Legal

Privacy Policy

1. Who we are

The data controller for recruiter / agency / partner accounts is Archie Recruitment (sole proprietorship registered in Poland). For candidate data uploaded by recruiters or partners, we act as the data processor; the agency is the controller. Contact: info@archie-recruitment.com.

2. What we collect

• Account data: name, email, password hash, company name, role (recruiter / partner / candidate).
• Recruitment data: candidate CVs (PDF / DOCX / image), profile fields (name, contact, skills, location, work experience), short audio / video pitch (15-30 seconds, optional), application history, recruiter notes, messages exchanged on the platform.
• Operational data: usage logs, IP address, browser user agent, timestamps — for security and rate-limiting.

We do not collect health data, political views, biometric identifiers, or other special categories of personal data unless the candidate explicitly volunteers them (e.g. via custom CV content).

3. Purposes and legal bases

• Account management — contract performance (Art. 6(1)(b) GDPR).
• Recruitment workflow for agencies and partners — legitimate interest of the agency (Art. 6(1)(f)), with the agency acting as controller and us as processor.
• Candidate-side features (creating a profile, applying to a job, recording an audio / video pitch) — explicit consent (Art. 6(1)(a)), granted at each collection point.
• AI CV analysis and translation — same legal basis as the underlying recruitment workflow. The recruiter always makes the final hire decision; AI scoring is advisory only.
• Service security and abuse prevention — legitimate interest (Art. 6(1)(f)).

4. Sub-processors and data recipients

• Google LLC / Firebase — hosting, database, file storage, authentication. EU data residency (europe-west region). Standard Contractual Clauses in place.
• Anthropic PBC — Claude AI for CV analysis, translation, and vacancy generation. US-based, processes under SCCs. Anthropic does not use submitted data to train models.
• Resend Inc. — transactional email delivery (partner notifications, partnership accept, Q&A replies, billing). US-based under SCCs.
• Recruitment agencies — our paying B2B clients who receive candidate data via the platform. Their use is governed by the Data Processing Agreement (Section 3 below).

Full live list with safeguards + change history: sub-processors.html.

5. International transfers

Some processing happens in the United States (Anthropic for AI analysis). Transfers are protected by Standard Contractual Clauses approved by the European Commission, plus the supplementary measures (encryption in transit and at rest, audit logs, access controls).

6. Data retention

• Recruiter and partner accounts: retained while the account is active, plus 12 months after termination for invoicing and dispute resolution.
• Candidate profiles: retained while the profile is active. Candidates can request deletion at any time. Profiles inactive for 24 months are automatically anonymised.
• Operational logs: 12 months.
• Consent records: 6 years (in line with Polish civil-law retention for proof of agreement).

7. Your rights

You can: access your data, correct it, request deletion, request portability, object to processing, and withdraw any consent. Exercise these rights by emailing info@archie-recruitment.com. We respond within 30 days.

You also have the right to lodge a complaint with the Polish data protection authority (UODO, uodo.gov.pl) or with the supervisory authority in your country of residence.

8. Automated decision-making

The platform uses AI to score CVs and suggest matches, but no automated decision produces legal or similarly significant effects on candidates. A human recruiter always makes the final decision to invite, present, or hire a candidate.

9. Cookies and similar technologies

We use only functional cookies required for authentication and theme preference. We do not use marketing or third-party tracking cookies. No cookie consent banner is required for functional cookies.

For website usage analytics we use Plausible Analytics (Plausible Insights OÜ, Estonia, EU). Plausible is a cookieless, privacy-friendly analytics service hosted in the EU. It collects only anonymous, aggregated metrics (pageviews, referrer, country, device type) and never stores personal identifiers or fingerprints. No cookie consent is therefore required. More: plausible.io/privacy-focused-web-analytics.

10. Changes to this policy

We will email recruiter and partner accounts at least 30 days before any material change. The current version is dated at the top of this page.

11. EU AI Act — transparency notice

pick.me + Outsor use a third-party large language model (Anthropic's Claude) to read CV content and surface structured fields (name, contact, skills, experience), produce a recruiter-facing summary, translate documents on request, and generate draft vacancy text from a brief. Under the EU AI Act this counts as limited-risk AI in HR.

• No automated decision-making. Every accept / reject / hire decision is taken by a human recruiter. The AI surfaces information; the recruiter decides.
• Right to opt out. Candidates can request that their CV not be processed by the AI by emailing info@archie-recruitment.com at any time. The recruiter view falls back to raw fields the partner typed in.
• Right to human review. If a recruiter has acted on AI output you disagree with, you can request a documented human review of the same submission.
• Model not trained on your data. See sub-processor section — Anthropic's commercial terms exclude training on customer data.

Terms of Service

1. The service

pick.me is a candidate-first ATS (Applicant Tracking System) and Outsor is a partner-submission portal, both operated by Archie Recruitment from Poland. The service lets recruitment agencies manage candidates, vacancies and clients; lets partner agencies submit candidates to host agencies; and lets candidates browse jobs and manage their professional profile.

