Electronic commercial communications: unsolicited commercial communications sent by electronic means to individuals who are not existing clients will only be sent with your prior, express and informed consent, in accordance with Art. 21 of Law 34/2002 on Information Society Services (LSSI-CE). Vizzuality does not currently send such communications.
5. Recipients of your data
We share your personal data only with the following categories of recipients, all of whom are bound by written agreements and, where they act as processors, by Data Processing Agreements that meet the requirements of Art. 28 GDPR:
Service providers acting as processors
Google LLC (United States) — provider of Google Workspace (email and documents used for internal communications), Google Meet (used for remote interviews), Google Analytics (website audience measurement) and Google reCAPTCHA (anti-bot protection on forms). Transfers to the United States are covered by the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses.
Bamboo HR LLC (United States) — provider of our Applicant Tracking System, used for recruitment purposes (see Section 9). Transfers to the United States are covered by the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses.
Webflow, Inc. (United States) — provider of our website hosting and content management platform. Transfers to the United States are covered by the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses.
Cloudflare, Inc. (United States) — provider of content delivery, security and anti-bot services (Turnstile) for our website. Transfers to the United States are covered by the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses.
Finsweet Pty Ltd (Australia) — provider of Consent Pro, our cookie consent management tool. Transfers to Australia rely on Standard Contractual Clauses where required.
A current list of processors is available on request.
Other recipients
Vizzuality staff involved in the relevant process (for example, hiring managers, team leads, People Operations or client account managers) may access your data on a need-to-know basis, bound by strict confidentiality obligations.
Public authorities (tax and social security authorities, courts, law enforcement) may receive your data where disclosure is required by law. Such authorities act as independent controllers.
We do not sell, rent or otherwise make your personal data available to any third party for marketing purposes.
6. International data transfers.
Some of our processors — notably Google LLC, Bamboo HR LLC, Webflow, Inc. and Cloudflare, Inc. — are located in the United States. Transfers of personal data to the United States are therefore carried out under the following safeguards:
- The EU–US Data Privacy Framework, where the recipient is certified under it;
- Standard Contractual Clauses adopted by the European Commission, together with supplementary technical and organisational measures appropriate to the risk.
You may request a copy of the applicable safeguards by writing to hello@vizzuality.com.
7. Automated decision-making and artificial intelligence.
We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects. All decisions that affect you in a material way — including, in particular, hiring decisions — involve meaningful human review.
We may use anonymised or aggregated data (which cannot be used to identify you) to improve our services or to evaluate and develop algorithms, including AI models used for internal analysis. Where we use third-party AI services on content that may contain personal data, we do so under contracts that restrict further use of that data by the provider, and subject to the safeguards set out in Sections 5 and 6.
8. Security and confidentiality.
Vizzuality holds ISO/IEC 27001 certification for its Information Security Management System. We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage, including access controls, encryption in transit and at rest where appropriate, logging, staff training and supplier due diligence.
All processors listed in Section 5 are bound by written agreements requiring equivalent security standards and assisting us with our obligations under Arts. 32 to 36 GDPR.
9. Recruitment and selection of candidates.
This section applies specifically to personal data processed when you apply for a position at Vizzuality — whether through our careers page, our applicant tracking system (BambooHR), by emailing us directly, via recruitment agencies, or through referrals.
9.1 Data we process
- Identification and contact data: full name, email, telephone, postal address, nationality.
- Professional data: CV/resume, cover letter, education, work history, certifications, languages, portfolio and professional profile links (LinkedIn, GitHub, etc.).
- Application responses: answers to questions in our application form.
- Interview data: notes taken during interviews, assessment and technical test results, and recordings of Google Meet sessions only where you have been informed in advance and have consented.
- Reference data: only where provided by you, and with your prior consent to contact your referees.
- Right-to-work documentation: where relevant at the offer stage.
We ask candidates not to include special category data in their applications unless strictly necessary (see Section 3).
9.2 Purposes and legal bases
We process your personal data as a candidate for the following purposes:
- Managing your application for a specific role — including reviewing your CV, organising interviews, evaluating your suitability and communicating with you. Legal basis: Art. 6.1.b GDPR (pre-contractual measures at your request).
- Conducting reference checks — only where relevant, and solely after you have given your prior consent to us contacting your referees. Legal basis: Art. 6.1.a GDPR (your consent).
- Retaining your profile in our talent pool for future openings — subject to a separate opt-in checkbox distinct from the application itself. Legal basis: Art. 6.1.a GDPR (your consent).
- Defending against potential legal claims arising from the selection process. Legal basis: Art. 6.1.f GDPR (our legitimate interest), subject to a documented balancing test.
- Compliance with labour, tax and social security obligations if you are hired. Legal basis: Art. 6.1.c GDPR (compliance with a legal obligation).
9.3 Retention
- If you are not selected, we retain your application data for up to one (1) year after the end of the selection process, for the purpose of defending against potential claims.
- If you consent to the talent pool, we retain your CV for up to two (2) years, after which we will either ask you to renew your consent or delete your data. You may withdraw your consent at any time.
- If you are hired, your data will migrate to your employment file and be retained in accordance with applicable labour, tax and social security legislation (typically 4 to 10 years depending on the document type).
- Interview recordings, where made, are deleted within 30 days of the conclusion of the selection process.
9.4 Recipients
For recruitment purposes, we share your data with BambooHR (our applicant tracking system) and Google LLC (for remote interviews and internal communications), as described in Section 5. Internally, your data is accessed by the hiring manager, team leads involved in the selection and People Operations staff, all bound by confidentiality obligations.
9.5 Sources
We collect candidate data primarily from you. Where we receive information about you from a third party — recruitment agency, employee referral, or a public professional profile such as LinkedIn — we will inform you at the earliest opportunity.
10. Your rights
You have the following rights in relation to your personal data:
- Access: obtain confirmation of whether we process your personal data and, if so, access to that data and information about the processing.
- Rectification: have inaccurate personal data corrected or incomplete data completed.
- Erasure: have your data deleted ("right to be forgotten") where the legal conditions are met.
- Restriction: request that we restrict the processing of your data in certain circumstances.
- Objection: object to processing based on our legitimate interests (Art. 6.1.f), including for direct marketing purposes.
- Portability: receive your data in a structured, commonly used and machine-readable format, where the processing is based on consent or contract and is carried out by automated means.
- Withdraw consent: withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Not to be subject to solely automated decisions that produce legal or similarly significant effects.
You may exercise these rights free of charge by writing to hello@vizzuality.com or to the postal address in Section 1, identifying the right you wish to exercise. In marketing communications, you may also unsubscribe using the link provided in each message.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), www.aepd.es.
