1.Who we are
Kitefox SRL is the data controller for the personal data described in this policy.
| Company | Kitefox SRL, trading as Foxwork.ai |
| VAT number | BE 0688.943.171 |
| Registered seat | Rue d'Alvaux 26/A, 1360 Perwez, Belgium |
| info@kitefox.com | |
| Phone | +32 2 700 63 03 |
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions go to the address above and reach the people who can act on them.
2.What this policy covers
This policy applies to two things:
- This website, www.foxwork.ai, including the intake request form.
- Foxwork, our recruitment service, which advertises job vacancies on behalf of employers, collects applications, and helps recruiters assess them.
Where an employer instructs us to run recruitment for one of its own vacancies, that employer is a separate controller for the candidate data it receives from us. This policy describes what we do with the data. The employer's own privacy notice governs what it does after we hand the application over.
3.Personal data we collect, and where it comes from
3.1 Website visitors
- Anything you type into the intake form: name, work email address, phone number, company, the role you are hiring for, and any details you add.
- Technical data your browser sends: IP address, browser and device type, pages viewed, and the time of the visit.
3.2 Candidates using Foxwork
- Identity and contact details: first and last name, email address, phone number.
- Application content: your CV, work history, education, skills, languages, availability, and your answers to the qualifying questions attached to a vacancy.
- Assessment data we generate: a match score and a written assessment of your application against the vacancy, produced with the assistance of an AI model. See section 6.
- Correspondence: emails and reminders we send you about your application, and your replies.
3.3 Data received from Meta (Facebook and Instagram) lead ads
We advertise vacancies on Facebook and Instagram. When you submit an instant form attached to one of those job ads, Meta passes the answers you gave to us through the Meta Marketing API. That typically means your name, email address, phone number, and your answers to the vacancy questions.
We use that data for one purpose: to process your interest in the vacancy you responded to, and to contact you about it. We do not buy advertising data about you, we do not build advertising profiles, and we do not use lead data to target further advertising at you.
4.Why we use it, and our legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Processing your job application and putting you forward to the employer | Steps taken at your request before entering a contract, Art. 6(1)(b) |
| Contacting you about a vacancy you responded to, including reminders to finish an application you started | Steps taken at your request before entering a contract, Art. 6(1)(b) |
| Assessing your application against the vacancy requirements | Legitimate interests, Art. 6(1)(f): matching candidates to roles is the service both you and the employer came for |
| Answering an intake request sent through this website | Steps taken at your request before entering a contract, Art. 6(1)(b) |
| Keeping your details on file for future vacancies | Your consent, Art. 6(1)(a), which you may withdraw at any time |
| Protecting our forms against automated abuse | Legitimate interests, Art. 6(1)(f): keeping the service usable and free of spam |
| Meeting our legal, accounting and tax obligations | Legal obligation, Art. 6(1)(c) |
We do not ask for special category data (Article 9 GDPR) such as health, religion, trade union membership, or ethnic origin, and we ask you not to include it in your CV or answers. If you send it anyway, we delete it when we notice it.
5.Who we share it with
We do not sell personal data, and we do not trade or rent it. We share it with:
- The employer advertising the vacancy you applied to. This is the point of the service. They receive your application and our assessment of it.
- Our processors, who handle data on our instructions only, under a written agreement meeting Article 28 GDPR:
- Salesforce, which hosts our CRM, this website and candidate records
- Amazon Web Services, for document handling and image generation (Stockholm, eu-north-1)
- Anthropic, for the AI assessment and text generation described in section 6
- Google, for the reCAPTCHA spam filter on our forms and for the email service that delivers our messages
- Meta Platforms Ireland, for delivering job advertising and receiving lead form responses
- Public authorities, where the law requires it.
6.AI-assisted assessment
Foxwork uses an AI model to read your application and produce a match score and a written assessment against the vacancy. We want to be plain about what that does and does not mean.
- The score is decision support for a human recruiter. A person decides whether to progress, hold, or reject your application.
- We do not make hiring decisions by automated means alone, so Article 22 GDPR does not apply to our process.
- The model does not use your application to train itself. Our AI providers process the text on our instructions and do not retain it for model training.
- We do not use age, gender, or any special category data as an input. Our job advertising uses Meta's Employment special ad category, which removes age and gender targeting from the advertising itself.
- You can ask a human to review any assessment we hold about you, and you can contest it. Write to info@kitefox.com.
7.International transfers
We keep data in the European Union wherever we can. Some of our processors are established in the United States. Where personal data leaves the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses, or by an adequacy decision where one applies. You can ask us for a copy of the safeguards in place.
8.How long we keep it
| Data | Retention |
|---|---|
| Application for a specific vacancy, and the assessment of it | Up to 24 months after the vacancy closes, then deleted |
| Candidate profile kept on file for future vacancies, with your consent | 24 months from your last contact with us, then deleted unless you renew consent |
| Lead form responses received from Meta | Same as the application they relate to |
| Intake requests sent through this website | 24 months from the last message |
| Records we must keep by law, such as accounting records | As long as the law requires, currently 7 years for accounting |
9.Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and get a copy of it.
- Rectify it if it is wrong or incomplete.
- Erase it. See section 10 for how.
- Restrict how we use it while a dispute is resolved.
- Port it, receiving it in a structured, machine-readable format.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, where we relied on consent. This does not affect processing that already happened.
- Ask for human review of any AI-assisted assessment, as described in section 6.
Write to info@kitefox.com. We answer within one month, as Article 12(3) GDPR requires. We may ask you to confirm your identity first, so that we do not hand your data to someone else.
If you are not satisfied with how we handled your request, you can complain to the Belgian Data Protection Authority: Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be.
10.Deleting your data
Send an email to info@kitefox.com with the subject line "Delete my data", from the address you applied with. We will delete your candidate record, your application, your CV and any AI-generated assessment, and we will confirm in writing once it is done. We aim to complete deletions within 30 days.
This includes data we received from a Meta lead ad. If you applied through a Facebook or Instagram job ad and want that removed, the same email address handles it.
We keep only what the law obliges us to keep, such as accounting records, and only for as long as it obliges us.
11.Cookies
This website sets no cookies of its own, and carries no analytics. There is no tracking pixel, no advertising tag and no visitor measurement on foxwork.ai. Because we set nothing that is not strictly necessary, there is no consent banner to click through.
Two third parties are called when you load a page, and one more when you submit the intake form. Our cookie policy lists each of them, what it does, and how to refuse it.
12.How we protect it
- Data is held in access-controlled systems. Only staff who need it can reach it.
- Traffic to and from this site and our applications is encrypted with TLS, and this domain is served over HTTPS only.
- Candidate records are separated per recruiter, so one client cannot see another's candidates.
- Credentials are held in a secrets store, never in source code.
If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, and we will notify the Belgian Data Protection Authority within 72 hours, as Articles 33 and 34 GDPR require.
13.Children
Our services are for people of working age. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, write to info@kitefox.com and we will delete it.
14.Changes to this policy
We update this policy when our processing changes. The date at the top always shows the current version. Where a change materially affects you, we will tell you directly if we hold your contact details.
15.Contact
Kitefox SRL, Rue d'Alvaux 26/A, 1360 Perwez, Belgium. VAT BE 0688.943.171.
info@kitefox.com, +32 2 700 63 03.