the statistics.
  • Each of the two has its own privacy notice, which you can always read with /privacy.
• Two separate consents for Cumino. You can answer yes or no to each: one for creating the CV, one for the other hiring campaigns.
• An application is not a consent. To take part in a company's campaign you read the company's privacy notice and confirm with “Apply”. You can withdraw the application whenever you wish.
• Artificial intelligence. You are talking to a virtual assistant, and we tell you right away. Artificial intelligence organises the CV and compares it with the requirements of a campaign, but it does not reject anyone: a person at the company always decides.
• Usage statistics. In the mini-app and on the web pages for candidates, statistics are switched on only if you press “I Accept” in the banner. If you then say no, we delete the data collected from that device (section 2.6).
• Withdrawing is not deleting.
  • Withdrawal stops that purpose immediately. If you wish, you can ask us to keep your profile on hold for 6 months, so you can pick up where you left off; otherwise we keep only what is needed to prove the service provided (section 5).
  • With “I'm no longer looking for work” you leave the offers. It does not delete the data.
  • Deletion (erasure (right to be forgotten), /delete) removes you from Cumino. Only an anonymous record for statistics and the proof of consents remain (section 5).
• For any request: [email protected].

---

1. Who processes the data and in what role

ALFERCOM SRL, Via Altinate 125, 35121 Padova (PD), VAT no. IT05068010288.
Data Protection Officer (DPO): [email protected].
Documents and suppliers: trust.cumino.com.

The company's privacy notice also applies to the selection: the virtual assistant and the mini-app show it before the company receives the data, and it can always be read again. If you do not know which of the two to contact, just write to [email protected]: if the request concerns the company, we forward it.

---

2. Which data, why, on what basis and for how long

2.1 CV service (controller: ALFERCOM)

• Data:
  • first name, surname, date of birth, gender, nationality, city, phone, email;
  • experience, education, skills, languages with level, certifications, driving licences, own vehicle, availability;
  • residence permit, if you state it;
  • photo, if you send it;
  • written and voice messages of the conversation;
  • generated CV and preferences about the look of the CV.
• Source: you, in the conversation with the virtual assistant or in the mini-app. The photo is present only if you send it.
• Legal basis: consent to the creation of the CV, requested at the start (Art. 6(1)(a) GDPR). Without this consent the CV cannot be created.
• Voice messages: they are used only to transcribe them. The audio file is deleted as soon as the CV is generated or the conversation starts again; the transcript stays in the profile.
• Retention period:
  • consent is valid for 12 months and is renewed with a tap; Cumino reminds you of the expiry 30, 15 and 7 days before;
  • if you withdraw consent, the service stops immediately. In the message that confirms the withdrawal we ask you whether you want us to keep your profile on hold for 6 months, so that if you change your mind it resumes where it was. If you answer yes, the profile stays for 6 months, without being used, on the basis of this choice of yours (Art. 6(1)(a) GDPR); if you answer no, or do not answer, the profile leaves Cumino immediately;
  • if consent expires without renewal, the same applies: in the reminders you can choose to renew or to have us keep the profile on hold for 6 months; if you do not answer, the profile leaves at expiry;
  • when the profile leaves, ALFERCOM keeps only the file needed to prove the service provided (section 2.5) and derives an anonymous record from it for statistics (section 2.4); the rest is deleted;
  • written messages and transcripts of voice messages are part of the profile and follow the same rules;
  • the temporary conversation memory (on ALFERCOM's server) keeps the history of a conversation for up to 30 minutes after the last message and the session data (language and session identifier) for up to 24 hours.

2.2 Application to a campaign (controller: the company)

• Data:
  • the profile and the CV;
  • the answers to the campaign's questions;
  • the stages and locations chosen, the interviews, the outcome;
  • the assessment against the requirements and the skills map (section 3);
  • the calls made by the voice assistant to arrange the interview;
  • the notes of the recruiter, which you do not see.
• How to apply: Cumino shows you the company's privacy notice and you confirm with “Apply”. It is not a consent: it is your request to be assessed for that campaign (pre-contractual measures, Art. 6(1)(b) GDPR; art. 111-bis of D.Lgs. 30 giugno 2003, n. 196, “Codice in materia di protezione dei dati personali” (Italian Data Protection Code), hereinafter “Codice privacy”). Cumino records that you have seen that version of the privacy notice and have applied.
• Legal basis and retention periods: the company decides them and states them in its own privacy notice. If you withdraw the application, the company no longer contacts you and keeps what is needed to document the selection and defend itself, for the period it states.
• Until you confirm with “Apply”, the company sees your name and the status of the application, because you entered its campaign, but does not see the CV or the answers. If you do not apply, the CV is created anyway and you can apply later.
• Special categories of personal data: membership of protected categories or health data are asked only in the campaigns that the company dedicates to protected categories or to disadvantaged workers, when a rule requires it (targeted job placement, L. 12 marzo 1999, n. 68 (Italian law on the right to work of persons with disabilities); art. 10, comma 2, D.Lgs. 10 settembre 2003, n. 276 (Italian legislative decree on employment and the labour market)). The company chooses the questions and is accountable for them, on the basis of Art. 9(2)(b) GDPR. Before the question the assistant warns that these are special data and that the answer is optional; the data are stored encrypted and are seen only by those at the company who need them. If you write information about your health on your own initiative, the assistant does not record it in the profile.

