EMERALD ZEBRA – PRIVACY & DATA PROTECTION POLICY

1. Introduction

Emerald Zebra Ltd (“Emerald Zebra”, “we”, “us”) is committed to protecting the privacy of all candidates, clients, and website users.
This policy explains how we collect, process, and safeguard personal data in accordance with:

• General Data Protection Regulation (GDPR)
• GDPR Article 22 on automated decision-making
• EU AI Act (2024)
• EU Platform Work Directive (2024)
• Cyprus data protection legislation

We use technology to support our recruitment services, including AI-assisted tools within our Applicant Tracking System (ATS) and other analytics platforms. All processing is conducted under strict human oversight.

2. Data We Collect

2.1 Candidate Data

• CVs, cover letters, portfolios
• Employment history, skills, qualifications
• Job preferences, salary expectations
• Communication records (emails, messages, interview notes)
• Assessment results (where applicable)
• Work eligibility and right-to-work documentation
• Interview recordings or transcripts (only with consent)

2.2 Client or Employer Data

• Contact details
• Job descriptions and hiring requirements
• Communications and feedback relating to candidate evaluation

2.3 Website, Cookies & Analytics

We collect standard website and device data for security and performance optimisation. Cookie preferences can be managed through our cookie banner.

3. How We Use Personal Data

We process personal data to:

• Provide recruitment, placement, and talent advisory services
• Match candidates to suitable roles
• Introduce candidates to clients
• Communicate about job opportunities, interviews, or applications
• Improve our services and maintain business operations
• Meet legal and regulatory requirements

We do not sell personal data.

4. AI, Automated Processing & Human Oversight

4.1 Use of AI within our ATS

Emerald Zebra uses an ATS, which includes AI-assisted features such as:

• CV parsing
• Vacancy–candidate skills matching
• Keyword-based recommendations
• Automated emails, workflow routing, and productivity tools

These features support our consultants but do not replace human decision-making.

4.2 No Fully Automated Decisions (GDPR Article 22)

We do not make recruitment decisions solely using automated processing or AI.

• There is no auto-rejection.
• All candidate profiles are reviewed by a human recruiter before decisions are made.
• Shortlisting, progress, or rejection decisions are never automated.

Where AI tools are used to support matching, the final decision remains with an Emerald Zebra consultant.

4.3 EU AI Act Compliance

AI systems used in recruitment are classified as high-risk under the EU AI Act.
We therefore ensure:

• Clear human oversight and accountability
• Transparency about the use of AI tools
• Bias monitoring and mitigation
• Accuracy and data-quality controls
• Vendor governance (ATS + other tools)

4.4 Platform Work Directive Transparency

Although Emerald Zebra is not a platform-employer, we comply with the Directive’s principles regarding:

• Transparency around algorithmic logic
• Human monitoring of candidate outcomes
• Protection against discriminatory or unfair automated decisions

Upon request, candidates may receive an explanation of how AI-supported tools contributed to any assessment.

5. Legal Basis for Processing

We process personal data under the following GDPR bases:

• Consent – when you submit a CV or apply for a job
• Contract – when we provide recruitment services to clients or candidates
• Legitimate interest – for sourcing, matching, and assessing suitability
• Legal obligations – compliance with employment, tax, audit, or regulatory requirements

Where required, we obtain additional explicit consent (e.g., for video interviews or personality assessments).

6. Sharing of Personal Data

We may share candidate data with:

• Employers seeking to hire
• Assessment providers (only when relevant to a role)
• Technology providers supporting our operations (e.g., ATS)
• Legal or regulatory authorities where required

All third parties must meet GDPR and AI Act compliance obligations.

We never share data with clients without a recruiter reviewing suitability first.

7. International Transfers

Where data is transferred outside the EU/EEA (e.g., via ATS or global clients), Emerald Zebra ensures the presence of:

• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Additional risk assessments, where required

8. Data Retention

We retain candidate data for recruitment purposes for 48 months unless:

• You request removal
• Regulatory requirements require a longer period

We may request updated consent periodically to keep your profile active.

9. Your Rights

Under GDPR and the EU AI Act, you have the right to:

• Access your personal data
• Rectify inaccurate information
• Request deletion (‘right to be forgotten’)
• Restrict processing
• Object to certain processing activities
• Data portability
• Request human intervention in any AI-supported assessment
• Receive an explanation of the role of algorithms in your evaluation

To exercise these rights, contact: jobs@emeraldzebra.cy

10. Security Measures

We use technical and organisational measures to protect personal data, including:

• Encrypted data storage
• Access controls and authentication
• Audit logs
• Vendor compliance checks
• Secure deletion and backup policies

11. Children’s Data

We do not process data of individuals under 18 for recruitment purposes.

12. Updates to This Policy

We may update this policy periodically. The most recent version will always be available on our website.

13. Marketing & Communications

Emerald Zebra may occasionally contact you with information that we believe is relevant to your professional interests, including job opportunities, industry insights, survey invitations, or updates about our recruitment services. We do this in accordance with applicable data protection laws.

When We Rely on Legitimate Interests

We may send you recruitment-related communications where:

• you have submitted your CV or applied for a role through Emerald Zebra, or
• you have engaged with our consultants regarding job opportunities, or
• you have requested information from us.

This is known as “soft opt-in”, and it allows us to share similar roles or services that may help your career development. You may opt out at any time.

Your Right to Opt Out

You can withdraw your consent or opt out of marketing communications at any time by contacting us at:

jobs@emeraldzebra.cy

Withdrawing consent does not affect recruitment-related communications necessary to provide our services.

14. Contact Us

Data Protection Officer
Emerald Zebra
12a Evripidou Street, Agia Zoni,
3031 Limassol, Cyprus

Email: jobs@emeraldzebra.cy (Subject: Privacy Officer)