1. General Provisions

This Privacy Policy (“Policy”) explains the rules governing the collection, processing, storage, transfer, protection, and deletion of personal data relating to individuals by Glorri LLC (“Glorri”).

This Policy applies to:

• candidates;

• company users;

• other individuals who create a Glorri account;

• individuals who use Glorri websites and digital services.

Glorri operates in accordance with the Law of the Republic of Azerbaijan “On Personal Data” and other applicable legislation. The law regulates the collection, processing, protection, and cross-border transfer of personal data.

2. What Data Do We Collect?

2.1 Candidate Data

We may collect:

• first and last name;

• information contained in passports and identity cards, including copies thereof;

• information about close relatives;

• gender information;

• address, telephone number, and other contact information;

• CV;

• work experience;

• education;

• skills;

• language proficiency;

• certificates;

• portfolio;

• job applications;

• application history;

• recruitment stage information;

• test and assessment results;

• interview information;

• evaluations;

• other information provided that is necessary for recruitment purposes.

2.2 Company User Data

We may collect:

• first and last name;

• work email;

• telephone number;

• position;

• company;

• user account information;

• roles and permissions;

• audit and activity logs.

2.3 Technical Data

We may collect:

• IP address;

• device information;

• browser information;

• operating system;

• login information;

• technical logs;

• security information;

• information obtained through cookies and similar technologies.

3. For What Purposes Do We Process Data?

Data may be processed for the following purposes:

• creating and managing accounts;

• receiving applications for vacancies;

• managing recruitment processes;

• evaluating candidate and vacancy matching;

• analyzing CVs;

• providing AI functions;

• conducting tests and assessments;

• managing interviews;

• communicating with candidates;

• reporting and analytics;

• platform security;

• resolving technical issues;

• product development;

• performing contractual obligations;

• complying with legal obligations.

4. Candidate Data Provided by Companies

When a candidate applies for a vacancy at a specific company, the information provided by the candidate is processed within that company's Glorri account. The primary purpose of such processing is to conduct and manage the relevant company's recruitment process.

Where Glorri processes such information on behalf of the company, Glorri acts as a data processor/operator.

The storage, deletion, and other processing of such data are carried out in accordance with the company's lawful instructions, contractual terms, and applicable legislation.

5. Glorri's Independent Purposes

Certain data may be processed by Glorri for independent purposes related to:

• platform security;

• technical operation;

• product improvement;

• analytics;

• service quality;

• compliance with legal obligations.

In such cases, Glorri determines the applicable legal basis for processing such data.

6. Legal Basis

Depending on the circumstances, personal data processing may be based on:

• the consent of the data subject;

• information provided by the data subject;

• legal obligations;

• performance of a contract;

• another lawful basis.

Under Azerbaijani law, except where processing is mandatory by law, the collection and processing of data may be carried out based on the data subject's consent or information provided in writing by the data subject.

Consent should specify the purpose, categories of data, processing operations, duration, and conditions for subsequent deletion or archiving.

7. Provision of Candidate Data to Employers

When a candidate applies for a specific vacancy, information necessary for the application may be provided to the employer of that vacancy.

Such information may include CVs, contact information, work experience, education, skills, test results, and other relevant recruitment information.

The provision of personal data to third parties is carried out on the legal grounds established by applicable legislation. Under Article 13 of the Azerbaijani law, as a general rule, disclosure of confidential personal data to third parties requires the data subject's consent.

8. AI and Automated Processing

Glorri may use AI technologies.

AI may be used for:

• CV parsing;

• CV analysis;

• identification of skills;

• matching candidates with vacancies;

• ranking candidates;

• generating candidate summaries;

• recommendations for HR professionals and other company users;

• other recruitment-related functions.

AI results are intended to serve as decision-support information. An AI result does not, by itself, constitute a final hiring decision. The final hiring decision is made by the relevant employer.

