CADRO Privacy Policy

1. Who is responsible for your data

The employer company you applied to, or which added you to its candidate database, is the controller of that data and decides why it is processed. CADRO processes such data as a processor on behalf of the company.

For the candidate cabinet account and the public talent-pool profile, CADRO (the service operator at https://cadro.waf.com.ua) is the data controller.

2. What data we process

• Application data: name, contacts (email, phone), CV and details extracted from it (experience, education, skills, languages), profile links, screening answers, recruiter comments and stage statuses.
• Cabinet account data: email, name and profile picture received from your Google account at sign-in, last sign-in date.
• Public talent-pool profile: only what you filled in and switched on yourself (position, skills, location, salary expectation, experience summary, optionally name and contacts).
• Data of company staff: name, email, role, actions in the system.
• Technical data: IP address, browser type, request logs, session and interface-language cookies.

3. Google sign-in and Google Calendar integration

When you sign in with Google we request only basic profile data: email address, name and picture. We use them to authenticate you and, in the candidate cabinet, to find applications submitted from that address. Signing in does not grant calendar access. We do not request access to your Google mail or contacts.

Google Calendar integration is optional and is connected separately by a staff user in CADRO Settings with their consent. CADRO creates, updates and deletes interview events in the connected user’s primary calendar and generates Google Meet links. Event details sent to Google include the interview title, date and time, vacancy title, candidate and interviewer names and email addresses, and a link to the candidate record in CADRO. Google Calendar sends invitations and updates to the selected participants.

To synchronize interviews, CADRO stores the connected Google account email, encrypted access and refresh tokens, connection status information, Google event IDs and meeting links. Disconnecting Google Calendar in Settings removes the saved integration credentials and sends Google a request to revoke authorization. Previously created events are not automatically deleted; you can manage them in Google Calendar. Interview records, event IDs and meeting links remain subject to the retention and deletion rules for the corresponding data in CADRO.

Our use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We use this data for the sign-in and calendar features described here, do not sell it and do not use it for advertising.

4. Purposes and legal bases

• Reviewing your application and communicating about it — based on the consent you gave when applying, or on the employer’s legitimate interest if the CV arrived another way.
• Candidate cabinet — based on your consent and to provide the features you use.
• Public talent-pool profile — solely on your explicit consent: the profile stays hidden until you switch it on; contacts of an anonymous profile are revealed to a company only after you accept its invitation.
• Service security, abuse prevention and legal compliance — legitimate interest.

5. Who we share data with

• Employer companies you applied to or whose talent-pool invitation you accepted.
• Infrastructure providers acting on our instructions: hosting, file storage, email delivery.
• Google and the selected interview participants receive event details when a staff user connects Google Calendar, as described in section 3.
• Public authorities — only where the law requires it.
• We do not sell personal data and do not use it for advertising.

6. Retention

• Application data is kept while the hiring process lasts and up to 12 months afterwards for similar vacancies, unless you withdraw consent earlier.
• Cabinet account and public profile — until you delete them or ask us to.
• Technical logs — up to 12 months.

7. Your rights

• Access, correct or delete your data.
• Withdraw consent at any time: in the candidate cabinet with the “Revoke consent” button next to an application, or by email to [email protected]. Withdrawal does not affect the lawfulness of processing before it.
• Hide or delete your public profile, decline a company’s invitation.
• Lodge a complaint with a data-protection authority.

8. Cookies

We use only strictly necessary cookies: a session cookie for sign-in and cookies for interface language and theme. There are no third-party advertising or analytics trackers.

9. Security

Data is transferred over HTTPS, sessions are protected by httpOnly cookies, company data is isolated between companies, and CV files are available only to authenticated users of the respective company.

10. Age

The service is intended for persons aged 16 and over.

11. Changes to this policy

We may update this policy; the current version is always available at https://cadro.waf.com.ua/privacy with the update date at the top.

12. Contact

For personal-data questions write to [email protected].