Privacy Policy

1. Scope

This Privacy Policy explains how Twenty One Talents ("Twenty One Nexus," "we") collects, uses, discloses, retains, and protects personal information through https://www.twenty-one-nexus.com, https://app.twenty-one-nexus.com, sales activities, support, events, and related services.

For candidate data processed solely on behalf of a customer, the customer generally determines the purposes and means of processing and acts as the business/controller; we act as service provider/processor under our DPA. Candidates should also review the recruiting organization's privacy notice.

2. Personal information we collect

Account and business contact information: name, business email, phone, employer, role, authentication information, preferences, and billing contacts.

Customer and candidate information: resumes, employment history, education, skills, communications, interview notes, job preferences, profile data, identifiers, and information submitted or generated through workflows.

Usage and device information: IP address, device/browser, logs, timestamps, page views, feature usage, security events, cookies, and similar technologies.

Sales and marketing information: interaction with campaigns, webinar registrations, meeting notes, lead-source information, and communication preferences.

AI-related information: prompts, instructions, source documents, generated outputs, ratings, corrections, and audit logs.

Support and transaction information: support messages, recordings where disclosed and permitted, invoices, payment status, and contract records. Payment card information may be processed directly by our payment provider and not stored by us.

3. Sources

We collect information directly from users and customers; from customer-authorized integrations; from publicly available professional sources; from data/enrichment providers; from cookies and service logs; and from business partners. Customers are responsible for ensuring that data supplied to us was collected and disclosed lawfully.

4. Purposes of use

Provide, configure, secure, support, and improve the Services.

Authenticate users, manage permissions, prevent fraud and abuse, and maintain audit logs.

Match, search, summarize, draft, communicate, and automate workflows at the customer's direction.

Process billing, contracts, renewals, and customer support.

Communicate about products, events, updates, and offers, subject to applicable opt-out rights.

Comply with law, enforce agreements, protect rights and safety, and establish or defend legal claims.

Create aggregated or de-identified analytics that are not reasonably linkable to a person.

Legal bases for processing (GDPR)

Where the EU/French GDPR applies and we act as controller, we rely on the following legal bases:

Performance of a contract: to provide, configure, secure and support the Services for our customers and users.

Legitimate interests: to operate, improve and secure the Services, prevent fraud and abuse, and conduct limited B2B marketing to professional contacts; balanced against your rights and interests.

Consent: where required, for certain marketing communications and non-essential analytics; you may withdraw consent at any time.

Legal obligation: to comply with accounting, tax and other legal requirements, and to respond to lawful requests.

When we process candidate data on behalf of a customer, the customer is the controller and is responsible for establishing the legal basis for that processing; we act as processor under the Data Processing Addendum.

5. AI and automated processing

Our Services may use AI to assist with searching, drafting, summarizing, scoring, ranking, matching, and workflow automation. The customer configures and controls many of these uses. AI outputs are intended to support, not replace, human judgment.

We do not authorize customers to use the Services to make unlawful discriminatory decisions or to rely exclusively on AI where human review or candidate rights are required. Additional details appear in our AI and Automated Decision Systems Policy.

6. Disclosure of information

We may disclose personal information to:

Service providers and subprocessors that provide hosting, security, analytics, communications, enrichment, payment, customer support, and AI infrastructure.

Customer-authorized integrations and recipients selected by the customer.

Professional advisers, auditors, insurers, and financing or transaction counterparties under confidentiality obligations.

Government authorities or other parties where required by law or reasonably necessary to protect rights, security, and safety.

A successor or affiliate in a merger, financing, restructuring, or sale, subject to appropriate safeguards.

7. Selling and sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use advertising or retargeting cookies. Because there is no "sale" or "share" of personal information, no "Do Not Sell or Share My Personal Information" mechanism is required.

8. Retention

We retain personal information for the period necessary for the purposes described, including the customer-configured subscription period, contractual and legal obligations, dispute resolution, security, backups, and suppression of unwanted communications. Candidate data processed for a customer is retained according to customer instructions, the DPA, and configured retention settings.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No system is completely secure. Customers must configure access rights appropriately and protect credentials.

10. Your privacy rights

Depending on residency and applicable thresholds, individuals may have rights to know/access, correct, delete, obtain a portable copy, object to or restrict certain processing, withdraw consent, and lodge a complaint with the CNIL (the French data protection authority). We will not unlawfully discriminate against individuals for exercising privacy rights.

Submit requests through [email protected]. We may verify identity and authority. Authorized agents must provide legally sufficient authorization. Where we act only for a customer (as processor), we may direct the request to that customer (the controller).

Under the EU/French GDPR, you may exercise your rights and lodge a complaint with the CNIL (www.cnil.fr) or your local EU supervisory authority. These Services are offered to business customers and candidates internationally.

Regional rights

EEA / United Kingdom: you have GDPR/UK-GDPR rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent) and may complain to your supervisory authority (in the UK, the ICO).

United States: depending on your state (e.g. California, Virginia, Colorado, Connecticut, Texas) you may have rights to access, correct, delete and obtain a copy of personal information, and to opt out of "sale", "sharing" or targeted advertising. We do not sell or share personal information and do not use targeted-advertising cookies, so no opt-out is required; you may still exercise access/deletion rights via [email protected]. We do not discriminate against you for exercising these rights.

Other jurisdictions: where local law grants additional privacy rights, we honor them to the extent applicable. Contact [email protected] from anywhere in the world.

11. Children

The Services are designed for business users and recruitment of working-age candidates, not children under 15. We do not knowingly collect personal information from children under 15 through the public website. Customers must not use the Services to process children's information without appropriate legal review and authorization.

12. International transfers

Information may be processed in countries other than the individual's location. Where required, we use contractual or other safeguards for international transfers. Customer data is hosted by Hetzner on dedicated servers in Germany (European Union).

13. Cookies

We use only necessary cookies and privacy-friendly analytics, as described in our Cookie Policy. We do not use advertising or cross-context behavioral advertising cookies, and we do not sell or share personal information.

14. Changes

We may update this policy. We will post the updated version and revise the effective date. Material changes may be communicated through the Service or email where appropriate.

15. Contact

Privacy contact: [email protected]; 8 rue Adrien Cramail, 92500 Rueil-Malmaison, France.