2. Who can use the service

• Recruitment agencies — sign up as recruiter, accept these terms, become responsible for the candidate data they upload.
• Partner agencies — sign up as partner, accept these terms, become responsible for candidate data they submit to host agencies.
• Candidates — sign up as candidate to apply for jobs; data is held under explicit consent and can be deleted at any time.

3. Pricing and invoicing

Subscription plans and prices are listed on pickme.work. During the MVP period invoicing is done manually by email; payment terms are Net 14 unless otherwise agreed in writing. All prices are exclusive of VAT, which is added per Polish tax law.

4. Your obligations

• Only upload data you have a legal basis to process. For recruiters and partners this means having the candidate's consent or another GDPR-compliant basis.
• Do not abuse the service (no automated scraping, no spam, no attempts to access other tenants' data).
• Respect candidate rights — deletion, portability, objection — within 30 days of receiving a request.
• Keep your account credentials confidential.

5. Our obligations & Service Level Agreement (SLA)

We commit to the following service levels for all paid Customers:

• Availability target — 99.5 % monthly uptime, measured as the percentage of total minutes in a calendar month during which the production application is reachable and responsive to authenticated requests, excluding scheduled maintenance and Force Majeure events.
• Scheduled maintenance announced at least 72 hours in advance, limited to a maximum of 2 hours per calendar month, does not count against the availability target.
• Support response targets: Severity 1 (service down / data integrity) — first response within 4 business hours; Severity 2 (major feature unavailable, workaround exists) — within 1 business day; Severity 3 (minor / question) — within 2 business days. Business hours: Mon–Fri 09:00–17:00 CET.
• Service credits for missed availability: 99.0–99.49 % → 5 % of monthly Fee; 95.0–98.99 % → 10 %; below 95.0 % → 25 % + Customer may terminate without penalty within 30 days. Customer must request the credit in writing within 60 days.
• Data protection & backups: encryption in transit (TLS 1.3) and at rest (AES-256), tenant isolation, 2FA available, audit logs, point-in-time recovery (PITR) with 7-day window (RPO 24 h · RTO 8 business hours).
• Personal Data Breach notification within 72 hours per GDPR Art. 33, by email to Customer's billing contact.
• Honour the data subject rights described in the Privacy Policy.

Full security details + transparency on what's planned vs live: outsor.work/trust.html.

6. Intellectual property

Our code, design and brand are ours. Your candidate data and your client data remain yours. AI-generated outputs (CV analyses, vacancy drafts) belong to you as the recruiter or partner who commissioned them.

7. Limitation of liability

Subject to §7.1, our total liability under these terms is capped at the sum of fees you paid us in the 12 months preceding the event giving rise to liability. We are not liable for indirect or consequential damages, including lost profits, lost opportunities or reputational harm.

7.1 Carve-outs. The liability cap and the exclusion of indirect damages do not apply to: (a) breach of confidentiality by either party; (b) Customer's payment obligations; (c) our wilful misconduct or gross negligence; (d) either party's indemnification obligations; or (e) our statutory liability under GDPR Art. 82 as Data Processor (which is governed by the DPA and applicable law and is not capped by these terms).

8. Termination

You can cancel your subscription at any time by emailing info@archie-recruitment.com. We can terminate your account for material breach (e.g. uploading data without consent) with reasonable written notice. On termination, we will export your data to you within 30 days and then delete it from our systems.

9. Governing law and disputes

9.1 Default — Polish law. Polish law applies. Disputes are resolved by the court competent for the registered seat of Archie Recruitment (currently: Lublin, Poland).

9.2 Optional — Dutch law for NL Customers. Where Customer is established in the Netherlands, the parties may instead agree in writing that Dutch law applies and the courts of Amsterdam have exclusive jurisdiction. Select this option in the signed MSA at outsor.work/msa.html §13.2.

9.3 GDPR-specific disputes. Disputes concerning GDPR / AVG obligations may, in addition to the courts above, be brought before the supervisory authority of the Customer's main establishment (NL: Autoriteit Persoonsgegevens; PL: Urząd Ochrony Danych Osobowych).

10. Changes to these terms

We will email at least 30 days before any material change. Continued use after the effective date counts as acceptance.

Data Processing Agreement

1. Subject and duration

The Controller (your agency) instructs the Processor (Archie Recruitment) to process candidate personal data exclusively for the purpose of operating the pick.me / Outsor recruitment platform on your behalf. The agreement lasts as long as the Controller's subscription is active and ends on termination, with a 30-day return / deletion window.

2. Nature of processing

The Processor stores, retrieves, transforms (including via AI analysis), transmits and deletes candidate personal data as instructed by the Controller through the platform's user interface and API.

3. Categories of data and data subjects

• Data subjects: job candidates, including those introduced by partner agencies via Outsor.
• Categories of data: identification (name, email, phone), CV content, voluntary skills and tags, optional audio / video pitch, application history, status, recruiter notes, message exchanges, location.
• No special-category data is processed unless the candidate explicitly volunteers it.