2.3 Other hiring campaigns (controller: ALFERCOM)

• Data: the profile and the preferences (what type of work, where, with what contract and what hours).
• Legal basis: consent to the other hiring campaigns, separate from the one for the CV (Art. 6(1)(a) GDPR).
• What happens:
  • if you consent, your profile, without name and without contacts, enters the pool that Cumino's client companies consult for their own campaigns;
  • you state your preferences (what work, where, with what contract and what hours, the minimum salary) and the channel on which to receive requests;
  • a company that has created a campaign can ask you, through Cumino, whether you want to take part. Your name and contacts pass to the company only if you, having read the company's privacy notice, confirm with “Apply”: from that moment it is an application like those in section 2.2;
  • the companies that use Cumino to look for candidates are employment agencies and ALFERCOM's client companies; the list of categories is at trust.cumino.com;
  • there is only one consent for all the other campaigns; the choice is made campaign by campaign with “Apply”.
• Withdrawal: the profile is no longer visible to companies and the requests stop immediately. As with the CV, you can ask us to keep the preferences on hold for 6 months, to reactivate consent without writing them again; otherwise they are deleted.
• Retention period: as long as consent is active.
• Never for advertising: these data are never used for commercial communications, neither by ALFERCOM nor by others.

2.4 Research centre and statistics (controller: ALFERCOM)

• Purpose: internal statistics on the labour market and on how the service works, for example the number of candidates by profession and by city, timings, drop-outs, outcomes. Never for advertising.
• When a profile leaves Cumino (after a withdrawal or an expiry, or with erasure), ALFERCOM derives an anonymous record from it and deletes the rest:
  • what remains, in generalised form: the age band (in 5-year bands), gender, nationality (by geographic area if rare), province (the region if rare), whether there is a permit to work, professions as codes, the sector and the years of experience in bands, the level and the field of study, skills by groups of the ESCO classification, languages, driving licences, work preferences, the channel and the year;
  • what does not remain: name, contacts, tax code, photo, CV, free text (messages, transcripts, descriptions), names of companies, precise dates, protected categories and health data;
  • every combination of age, gender, nationality, province and profession applies to at least 5 people, and the record is not linked to the profile or to the other data: for this reason it does not allow you to be recognised and it is anonymous data (recital 26 GDPR). ALFERCOM keeps it without time limit, only for statistics, and checks the risk once a year.
• Legal basis for creating the record: ALFERCOM's legitimate interest in understanding and improving the service and the labour market (Art. 6(1)(f) GDPR). The outcomes of campaigns (suitability, interview, hiring) enter the record only as categories and with the authorisation of the client companies, provided for in the contract.
• Withdrawal: withdrawing a consent does not stop these statistics, because they are made on anonymous data.
• Objection: you can object to the creation of the record by writing to [email protected] (Art. 21 GDPR); in that case ALFERCOM does not create it.

2.5 Security, consent register and legal obligations (controller: ALFERCOM)

• Data:
  • the consent register: for each choice, a code that identifies you (not your phone or email), the purpose, the action (given, refused, withdrawn, renewed, expired), the exact text shown, the version of the privacy notice, the date and time, the channel, who made the choice and the language;
  • when the profile leaves, the file needed to prove the service provided: the consent register, the dates of the service, the versions of the CV, the submissions to companies and the latest version of the CV, with restricted access;
  • technical logs and session identifiers.
• WhatsApp link to the mini-app: the link binds to the first phone that opens it and, once opened, is valid for 90 minutes. To recognise the phone, the mini-app sets a technical cookie, “cumino_twa_device”, which is used only for the mini-app's requests, cannot be read by the page and lasts 24 hours. The cookie is necessary for the security of the service you requested, so it does not require your consent. In the database only the hash of the cookie and the hash of the number remain, not the number in clear; every night the rows of links that expired more than a week ago are deleted (a link is valid for 24 hours at most).
• Legal basis: obligation to prove consent and its withdrawal (Art. 7(1) GDPR; accountability principle, Art. 5(2) GDPR); legitimate interest in security and in defence in legal proceedings (Art. 6(1)(f) GDPR), even after erasure, to establish, exercise or defend a legal claim (Art. 17(3)(e) GDPR); legal obligations (Art. 6(1)(c) GDPR).
• Retention period:
  • the consent register stays as proof even after a withdrawal or an erasure; the service file stays after a withdrawal or an expiry, not after erasure. They are kept for the duration of the processing and 5 years after. After erasure the register does not contain your name: email and phone remain only as an irreversible hash, which ALFERCOM can compare, with a key kept separately, if it has to prove a consent;
  • technical logs are kept for 12 months at most.

