Privacy notice
This notice explains how ARA.BG EOOD processes personal data when you visit ai-people-hub.com, request a demo, become a partner or use AI People Hub as a user of a company account.
1. Who the controller is
ARA.BG EOOD (АРА.БГ ЕООД), company number (ЕИК) 203301726. For any question about personal data: office@ai-people-hub.com.
2. When we are a controller and when a processor
The employee and candidate data a company enters into AI People Hub (personnel files, leave, pay, applications and so on) is processed on behalf of that company. The company is the controller of it and we are its processor under Article 28 of Regulation (EU) 2016/679 (GDPR) — the terms are in the Data processing agreement. If you are an employee or a candidate of one of our customers, please address your request to them; we will assist them.
This notice covers the data for which we decide why and how it is processed, described below.
3. What we process, why, and on what basis
| When | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Visiting the website | IP address, browser, requested page, time | Security, abuse prevention, diagnostics | Legitimate interest — Art. 6(1)(f) |
| Statistics on the public pages | Page address, referrer, device and browser type; with your consent, also Google Analytics cookies (_ga) — see the Cookie policy | Aggregated traffic statistics | Without cookies — legitimate interest, Art. 6(1)(f); with cookies — consent, Art. 6(1)(a), which you may withdraw at any time |
| Your choice in the cookie banner | A random ID, the choice made, the policy version, the page, the time — no IP address | To demonstrate that consent was given (Art. 7(1)) | Legal obligation — Art. 6(1)(c) |
| A demo request or an HR service partner application | Name, company, work email, phone, number of employees, interest, services, message, partner code, IP address and browser | To contact you and present the product | Steps prior to a contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) |
| Ideas and votes on the public roadmap | Name and email with a suggestion; votes are counted by a hashed IP address | To review the idea and reply; one vote per visitor | Legitimate interest — Art. 6(1)(f) |
| The referral partner program | Contact and company details, referred clients, commission earned, payment details (IBAN) and, for individuals, the personal number (ЕГН) for tax purposes | The partner contract, commission payouts, accounting | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| A user account in a company profile | Name, email, role, sign-in data, two-factor authentication, activity and security log | Providing the service, account security, support | The contract with your employer and our legitimate interest — Art. 6(1)(b) and (f) |
| Billing | Payer contact details, company details, payment history | Subscription and invoices | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Support | The content of the request and contact details | To answer the request | Contract or legitimate interest — Art. 6(1)(b) and (f) |
We do not sell personal data or use it for advertising profiles. We make no automated decisions with legal effects about website visitors.
4. How long we keep it
- Demo requests and partner applications — until you ask us to delete them or object to the processing, or until we no longer need them to contact you.
- Server logs — 90 days.
- User accounts — for the term of the contract with your employer and up to 30 days after it ends, after which they are deleted.
- Accounting records and payment data — 10 years, as the Bulgarian Accountancy Act requires.
- Roadmap suggestions — while the idea is published, or until you ask for deletion.
5. Who receives the data
We use providers who process data on our behalf and on our instructions:
- hosting and email — Spaceship (servers in an EU data centre in the Netherlands (Amsterdam); email — Spacemail);
- public-page statistics — Google Analytics (Google Ireland Ltd.), with no advertising features and with cookies only if you allow them;
- payments — Stripe;
- AI features in the product — Google (Gemini API), only when a user uses such a feature;
- encrypted backups — Backblaze B2 (EU, Amsterdam).
The full list of sub-processors for our customers' data is in the Data processing agreement. We may also disclose data to public authorities where the law requires it.
6. Transfers outside the EU
Our servers and backups are in the EU. Google (statistics and AI features) and Stripe (payments) belong to groups based in the United States, and data they handle may be processed outside the European Economic Area. Both are certified under the EU–US Data Privacy Framework, and their data processing terms also include the European Commission's standard contractual clauses.
7. Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. Where processing relies on consent, you may withdraw it at any time.
Write to office@ai-people-hub.com. We reply within one month and may ask you to confirm your identity.
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg — or with the supervisory authority where you live.
8. Security
The connection to the site is encrypted (HTTPS). Sensitive documents and fields (personal numbers, ID cards, IBANs) are stored encrypted. We maintain role-based access control, two-factor authentication, audit logs and encrypted backups.
9. Changes
We may update this notice. The date and version at the top show the latest change; we will notify registered users of material changes.