Recruitment Privacy Notice

1. Who We Are

RyuHire ("we", "us") operates TalentOS to manage job applications and candidate records for our own hiring and for hiring on behalf of our clients. This notice explains how we collect, use, and protect personal data submitted through our career site, WhatsApp, Telegram, email, or any other channel we make available for job applications.

2. What We Collect

When you apply for a role or join our talent pool, we collect:

• Contact details you provide — full name, email, phone number, and LinkedIn profile if given
• Your CV/resume file and any information extracted from it (work history, education, skills, and similar details)
• Messages you send us through a supported channel (e.g. WhatsApp or Telegram), to keep a record of the conversation
• Which job (if any) you applied to, and the channel and source you came from

3. Why We Collect It

We use this data solely to evaluate your application, contact you about roles that may be a fit, and maintain a searchable record of candidates for current and future hiring needs. We do not sell personal data or share it with third parties for marketing purposes.

4. Automated Processing Of Your CV

When you submit a CV, we use an AI system (Google's Gemini) to automatically read the file and extract structured details — work history, education, skills, and similar fields — so your profile is searchable without a recruiter re-typing it by hand. This extraction does not itself decide whether you are hired, shortlisted, or rejected; every hiring decision is made by a person. If a field the system extracted looks wrong, you can ask us to correct it (see Section 8).

5. Who We Share It With

We use the following service providers to run TalentOS. Each only processes your data to provide their specific service to us — none of them are permitted to use it for their own purposes:

• Google (Gemini) — reads uploaded CVs to extract structured candidate data
• Google Cloud Storage — stores your uploaded CV file itself
• Supabase — hosts our database and candidate records (Singapore region)
• Meta (WhatsApp, Messenger) and Telegram — deliver and receive messages if you apply through one of those channels
• Resend — sends the email link used to sign in to your candidate profile

Some of these providers operate infrastructure outside Malaysia and Singapore (for example, Google's cloud regions). Where your data is transferred this way, we only use providers who commit contractually to data protection standards comparable to the PDPA.

6. How Long We Keep It

We retain candidate records for up to 3 years from your last activity with us, after which inactive records are removed unless you ask us to keep them for longer (e.g. because you'd like to stay in our talent pool).

7. If Something Goes Wrong

If we become aware of a data breach that creates a real risk of harm to you, we will notify affected candidates and the relevant authority (Malaysia's Department of Personal Data Protection, or Singapore's PDPC, as applicable) without undue delay.

8. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and the Personal Data Protection Act 2012 (Singapore), you may:

• Ask us what personal data we hold about you
• Ask us to correct inaccurate information, including anything our AI system extracted incorrectly
• Withdraw your consent and ask us to delete your record

To exercise any of these rights, email hello@ryuhire.com. We aim to respond within 21 days. Deletion requests are actioned within 30 days unless we're required to keep a record for a legal reason (e.g. an active dispute), in which case we'll tell you why.

9. Security

Data in transit is encrypted (HTTPS). Access to candidate records is restricted to authorised RyuHire staff signed in through our staff authentication system, and every staff action on a candidate record is logged. Messages sent through WhatsApp, Telegram, or Messenger are also verified as genuinely coming from that platform before we accept them.