1. Data Controller
People Pons d.o.o.
OIB (Company ID): 55454122296
Address: Ulica Ive Senjanina 14a, 23000 Zadar, Croatia
E-mail: info@peoplepons.com
Phone: +385 91 514 0192
Data protection contact: dpo@peoplepons.com
2. What Data We Collect
We collect the following categories of personal data:
- Identification data: first name, last name, date of birth, OIB (personal identification number), nationality
- Contact data: e-mail address, telephone number, residential address
- Professional data: CV, work history, education, qualifications, certificates
- Documentation: copies of documents required for the recruitment process
- Technical data: IP address, browser type, device information
- Communication data: platform identifier (e.g. WhatsApp ID), the content and record of conversations with our team and our AI assistant Leo
Note on minimisation: In the initial stage we collect only the basic data required to process your enquiry. Additional data (OIB, copies of documents) are requested only when strictly necessary for a specific procedure (e.g. work permits) and at a later stage of the process.
3. Purpose and Legal Basis of Processing
We process your personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Processing the enquiry and managing the application (steps prior to entering into a contract) | Art. 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract and/or Art. 6(1)(f) – legitimate interest |
| Communication related to the application and the process | Art. 6(1)(b) and/or Art. 6(1)(f) GDPR |
| Inclusion in the talent pool | Art. 6(1)(a) GDPR – your consent (separate consent) |
| Sharing data with an employer | Art. 6(1)(a) GDPR – your consent (named employer) |
| Fulfilling legal obligations | Art. 6(1)(c) GDPR |
| System security and prevention of misuse | Art. 6(1)(f) GDPR – legitimate interest |
| Improving services (internally, without ranking candidates) | Art. 6(1)(f) GDPR – legitimate interest |
4. Use of the AI Assistant Leo
People Pons uses Leo, an AI assistant that helps with the initial communication with candidates and employers. Leo uses advanced language technology (Anthropic Claude) to conduct a natural conversation.
What Leo does:
- Conducts the initial conversation and collects the basic data for the application
- Provides information about available positions and vacancy terms
- Answers frequently asked questions about the recruitment process
- Detects a possible mismatch between the requirements of the vacancy and the data you have provided and shows you the options (human review, other positions, talent pool, withdrawal)
- Prepares a summary of the application for our consultants
If Leo identifies a possible mismatch with the vacancy requirements, it will offer you 4 options:
- Human review — your case is reviewed by our consultant
- Other positions — display of other open positions that might suit you
- Talent pool — we keep your data for future opportunities (24 months)
- Withdrawal — ending the conversation
Leo never automatically rejects applications or closes the conversation without your explicit choice.
What Leo does NOT do:
- Does NOT make hiring decisions
- Does NOT rank or score candidates
- Does NOT carry out psychological or behavioural analysis
- Does NOT reject applications automatically
Important: All decisions about candidates are made by our consultants, who review every application. You have the right to request a human review of your case at any time.
5. Recipients of the Data
We may share your data with:
- Employers — only the data of selected candidates, with your explicit consent
- Public authorities — the Ministry of the Interior (MUP), the Croatian Employment Service (HZZ) where legally required
- IT service providers:
- Anthropic (AI technology) — USA, under Standard Contractual Clauses (SCCs)
- Supabase Inc. (database) — see further details below
- Meta Platforms Ireland Limited (communication platforms — WhatsApp; and Meta Pixel for ad measurement, with consent only) — EU/USA under SCCs
- Google Ireland Limited (Google Analytics — traffic measurement, with consent only) — EU/USA under SCCs
- Microsoft Ireland Operations Limited (Microsoft Clarity — user experience analysis, with consent only) — EU/USA under SCCs
- Telegram FZ-LLC — internal notification to a consultant when a conversation with Leo is escalated. The notification may contain the candidate's first name, last name and phone number. It is not a communication channel with candidates. — UAE, under Standard Contractual Clauses (SCCs)
- MyDataKnox (web hosting and email server) — Croatia, EU
Supabase Inc. (database)
We use Supabase to store candidate data. Supabase acts in two roles:
- As a processor: Supabase stores and processes candidate data exclusively on our instructions. The data is stored in the EU region (Frankfurt, Germany).
- As a separate controller: Supabase independently processes technical data on the use of the platform (telemetry, billing, security, fraud prevention) for its own legitimate business purposes. This processing is described in detail in the Supabase Privacy Policy.
The transfer of data to the USA is secured by means of Standard Contractual Clauses (SCCs) approved by the European Commission.
6. Transfer of Data Outside the EU
Some of our service providers are located outside the European Union (USA, UAE). For such transfers we ensure appropriate safeguards:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Additional technical protective measures (encryption, pseudonymisation)
7. Data Retention Periods
| Category | Retention period |
|---|---|
| Active applications | Until the end of the process + 6 months |
| Talent pool | 24 months from consent or until withdrawal |
| Legal obligations | In accordance with the law (up to 11 years for accounting records) |
| Upon a deletion request | Without undue delay, at the latest within the statutory period (up to 30 days). As a rule we aim to act faster, but the request may require verification and administrator approval. |
8. Your Rights
Under the GDPR you have the following rights:
- Right of access (Art. 15): You may request to see all the data we hold about you. For quick assistance you may ask Leo to record your request and forward it to our data protection team. To protect your privacy, identity verification may be required for full access to the data.
- Right to rectification (Art. 16): You may request the correction of inaccurate data.
- Right to erasure (Art. 17): You may request the deletion of your data. Request deletion through Leo or contact us at dpo@peoplepons.com.
- Right to restriction of processing (Art. 18): You may request the restriction of processing in certain situations.
- Right to data portability (Art. 20): You may request the transfer of your data in a structured format.
- Right to object (Art. 21): You may object to the processing of your data.
- Right to withdraw consent: You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, contact: dpo@peoplepons.com
9. Right to Lodge a Complaint
If you believe that we are processing your data contrary to the GDPR, you have the right to lodge a complaint:
Croatian Personal Data Protection Agency (AZOP)
Web: www.azop.hr
E-mail: azop@azop.hr
Address: Selska cesta 136, 10000 Zagreb
10. Data Security
We apply appropriate technical and organisational measures to protect your data:
- Encryption of data in transit and at rest
- Role-based access control
- Regular data backups
- Employee training on data protection
11. Cookies
Our website uses cookies for:
- Essential functioning of the website (technical cookies)
- Security and prevention of misuse
- Traffic analytics (where applicable)
Non-essential cookies (e.g. analytics) are loaded only after your consent via the cookie banner on your first visit. You can change your settings at any time via the ‘Cookie settings’ option on the website.
For more information, contact us at info@peoplepons.com.
12. Changes to the Policy
We reserve the right to amend this Privacy Policy. All changes will be published on this page with the date of the last amendment indicated.
13. Contact
For all questions regarding personal data protection:
People Pons d.o.o.
Data protection contact: dpo@peoplepons.com
Phone: +385 91 514 0192
Address: Ulica Ive Senjanina 14a, 23000 Zadar, Croatia
Questions about this policy? Contact our data protection contact: dpo@peoplepons.com or phone +385 91 514 0192.