Privacy Policy

2. Types of Personal Data Collected

At Novense, the following personal data is collected and processed from users registered on QIU, both candidates and recruiters, in order to generate professional profiles and facilitate connection with job opportunities:

2.1 Contact and identification data

• First and last name
• Email address
• Mobile phone number

2.2 Financial and billing data

Data necessary for the administrative, accounting and tax management of the contracted services, including:

• Identification data of the invoice holder
• Tax address
• Information related to invoicing and the payment method used

2.3 Payment method data

If payments are made through the platform, the essential data for managing the charge will be processed through:

• Credit or debit cards
• PayPal or other electronic payment platforms

QIU does not store full bank card details under any circumstances. Payments are managed through secure payment platforms that comply with the PCI-DSS security standard, and those platforms are responsible for processing payment data in accordance with their own privacy policies.

2.4 Professional and academic data

• Work experience (employment history, roles held, companies, dates)
• Academic education (degrees, educational institutions, dates)
• Special skills and professional competencies
• Language levels
• Expected salary range

The data necessary for profile creation and service provision is mandatory. Refusal to provide it will prevent proper use of QIU.

2.5 Availability and job preference data

• Availability to start
• Geographic preferences or work modality preferences (on-site, remote, hybrid)

2.6 Sensitive data (processed with special protection)

• Degree of disability
• Work permit in the country of the job offer (yes/no)

Sensitive data is always voluntary.

2.7 Automatically generated data

• Access data, logs, device identifiers and browsing data.
• Browsing data is processed in accordance with QIU’s Cookie Policy, permanently available on the website.

Important note on sensitive data: the processing of health-related data (such as degree of disability, Article 9 GDPR) is carried out only with the user’s explicit consent and is strictly limited to the purpose of adapting job offers to their specific needs, without sharing this information with third parties outside QIU.

3. Purpose of Processing in QIU

At Novense, the personal data of candidates and recruiters is processed exclusively for the following purposes, always with users’ informed consent and in compliance with applicable regulations:

3.1 Generation and optimisation of professional profiles

The data provided by users (work experience, education, skills, preferences, etc.) is used to generate and optimise professional profiles through artificial intelligence agents connected to an external provider, which is identified later in this privacy policy. This ensures that this policy is aligned with the one provided by that provider, guaranteeing maximum transparency and consistency in the processing of personal data.

Likewise, the data provided by users through their direct interaction with the AI agent, as well as the transcripts of conversations between recruiters and candidates, are used to generate and optimise professional profiles. This data makes it possible to adapt profiles more precisely to each user’s competencies, interests and expectations, always ensuring the protection of their privacy and the responsible use of the information.

The objective is to facilitate the creation of tailored and relevant CVs for the job opportunities available.

3.2 Connection between candidates and recruiters

• The generated profiles are made available to recruiters registered on QIU, in order to facilitate talent search and the adaptation of job offers to candidates’ specific needs.
• Candidate profile data may be accessible by recruiters registered on the platform for the purpose of managing selection processes or professional contact. In such cases, recruiters will process the data in accordance with their own responsibilities regarding data protection and their own purposes, and must inform the candidate when applicable.

3.3 Administrative management, billing and charges

The personal data provided by the user described in sections 2.2 and 2.3 of this policy will be processed for the following purposes:

• Managing the contractual relationship and the provision of the services offered by QIU.
• Managing billing, charges and payments for the contracted services.
• Complying with applicable legal obligations in tax, accounting and administrative matters.
• Handling inquiries, requests or incidents raised by the user.

3.4 Continuous improvement of the service

• We analyse anonymised and aggregated data to optimise the user experience, improve the accuracy of generated profiles and develop new functionalities.
• QIU uses third-party cookies for analytical and measurement purposes, based on external analytics tools, in order to obtain statistical information about platform usage, analyse users’ aggregated behaviour and evaluate the performance and effectiveness of advertising campaigns and dissemination actions carried out.

3.5 Legal compliance and security

• Processing of personal data through the use of QIU’s own technical and functional cookies, necessary to ensure the proper functioning of QIU, enable session management and user authentication, strengthen system security and prevent unauthorised or fraudulent access, and remember and apply user preferences such as language or certain usage settings.

3.6 Sensitive data (disability, work permit, etc.)

• Sensitive data, such as degree of disability or work permit, is processed only when the user voluntarily provides it and exclusively for the purpose of adapting job offers to their needs. At no time will it be used for discriminatory automated decisions.
• This data is not shared outside QIU and is subject to enhanced protection measures.

Transparency note: under no circumstances is personal data used for purposes other than those described, unless there is the user’s explicit consent or a legal obligation.

