Privacy Policy of VEXXA Work

The controller is the one who determines the purpose and method of processing personal data. VEXXA Work is therefore the controller of the processing of personal data that users enter into the system. If users decide to apply for a job, the company becomes an independent controller of the personal data it decides to process, for example by copying it into its own systems.

VEXXA Work is the data controller for the processing of personal data used for matching, filtering, and scoring of profiles in the talent pool. Once talents accept an invitation from talent seekers for a specific position, the application process begins, and from that point on the talent seekers become the data controllers for the personal data they choose to process.

Users themselves provide personal information to VEXXA Work by registering in the system, either through the app or the website. In some cases, especially for company employees, managers can create access for their employees, and registration in such cases is typically based on the consent or employment agreement of those individuals.

VEXXA Work collects and processes the personal information necessary to connect individuals and companies. We may collect the following personal information:

3.1 Information provided by users — identification information: name, address, phone number, and email address.

3.2 Information about applicants.

3.2.1 Details entered in your CV or cover letter: such as education, employment history, language skills, and references.

3.2.2 Communication information: records of your communications with VEXXA Work or company employees regarding job applications.

3.2.3 Recruitment information: hiring date, employment ratio, and other details companies may request during a hiring process.

3.3 Information related to the talent pool.

3.3.1 In addition to completing their profile, talents provide additional information related to job preferences, such as skills, terms of employment, working conditions, and a CV (if not already linked to the profile).

3.3.2 VEXXA Work uses the above information to match talents with talent seekers as follows:

3.3.2.1 First, the information is filtered based on the data submitted in profiles. Personal data such as age, gender, nationality, or religion is not used for matching.

3.3.2.2 Next, the filtered information of talents who pass the initial screening is sent to a third-party AI service that reads, scores, and matches the information with job descriptions.

3.3.2.3 The AI evaluates relevant factors, such as education and work experience, and selects a group of talents based on the results. Selected talents receive an invitation to express interest in a specific job, and talent seekers are granted access only to the profiles of those selected — no others.

We use cookies to analyze website and app traffic, gathering data like the pages you visit, session duration, page views, and more. Refer to our cookie policy for further details.

Activity within the VEXXA Work system: when you use the platform we collect information such as job application summaries, messages between you and employers, application status, and saved jobs.

Device information: if you report technical issues, we receive information about the app version, your device, operating system, browser, and other information necessary to fix software errors and improve our products and services.

We use your device's IP address to protect our legitimate interests and to resolve technical issues.

Other information: we may process additional information necessary for providing services or protecting legitimate interests; the above is not exhaustive.

We process your personal data to provide you with our platform's services, including:

1. Authenticating your access to the VEXXA Work system.
2. Collecting relevant information users register in their profile or attach to it, such as a CV and cover letter, so that companies can properly assess applications and applicants can improve their chances of getting the job they want.
3. Collecting additional information, cf. section 3.3.1, for the talent pool in order to match talents and talent seekers using filters and artificial intelligence.
4. Communicating with you and enabling you to communicate with other users of VEXXA Work.
5. Developing our products and services.
6. Conducting marketing and promotional activities for VEXXA Work, such as an electronic newsletter about our services and announcements about planned changes or improvements.
7. Performing statistical analysis, such as when a new service is added or to improve existing services.

We process personal data based on user consent, contract fulfillment, legal obligations, and the legitimate interests of VEXXA Work or a third party, i.e.:

• To contact you regarding a mutual business relationship, including direct marketing;
• To improve our service;
• To correct errors that occur during the use of our service;
• To ensure backup and recovery of systems and data when systems fail;
• To defend the legal claims of VEXXA Work and our customers;
• To assess the quality of our service based on satisfaction surveys that you answer;
• To evaluate the effectiveness of marketing that you have been involved in; and
• To ensure efficient customer service and work execution.

VEXXA Work places emphasis on the security of personal information through both organizational and technical measures. The system is designed with security and data protection in mind. Users register their own personal information and can log in at any time to delete or modify information on their profile.

We strive to ensure that third-party software we use complies with data protection law. We assess information security risks and take measures where needed, including access control, processing agreements, network security solutions, and confidentiality obligations of employees.

In the event of a security breach, we follow predetermined procedures, such as notifying the Data Protection Authority, and if the breach poses a high risk to the rights and freedoms of individuals, we will inform you about it.