9. AI Providers

Glorri may use the following AI service providers to provide AI functionality:

Anthropic — Claude Sonnet
Purpose	CV parsing and analysis; skills identification; candidate-vacancy matching; candidate ranking; candidate summaries; recommendations; other recruitment-related functions
Data	CVs, vacancy information, candidate profiles, skills, information contained in passports and identity cards, including copies thereof, work experience, and other recruitment data necessary for AI functionality
Region	548 Market Street, PMB 90375, San Francisco, CA 94104
OpenAI
Purpose	CV parsing and analysis; skills identification; candidate-vacancy matching; candidate ranking; candidate summaries; recommendations; other recruitment-related functions
Data	CVs, vacancy information, candidate profiles, information contained in passports and identity cards, including copies thereof, skills, work experience, and other recruitment data necessary for AI functionality
Region	1455 Third Street, San Francisco, California 94158, U.S.A.

Candidate data, including CVs, profile information, and other relevant data, may be used by Glorri for the training and improvement of artificial intelligence models (model training).

10. Infrastructure Where Data Is Stored

Glorri uses the following technology service providers:

• Hetzner Online GmbH, Gunzenhausen, Bavaria, Germany;

• Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany;

• Cloudflare, 101 Townsend St, San Francisco, California 94107, United States;

• DigitalOcean, 105 Edgeview Drive, Suite 425, Broomfield, Colorado 80021, USA;

• Amazon Web Services, 410 Terry Avenue North, Seattle, WA 98109-5210, U.S.A.;

• Anthropic PBC, Claude Sonnet, 548 Market Street, PMB 90375, San Francisco, CA 94104;

• OpenAI, 1455 Third Street, San Francisco, California 94158, U.S.A.;

• Twilio, 101 Spear Street, Fifth Floor, San Francisco, California 94105;

• Tawk.to, Sidraba 1-19, Riga LV 1067, Latvia;

• DeBounce, Hinganemala, Sasane Nagar, Hadapsar, Pune, Maharashtra 411088, India;

• Zoho, Estancia IT Park, Plot No. 140 & 151, GST Road, Vallancherry Village, Chengalpattu Taluk, Kanchipuram District 603 202, Chennai, India;

• Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043.

Specific data storage regions are updated according to Glorri's technical configuration.

11. Cross-Border Transfer

Because Glorri uses international infrastructure, personal data may be processed outside the Republic of Azerbaijan.

The following infrastructure locations may be used:

• Nuremberg, Germany;

• Falkenstein, Germany;

• Helsinki, Finland;

• Lauterbourg, France;

• Portsmouth, United Kingdom;

• Karlsruhe, Germany;

• AWS Frankfurt, Germany, region code eu-central-1;

• DigitalOcean Frankfurt, Germany.

Cross-border transfer of personal data is separately regulated under Azerbaijani law. Such transfers are carried out in accordance with applicable legal requirements, including requirements relating to consent and data protection.

Cross-border transfers are carried out based on the User's acceptance of these Terms and online consent.

12. Data Retention Period

• For candidate data belonging to a company, Glorri does not apply a universal deletion period. Retention and deletion may instead be governed by a separate agreement with the relevant company.

• The retention period is primarily determined by the Customer or company, and Glorri retains such data in accordance with the applicable contractual terms.

• Candidate data submitted to or provided by a company may be retained for as long as necessary for the company's recruitment purposes and in accordance with the company's data retention policy, contract, and applicable law. Glorri provides functionality through the Platform that enables candidates to request deletion or modification of their data.

• Data retained by Glorri for its own independent purposes is not retained longer than necessary for those purposes.

• When the purpose for processing no longer exists and there is no other lawful basis for retention, the data may be deleted, destroyed, or, where permitted by law, anonymized.

13. Deletion of Candidate Data

When a candidate submits a request for deletion of their personal data, Glorri determines:

1. in which system the data is stored;

2. the purpose for which the data is being processed;

3. the role of Glorri or the relevant company in relation to the data;

4. whether there is a legal basis for retaining the data.