4. Legal Basis for Processing

The processing of personal data in QIU is always carried out on a clear legal basis and in accordance with the General Data Protection Regulation (GDPR). The legal bases applicable to each purpose are set out below:

4.1 Consent of the data subject (Articles 6(1)(a) and 9(2)(a) GDPR)

• Generation of professional profiles and connection with recruiters: the processing of candidates’ personal data (including work experience, education, skills, salary preferences, availability, languages and —when voluntarily provided— sensitive data such as degree of disability or work permit) is based on the user’s freely given, specific, informed and unambiguous consent, granted when registering on QIU and completing their profile.
• Sensitive data: the processing of special categories of data (such as degree of disability) requires additional explicit consent, which the user can grant or withdraw at any time from their profile, by contacting the user support channels provided by the company or by making an explicit request to the DPO.

4.2 Performance of a contract (Article 6(1)(b) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR)

• The performance of a contract to which the data subject is a party.
• The provision of the profile generation services and connection with job opportunities requires processing certain personal data (such as name, contact details, work experience and education). This legal basis applies when processing is necessary for the performance of the contract between Novense and the user (candidate or recruiter).
• The processing of billing and transaction data is based on the performance of the contract (service provision) and on compliance with legal obligations in tax and accounting matters when applicable.
• The consent of the data subject, where legally required.
• In exceptional cases, we process personal data to comply with applicable legal obligations (for example, data retention to comply with tax or judicial regulations).

4.3 Legitimate interest (Article 6(1)(f) GDPR)

• Legitimate interest is used as the legal basis for internal service improvement activities, analysis of aggregated and anonymised usage of QIU, and ensuring system security and functionality. In these cases we carry out a balancing test to ensure that our legitimate interests do not override users’ fundamental rights and freedoms.
• Users may object to processing based on legitimate interest at any time.

5. User Rights under the GDPR

QIU guarantees that all users (candidates and recruiters) can fully exercise their rights over their personal data, as detailed below:

5.1 Right of access

The user has the right to request a copy of the personal data we process about them, as well as information about the purpose of the processing, the categories of data, the recipients and the retention period.

5.2 Right to rectification

The user may request the correction of their personal data if it is inaccurate or incomplete.

5.3 Right to erasure (“right to be forgotten”)

The user may request the deletion of their personal data when it is no longer necessary for the purposes for which it was collected, or when they withdraw their consent.

5.4 Right to restriction of processing

The user has the right to request that the processing of data be restricted in certain circumstances (for example, while verifying the accuracy of the data or determining the lawfulness of the processing).

5.5 Right to data portability

The user may receive their personal data in a structured, commonly used and machine-readable format, and transmit it to another controller where the processing is based on consent or on a contract.

5.6 Right to object

The user may object to the processing of their personal data based on Novense’s legitimate interest, including profiling.

The right to object will not apply to processing that is necessary for the performance of the contract or for providing QIU’s main service, including the generation and optimisation of professional profiles, without which the service could not be provided. If the user objects to such essential processing, Novense may proceed to suspend or cancel the user’s account.

5.7 Rights related to consent

For processing based on consent (such as the use of sensitive data), consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.

5.8 Rights related to sensitive data

If sensitive data has been provided (such as degree of disability), the user may request specific information about its use and protection, as well as its deletion at any time.

How to exercise your rights

To exercise any of these rights, you can:

• Access your profile on the platform and modify or delete your data directly.
• Send a request to gdpr@qiu.live, indicating the right you wish to exercise and providing the information necessary to identify yourself.
• Contact our DPO at dpo@qiu.live for any question or complaint related to data protection.

If you believe that the processing of personal data infringes the regulations, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Response deadline: we will handle your request within a maximum of 30 days from receipt, except in exceptional cases requiring a justified extension.

6. Data Security and Retention

6.1 Security Measures

At Novense, advanced technical and organisational measures are implemented to protect our users’ personal data against unauthorised access, loss, destruction or accidental alteration. These measures include:

• Data encryption: all personal data is transmitted and stored in encrypted form, using secure protocols (TLS/SSL).
• Restricted access: only authorised staff and recruiters registered on QIU can access the data, according to their role and specific needs.
• Robust authentication: we use multi-factor authentication systems to access sensitive areas of the platform.
• Periodic audits: systematic security assessments and vulnerability analyses are carried out in order to ensure the integrity of the systems. Likewise, contracted technology providers are required to carry out security assessments and vulnerability testing on their services, with particular value placed on compliance with information security standards such as ISO/IEC 27001, NIST or PCI DSS.
• Protection of sensitive data: specially protected data (such as degree of disability) is subject to additional security measures and is only accessible for specific purposes and with explicit consent.

Likewise, based on the security and personal data protection policies of its service providers and the contractual agreements signed with them, there is a commitment to notify any personal data security breach that could affect the processing carried out, in accordance with Articles 33 and 34 GDPR.