4. Processor obligations

• Process only on the documented instructions of the Controller (which include the platform's intended functionality).
• Ensure all persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures (HTTPS, encryption at rest in Firebase, access controls, rate limiting, regular backups, incident response procedures).
• Engage sub-processors only with the Controller's general authorisation, listed in the Privacy Policy, with a 30-day notice before adding new ones.
• Assist the Controller in responding to data subject requests within the platform's standard tools and exports.
• Notify the Controller within 72 hours of any personal data breach affecting their data.
• Return or delete the Controller's data at the end of the agreement, at the Controller's choice.
• Allow the Controller to audit compliance via documentary review (on-site audits are available on request for Pro / Enterprise tiers).

5. Sub-processors

Current list: Google LLC / Firebase (EU hosting), Anthropic PBC (US AI analysis under SCCs), Resend Inc. (US transactional email under SCCs). The authoritative live list with safeguards is at sub-processors.html and is updated within 24 h of any change.

6. International transfers

Where data is transferred outside the EU (primarily to Anthropic in the US), transfers are governed by the Standard Contractual Clauses approved by the European Commission, with supplementary measures (encryption in transit, no model training, audit log).

7. Term and termination

This DPA runs concurrently with the subscription. On termination, the Processor returns or deletes all Controller data within 30 days.

8. Governing law

Polish law applies. Disputes are resolved by the court competent for the registered seat of Archie Recruitment.

Outsor — commercial terms

1. The plan

• Price: €149 net per month per agency workspace. Unlimited partner sub-accounts, unlimited submissions, unlimited active vacancies.
• Founder pricing: First 5 NL agencies that sign up get €89 net per month, locked for life of the subscription.
• Annual discount: -15% if you pay 12 months upfront (€127 / mo equivalent at list, €76 at founder rate).
• Trial: 3 days, full features, no credit card. Extension on request — reply to your welcome email, we extend without a quota.

2. Billing

• Mode: B2B invoice, Net 14, bank transfer. No Stripe, no credit card.
• First invoice: Issued by Archie Recruitment within 7 days after the trial ends (or extension expires).
• VAT: Invoiced under Polish VAT rules. EU customers with a valid VAT-ID get reverse-charge.
• Late payment: Service stays active for 14 days past the invoice due date. Beyond that the workspace gates new submissions (existing data + exports stay available) until the invoice clears.

3. Cancellation

Reply STOP to any invoice email or write to info@archie-recruitment.com. We close the account at the end of the billing period, refund the unused remainder of any annual prepayment pro-rata, and export your data (CSV + per-candidate JSON) within 24 hours.

4. What's included vs not (vs pick.me Agency)

Outsor Standalone covers the partner-submission inbox, kanban, work terms tracking, hours log, invoice generation, and partner Q&A. It does NOT include: pick.me's full ATS pipeline kanban, candidates table, AI deep analysis, candidate AI matching, multi-recruiter team seats, or analytics dashboards. To unlock those, switch the subscription to pick.me Agency (€699 net / seat / mo) via the upgrade button in the sidebar.

5. NL staffing compliance (WAADI / SNA / A1) — what Outsor does & doesn't do

Outsor is a software platform. It does not place workers, does not run payroll, and does not act as an employment agency. The following table makes the boundary explicit for any Dutch agency reviewing this:

In short: Outsor is the partner-management software layer. Customer remains the legally accountable party for all Dutch staffing-law obligations. If your agency is unsure about WAADI / SNA / G-rekening obligations, talk to a Dutch tax advisor or arbeidsrechtjurist before processing your first partner-sourced worker through Outsor.

6. AVG / RODO scope

For candidate data submitted through Outsor: the host agency is the data controller, the partner agency is a joint controller for the submission stage, and pick.me / Archie Recruitment is the processor. The DPA above governs the processor relationship. Joint-controller arrangement between host and partner is implicit in the partnership accept — partners agree they share controller responsibility for what they submit.

Imprint

• Legal name: Artur Seredziuk Archie Recruitment (jednoosobowa działalność gospodarcza / sole proprietorship)
• Trading name: Archie Recruitment (operating Outsor and pickme.work)
• Country of registration: Poland
• Owner: Artur Seredziuk
• Registered address: ul. Rynek Solny 1 lok. 6, 22-400 Zamość, Lubelskie, Poland
• NIP (Tax ID): 9222957890
• REGON: 543460480
• Registry: CEIDG (Centralna Ewidencja i Informacja o Działalności Gospodarczej) — public registry, searchable at prod.ceidg.gov.pl by NIP 9222957890
• PKD (business activity code): 78.10.Z — Działalność związana z wyszukiwaniem miejsc pracy i pozyskiwaniem pracowników (recruitment and placement services)
• Start of activity: 8 December 2025
• Business email: info@archie-recruitment.com
• Privacy / GDPR contact: info@archie-recruitment.com
• Supervisory data-protection authority: UODO — Urząd Ochrony Danych Osobowych, uodo.gov.pl