If you believe that your personal information is at risk, or that someone has accessed your password or other information, please contact us at info@vexxawork.com.

When applicants apply for jobs, their personal data is shared with employees of the companies advertising the position, whether in Iceland or abroad. Similarly, the personal data of talents is shared with talent seekers when they are matched with job descriptions, express interest, and are selected. Employees of VEXXA Work also have access to users' personal data as needed for the performance of their duties.

In the talent pool, we send talent information to a third-party AI service that matches it with job descriptions, as described in section 3. Such third parties are data processors, and a specific data processing agreement is in place with them.

For the purpose of developing and supporting our services, we may grant developers, maintenance and support providers, marketing service providers, and cloud service providers access to users' personal information. These parties are processors for VEXXA Work and we conclude specific processing agreements with them.

Your personal data may also be transferred to our legal advisors for contract negotiation or dispute resolution, and to external audit and tax advisors. In such cases we take appropriate measures to ensure the security of personal data.

We ensure that processing of your personal data takes place within the European Economic Area or in countries considered to provide adequate protection according to the Data Protection Authority.

In addition, we may provide authorities or others with personal data where based on legal obligations, contractual provisions, or legitimate interests of ours or a third party.

VEXXA Work processes your personal information for as long as it is necessary and relevant to achieve the purpose of the processing, or where required by legal obligation or legitimate interests of VEXXA Work or a third party.

Users can choose to remove/delete personal information on their own profile whenever they want. If you do so, the information immediately disappears from the website/app, but we store it in our database for an additional thirty days so it can be recovered, for example if deleted by mistake. After thirty days, the information is deleted and can no longer be retrieved.

If you participate in the talent pool, information related to AI-based matching is stored for three months. This is done to maintain transparency and fairness — for example, to respond to requests for information about the matching process or to comments.

If you pause your participation in the talent pool, the additional information you provided is still retained, but your data will no longer be used for matching.

If you delete your participation in the talent pool, the additional information you provided will be permanently deleted, unless there is a specific reason to retain it.

VEXXA Work will delete your personal information if (i) it is no longer necessary for the purpose for which it was collected, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate reasons, (iv) deletion is required by legal obligation, or (v) you have withdrawn your consent.

In some cases it may be necessary to store some personal data for a longer period, especially to protect our legitimate interests or due to a legal obligation. In such cases we only store what is necessary and delete it as soon as possible.

Data protection legislation grants various rights to registered individuals, including the right to information about whether and how we process your personal data. Such rights may be subject to limitations arising from law, the interests of others, or the legitimate interests of VEXXA Work.

If there are no limiting circumstances, VEXXA Work will comply with requests regarding the rights below free of charge, unless the request is unfounded or excessive. Individuals must prove their identity when seeking to exercise their rights.

10.1 Right of access and right to data portability

You have the right to know whether VEXXA Work processes personal data about you and to access that information. When data is processed based on consent or a contract, you have the right to receive the information you provided to us, and you can request that it be sent directly to another data controller where technically feasible.

10.2 Right to correction and deletion

In most cases, users can themselves correct and delete their personal data in the VEXXA Work system. Where this is not applicable, you can request that incorrect or unreliable information be corrected. In certain cases, you may have the right to have specific personal data deleted.

10.3 Right to object to or restrict processing

You have the right to object to processing due to your particular circumstances when it is based on legitimate interests, and to object to processing for direct marketing purposes, in which case such processing will stop. Under certain circumstances you can also request a restriction on processing.

The talent pool involves automated processing using filters within VEXXA Work and a third-party AI service that matches talent information with job descriptions. Final hiring decisions are made by the talent seekers' staff.

Results are stored for three months and may be reviewed to provide explanations on request, by contacting info@vexxawork.com. If a user has deleted their data from the talent pool, it will not be possible to provide this information.

If you have inquiries or comments regarding the processing of personal data at VEXXA Work, you can send an email to info@vexxawork.com. You also have the right to complain to the Data Protection Authority in case of a dispute regarding the handling of your personal data. However, we hope you will contact us first so that we can assist you. If you choose to go directly to the Data Protection Authority, you can email postur@personuvernd.is.

VEXXA Work reserves the right to review and modify its data protection policy as necessary to reflect the processing of personal data at any given time. Changes will be announced on the VEXXA Work website/app.