6.2 Data Retention

Personal data is retained for as long as necessary to fulfil the purposes described in this policy, unless the law requires a longer retention period. Specifically:

• Candidate and recruiter data: retained while the user keeps their account active on QIU. After account closure or a deletion request, the data is erased within a maximum of 30 days, unless there are legal obligations requiring its retention (for example, billing or tax compliance).
• Transaction data and evidence of operation (if applicable): retained for the periods necessary to meet legal obligations (tax and accounting), manage claims and address liabilities arising from the service.
• Logs and security records: retained for the time strictly necessary for security, fraud prevention and technical audit, applying minimisation criteria and periodic review.
• Sensitive data (disability, work permits, etc.): deleted immediately upon the user’s request or when the user closes their account, unless retention is required by law.

In all cases, the periods are established in accordance with the storage limitation principle and the controller’s accountability.

6.3 Secure Deletion

When data is no longer necessary, it is securely and permanently deleted, ensuring it cannot be recovered or reconstructed.

6.4 Confidentiality Commitment

All Novense staff and external collaborators are subject to strict confidentiality obligations and have received training in data protection and the GDPR.

7. Changes to the Privacy Policy

Novense reserves the right to update or modify this Privacy Policy at any time to adapt it to legislative, case-law, technical or business model changes. Any modification will be communicated to users as follows:

• Email notification: a notice will be sent to the address registered on QIU, informing about the changes made and the effective date.
• Publication on QIU: the updated version of the policy will always be available on the website and in the “Settings” or “Privacy” section of the platform, with the date of the last update clearly indicated.
• Explicit consent for significant changes: if the changes substantially affect users’ rights or the way their personal data is processed (for example, new processing purposes or disclosure to third parties), new explicit consent will be requested before applying them.

Validity and acceptance: continued use of QIU after the changes take effect implies acceptance of the new Privacy Policy. If you do not agree with the changes, you may exercise your rights to object, erase or port your data, or close your account at any time.

Version history: a record of previous versions of this policy will be kept, available upon request at gdpr@qiu.live.

8. Data Recipients

Depending on the purpose of processing, the following categories may access personal data:

• Recruiters registered on QIU, for managing selection processes and professional contact.
• Service providers necessary for the proper functioning of QIU’s activity, in particular technology and hosting service providers that host the infrastructure where personal data is stored.
• Financial institutions and payment platforms (for example, card payment gateways or PayPal), exclusively for proper charge management.
• Public administrations and competent bodies, in compliance with legal obligations.

These providers act as processors, accessing the data only for the provision of the contracted service and following Novense’s instructions, and such access does not constitute a data disclosure. Novense has entered into the corresponding data processing agreements with these providers, in accordance with Article 28 of Regulation (EU) 2016/679.

These third parties will act as processors or independent controllers, as applicable, ensuring compliance with current data protection regulations.

9. Integration with Google Calendar or Microsoft Calendar

9.1 Purpose of the Integration

QIU offers users the possibility of voluntarily connecting their Google and Microsoft account to synchronise information between the platform and Google Calendar or Microsoft Calendar. The purpose of this integration is to:

• Create events in the user’s personal calendar from QIU.
• Update events previously created or managed from QIU.
• Allow two-way synchronisation of events between Google Calendar or Microsoft Calendar and QIU.
• Detect changes made by the user directly in Google Calendar or Microsoft Calendar in order to keep the information shown in QIU up to date.
• Improve the planning, tracking and management experience of activities associated with the user’s account.

The connection with Google Calendar or Microsoft Calendar is completely optional and requires the user’s express consent through the authorisation process provided by Google or Microsoft.

9.2 Data Accessed

When the user authorises the integration, QIU may access only the information necessary to provide the synchronisation features requested. Depending on the permissions granted, QIU may access:

• Calendar event information.
• Event title.
• Start and end date and time.
• Event description.
• Event status.
• Technical identifiers necessary for synchronisation.
• Information about changes made to events.

QIU does not access the content of other Google or Microsoft services that are not expressly related to the calendar functionality authorised by the user.

9.3 Legal Basis for Processing

The legal basis for processing the data obtained through Google Calendar or Microsoft Calendar is the user’s express consent, granted during the OAuth authorisation process provided by Google or Microsoft. The user may withdraw that consent at any time:

• By disconnecting the Google or Microsoft account from the QIU settings.
• By revoking the application’s access from the security settings of their Google or Microsoft account.

The withdrawal of consent will not affect the lawfulness of processing carried out prior to that withdrawal.

9.4 Limited Use of Google Data

The data obtained through the Google or Microsoft APIs will be used exclusively to provide the features described in this Privacy Policy and requested by the user. QIU undertakes that it will:

• Not sell information obtained through the Google or Microsoft APIs to third parties.
• Not use the data obtained for advertising purposes.
• Not use calendar data to build commercial profiles unrelated to the services provided by QIU.
• Not share the information obtained through Google Calendar or Microsoft Calendar with third parties, except where legally required or strictly necessary for the technical provision of the contracted service.