2.6 Usage statistics and error detection (controller: ALFERCOM)

• Purpose: to understand how the virtual assistant, the mini-app and the web pages are used, and to find errors in order to fix them. Never for advertising, never to assess you.
• Tool: PostHog (section 4).
• In the mini-app and on the web pages for candidates (the company's privacy notice, consent renewal):
  • PostHog is switched on only with your consent, which you give with “I Accept” in the banner that appears on the first visit. Legal basis: consent, Art. 6(1)(a) GDPR and art. 122 of the Codice privacy;
  • without your consent PostHog does not load, does not send anything and does not save anything on the device;
  • you can change your choice at any time with “Change your choice about statistics”, at the bottom of the main page of the mini-app. If you answer no, PostHog stops collecting data and ALFERCOM deletes the data already collected from that device, events and recordings; only a note of the “no” remains on the device;
  • PostHog collects the pages viewed, the clicks (without the text or the attributes of the elements), technical errors and the session recording, in which texts and filled-in fields are masked. Page addresses arrive without parameters. PostHog never receives your name, contacts, photo, the text of the CV or the access codes of the WhatsApp or Telegram link.
• In the virtual assistant (on WhatsApp, Telegram and Instagram): PostHog collects the steps of the journey, for example “CV generated”, with a pseudonymous code calculated by the server instead of the phone number; the number cannot be derived from the code. Legal basis: ALFERCOM's legitimate interest in making the service work and improving it, Art. 6(1)(f) GDPR. You can object by writing to [email protected].
• Retention period:
  • events are kept for 24 months, then only the totals remain; session recordings are kept for 30 days;
  • with erasure ALFERCOM also deletes the events of the virtual assistant with your code.

2.7 Cookies and browser storage

The mini-app and the web pages for candidates save on the device only:

Technical cookies and storage are necessary for the service you requested and do not require consent (art. 122 of the Codice privacy).

---

3. Artificial intelligence

You are talking to a virtual assistant. We say so at the start of the conversation and at the start of every call (Art. 50 of Regulation (EU) 2024/1689 (AI Act) on artificial intelligence). If you ask, the assistant confirms that it is an artificial intelligence.

What artificial intelligence does not do:

• it does not reject anyone and does not decide: the suitability and the skills map are an aid for the recruiter, who sees the reason for each assessment and decides personally. There are no decisions based solely on automated processing (Art. 22 GDPR);
• it does not recognise emotions;
• it does not carry out biometric analyses;
• it does not infer origin, health, opinions or other protected characteristics.

It is profiling (Art. 4(4) GDPR), because it assesses professional aspects concerning you. For this reason you can:

• ask why you received a certain assessment;
• correct your CV;
• ask that a person at the company review the assessment;
• contest it.

You can send your requests to the company of the campaign or to [email protected], which forwards them.

Only what is needed goes to the artificial intelligence model. For the skills map only the professional part of the CV goes: no name, contacts, date of birth, nationality, gender or photo.

Artificial intelligence suppliers:

• the models arrive through Vercel AI Gateway (models of OpenAI and Google);
• transcription and numerical representation of texts (embedding): OpenAI;
• voice assistant: ElevenLabs.

ALFERCOM uses the services in the business version, and the data are not used to train the suppliers' models:

• OpenAI and Google do not use for training the data received through their services for businesses (API);
• for ElevenLabs the use of data for training is excluded in the settings of ALFERCOM's account.

---

4. Who receives the data

• The company of the campaign you apply to, after you have seen the company's privacy notice.

• Other companies only if you answer “Apply” to one of the other hiring campaigns. Before that they see only the profile without name and contacts (section 2.3).

• ALFERCOM's suppliers that act as processors, under contract:

  • servers and database: Hetzner, Germany;
  • network and protection: Cloudflare;
  • artificial intelligence: section 3;
  • telephony: Twilio;
  • email: Resend;
  • messages on WhatsApp, if you choose WhatsApp: Meta, with the WhatsApp Business Platform;
  • technical errors: Sentry;
  • usage statistics and error detection: PostHog, servers in the EU (section 2.6);
  • addresses and maps: Mapbox;
  • the company's calendar and video calls, if the company connects them: Microsoft 365.