Where the data is processed on behalf of a specific company, the request may be assessed in cooperation with that company.

Where there is no lawful basis for retaining the data, the data is deleted or destroyed in accordance with the applicable procedure.

14. Backups

Data deleted from active systems may remain in backup systems for 35 days.

Once the backup retention period expires, the data is deleted as part of the backup rotation process.

15. Candidate Rights

Where provided by applicable law, data subjects have the right to request from the company to which they applied:

• information about the processing of their personal data;

• access to their personal data;

• information about the purpose of processing;

• correction of inaccurate data;

• deletion or destruction of their data;

• objection to processing;

• protection against unlawful processing;

• objection to automated processing.

16. Requests

Requests may be submitted through the electronic or other contact details of the companies to which the candidate applied.

17. Withdrawal of Consent

Where consent is required, the data subject may withdraw their consent.

Requests to withdraw consent may be submitted through the electronic or other contact details of the company to which the candidate applied.

However, where there is a separate lawful basis for processing the data, withdrawal of consent does not necessarily result in the immediate cessation of processing or deletion of the data.

18. Special Categories of Personal Data

Glorri does not encourage the submission of special-category personal data that is not necessary for recruitment purposes.

Such data may only be processed where permitted by applicable law and where an appropriate legal basis exists.

19. Security

Glorri applies appropriate technical and organizational measures to protect personal data.

Depending on the applicable circumstances, these may include:

• access controls;

• authentication;

• role-based permissions;

• security monitoring;

• backups;

• audit logging;

• vulnerability management;

• network security;

• incident response.

20. Security Incidents

In the event of a data security incident, Glorri investigates the incident, limits its impact, and takes measures in accordance with applicable legislation.

21. Personal Data Security Incident Notification Procedure

• Incident Identification and Assessment
  When an incident is identified that results in or may result in the loss, unauthorized access, disclosure, alteration, destruction, or compromise of personal data, Glorri immediately records and assesses the incident.

• Customer Notification
  If it is determined that the incident has affected or may affect Customer data, Glorri shall notify the Customer in writing within 72 hours.

• Content of Notification
  Where reasonably possible, the notification shall include:

  • the date and time when the incident occurred or was discovered;

  • the nature and description of the incident;

  • the categories of data affected or potentially affected;

  • the categories of individuals affected;

  • the known or likely consequences of the incident;

  • measures taken or planned to prevent, mitigate, and remediate the incident;

  • contact details for obtaining additional information.

• Investigation and Cooperation
  Glorri shall investigate the incident, determine its scope, and implement appropriate technical and organizational measures to mitigate risks. Where necessary, Glorri shall cooperate with the Customer and provide available additional information.

• Follow-Up Notifications
  If all information is not available at the time of the initial notification, Glorri shall provide additional information to the Customer on a phased basis as the investigation progresses.

• Documentation
  The incident, measures taken, and outcomes shall be appropriately documented by Glorri and retained for the period required under applicable law and contractual obligations.

22. Third-Party Service Providers

Glorri uses the services of the following third-party providers for the provision of its services:

• Hetzner Online GmbH;

• Contabo GmbH;

• Cloudflare;

• DigitalOcean;

• Amazon Web Services;

• Anthropic PBC, Claude Sonnet;

• OpenAI;

• Twilio;

• Tawk.to;

• DeBounce;

• Zoho;

• Google.

23. Children's Data

Glorri is primarily intended for individuals over the age of 18 who participate in the labor market.

24. Changes

This Policy may be updated from time to time.

Where significant changes are made, users may be notified through appropriate means.

25. Contact

Glorri LLC

Email: [email protected]
Phone: +994 55 815 38 74
Tax ID (TIN): 1004459901
Address: Caspian Plaza, Jafar Jabbarli 44
Website: glorri.com