9.5 Retention of the Information

Synchronised data will be retained only for as long as necessary to maintain the synchronisation functionality and provide the contracted services. When the user disconnects their account or requests the deletion of their data:

• Synchronisation with Google Calendar or Microsoft Calendar will stop.
• Identifiers and access tokens will be deleted or invalidated.
• Stored data will be handled in accordance with QIU’s general data retention and deletion policies.

9.6 Security

QIU applies appropriate technical and organisational measures to protect the information obtained through this integration, including:

• Encryption of communications using secure protocols (HTTPS/TLS).
• Secure storage of credentials and authorisation tokens.
• Access control based on least privilege.
• Security activity logging and monitoring measures to prevent unauthorised access.

9.7 Withdrawal and User Control

The user retains control at all times over the connection between QIU and Google Calendar or Microsoft Calendar. The user may:

• Connect or disconnect their Google or Microsoft account.
• Revoke the permissions granted to QIU.
• Request the deletion of the associated data.
• Exercise the rights recognised by the GDPR.

9.8 Compliance with Google Policies

QIU’s use of information received from the Google or Microsoft APIs will comply with the API Services User Data Policy of both Google and Microsoft, including the Limited Use requirements where applicable. Information obtained through Google Calendar or Microsoft Calendar will be used solely to provide or improve the features expressly requested by the user and described in this Privacy Policy.

10. International Data Transfers

Personal data is processed entirely within the European Economic Area. No international data transfers to third countries are carried out.

Processing location:

• Hosting: Spain (Madrid).
• AI / processor: Microsoft Ireland Operations Limited.

If, due to the nature of technology or payment providers, international data transfers outside the European Economic Area are carried out, Novense will inform users and will apply the appropriate safeguards provided for in the GDPR (for example, an adequacy decision or standard contractual clauses), indicating the means to obtain a copy of the safeguards or where they have been made available.

11. Use of AI and Data Protection

At Novense, the artificial intelligence models of Azure OpenAI Service (Microsoft Azure) are used to generate and optimise professional profiles in QIU, always under strict privacy and data protection safeguards, aligned with the policies of Azure OpenAI Service (Microsoft Azure) and the GDPR.

11.1 Purpose of using Azure OpenAI Service (Microsoft Azure)

• Candidates’ personal data (work experience, education, skills, etc.) is sent to Azure OpenAI Service (Microsoft Azure) exclusively to generate and improve professional profiles, adapting them to the needs of the labour market.
• The data is not used to train Azure OpenAI Service (Microsoft Azure) models without the user’s explicit consent, nor is it shared with third parties outside QIU.
• The user has the right at all times to modify the AI-modelled profiling, as well as to request human intervention, express their point of view and contest decisions in accordance with Article 22 GDPR.

11.2 Protection Measures

• Data minimisation: only the data necessary for profile generation is sent to Azure OpenAI Service (Microsoft Azure), avoiding the processing of irrelevant information.
• Anonymisation and pseudonymisation: wherever possible, data is processed so that it does not allow direct identification of the user.
• Data protection agreements: Azure OpenAI Service (Microsoft Azure) complies with the GDPR and applies technical and organisational safeguards to ensure the confidentiality and security of the data, including selecting providers within the EU and applying contractual clauses that comply with Article 46 GDPR.

11.3 Transparency and User Control

• Users are clearly informed about the use of Azure OpenAI Service (Microsoft Azure) in the profile generation process, in this policy and at the time they register their data.
• Users may request specific information about how their data is processed through Azure OpenAI Service (Microsoft Azure), and may exercise their rights of access, rectification, erasure or objection at any time by contacting gdpr@qiu.live.

11.4 Alignment with the policies of Azure OpenAI Service (Microsoft Azure)

Novense follows the privacy guidelines of Azure OpenAI Service (Microsoft Azure), including:

• Not using users’ data to train AI models without consent.
• Ensuring that sensitive data (such as degree of disability) is not processed or stored beyond the specific purposes authorised by the user.
• Facilitating the exercise of users’ rights under the GDPR, including the right to data portability and erasure.

11.5 Shared Responsibility

Novense acts as the controller of personal data, while Azure OpenAI Service (Microsoft Azure), through its hosting and infrastructure, acts as a processor in the context of profile generation, under an agreement that ensures GDPR compliance and data protection.

12. Use of the Platform by Minors

QIU is not directed at minors under 18 years of age.

Novense does not knowingly collect personal data from minors of that age nor allow their registration or use of the services offered.

If registration or use of QIU by a minor under 18 years of age is detected, Novense will immediately delete the account and the associated personal data, without prejudice to any applicable legal obligations.