  The complete list, with location and safeguards, is at trust.cumino.com.

• The messaging apps you choose, Instagram (Meta) and Telegram: they process the messages as independent controllers, according to their own privacy notices.

• OpenStreetMap, only if in the mini-app you use your location to fill in the city: your device sends the position to the Nominatim service of the OpenStreetMap Foundation (United Kingdom, a country with an adequacy decision of the European Commission), which returns the name of the city and processes the data according to its own privacy notice.

• The authorities, when the law requires it.

5. Withdrawal of consent, withdrawal of an application, “I'm no longer looking for work” and deletion (erasure)

These are four distinct actions.

• Withdrawal of a consent. You can do it at any time, from the mini-app, from the virtual assistant or by email, as easily as you gave the consent. Withdrawal stops that purpose immediately and does not affect what was done before.
  • CV service: ALFERCOM no longer creates or edits the CV. If you ask, the profile stays on hold for 6 months; otherwise it leaves immediately (section 2.1).
  • Other campaigns: the profile is no longer visible to companies and the requests stop. If you ask, the preferences stay on hold for 6 months (section 2.3).
• Withdrawal of an application. You can withdraw the application to a campaign at any time: the company no longer contacts you and keeps what is needed to document the selection, for the period it states in its own privacy notice (section 2.2).
• “I'm no longer looking for work”. You leave the offers and the contacts. It is not a withdrawal and does not delete the data.
• Deletion (erasure). You can ask for it with /delete, from the mini-app or by email.
  • ALFERCOM removes your data from all its own systems: profile, CV, photo, conversations, import files (these are deleted anyway after 7 days), usage statistics events of the virtual assistant.
  • The applications with companies, within Cumino, also lose your data: they remain as masked rows with the status “Erasure”, outside the lists and exports, so that the company knows it must no longer look for you. The contract between ALFERCOM and the companies provides for this, and the companies are notified (Art. 19 GDPR).
  • If a company had exported your data outside Cumino, for example into its own system, the company is responsible for that copy: ALFERCOM notifies it of your request.
  • Only the anonymous record for statistics (section 2.4) and the proof of consents (section 2.5) remain.

What remains after a withdrawal, and on what basis:

• the profile, the CV, the messages and the transcripts: 6 months, only if you ask for it (Art. 6(1)(a) GDPR); then, or immediately, they leave Cumino (section 2.1);
• the preferences for the other campaigns: the same (section 2.3);
• the application with a company: to document the selection, on the basis and for the period that the company states in its own privacy notice (section 2.2);
• the anonymous record for statistics: without limit, because it is not personal data (section 2.4);
• the consent register and the service file: to prove consent and defend a right (Art. 7(1), Art. 5(2) and Art. 17(3)(e) GDPR; Art. 6(1)(c) and (f)), for the duration of the processing and 5 years after (section 2.5);
• technical logs: 12 months at most (section 2.5).

ALFERCOM never uses these data for commercial communications.

6. Transfers outside the European Union

Some suppliers are based in the United States (sections 3 and 4). The data reach them only with one of the safeguards provided for by the GDPR (Arts. 44 et seq.): for certified suppliers, the EU-US adequacy decision (EU-US Data Privacy Framework); in other cases, the standard contractual clauses of the European Commission. The detail for each supplier is at trust.cumino.com.

7. Rights

For the data of which ALFERCOM is the controller, you can ask at any time:

• to access the data and obtain a copy;
• to correct or complete them;
• to delete them (erasure);
• to restrict their processing;
• to receive them in a format readable by a computer (portability);
• to object to processing based on legitimate interest, including statistics;
• not to be subject to decisions based solely on automated processing (Cumino takes none).

How: in the virtual assistant with /privacy and /delete, in the mini-app, or by writing to [email protected]. We reply within one month. If the request is complex, we can extend the deadline by two months, and in that case we inform you of the extension.

Complaint: you can contact the Garante per la protezione dei dati personali (the Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma (www.garanteprivacy.it), or a court.

8. Is providing the data mandatory?

No. Without consent to the CV service, however, it is not possible to create the CV; and without the essential data of a CV (name, a contact, at least one experience or one education entry) it is not possible to complete it. If you say no to the other hiring campaigns, nothing changes for the application to the current campaign.

9. Changes

If the privacy notice changes, the new version appears on this page, with the date. If the change concerns a consent already given, we ask for it again.