Privacy Policy
This is a template pending legal review.
Last updated: July 4, 2026
CalHire, Inc. ("CalHire", "we", "us") is committed to protecting personal data. This Privacy Policy explains what we collect, why, the legal bases we rely on, who we share it with, how long we keep it, the safeguards we apply, and the rights you have — including region-specific rights under the US state privacy laws (California CCPA/CPRA and comparable state laws), the EU GDPR, the UK GDPR, the UAE PDPL, and India's Digital Personal Data Protection Act, 2023 (DPDP Act).
This policy covers our public website at calhire.com. When you use the CalHire application (app.calhire.com) as a candidate or on behalf of an employer, CalHire generally acts as a processor (or, under some laws, a "service provider") on the employer's behalf for candidate data, and as a controller for account, billing, and security data; the applicable order form or Data Processing Addendum (DPA) governs those uses and, where applicable, prevails over this policy.
1. Controller, DPO, and contact
For the public website and the data described here, CalHire, Inc. is the data controller (and, under the DPDP Act, the Data Fiduciary). You can reach our privacy team and Data Protection Officer (DPO) at privacy@calhire.com, and for general enquiries at hello@calhire.com.
- Jurisdiction of incorporation: [TODO: confirm jurisdiction of incorporation].
- EU/UK representative & DPO: contactable at privacy@calhire.com.
- India Grievance Officer (DPDP Act): contactable at privacy@calhire.com.
2. Personal data we collect
We collect the following categories of personal data:
- Identifiers and contact data. Name, work email, company, role, region, and the content of your message when you fill in a contact, demo, or partner form.
- Consent records. Your cookie/processing choices: the categories accepted, the policy version, and a timestamp. We mask the client IP and truncate the user-agent before storage.
- Usage data (consent-based). Aggregate, privacy-respecting analytics about how the site is used.
- Device and connection data. Standard log data (e.g. coarse location derived from IP, browser type) used for security and abuse prevention.
- Commercial data. For paying customers, billing contact and transaction records (payment card data is handled by our payment processors, not stored by us).
We do not knowingly collect special-category / sensitive personal data through the website, we do not use cross-site advertising trackers, and we do not sell or "share" personal data for cross-context behavioral advertising (as those terms are defined under US state privacy laws).
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Respond to your enquiry | Contact/lead details | Legitimate interests; steps prior to a contract |
| Product updates you opted into | Consent | |
| Analytics to improve the site | Usage data | Consent |
| Provide and bill paid plans | Contact, commercial data | Performance of a contract |
| Keep the site secure | Device/log data | Legitimate interests; legal obligation |
| Prove consent compliance | Consent records | Legal obligation; legitimate interests |
Under the UAE PDPL and India's DPDP Act we rely on your consent for marketing and analytics, and on legitimate uses / contractual necessity / legal obligation for responding to you, providing paid services, and securing the service. Under US state laws we process the categories above for the business and commercial purposes described here and do not use them for incompatible purposes.
4. Automated decision-making and AI
The website makes no automated decisions that produce legal or similarly significant effects about you. On the CalHire platform, hiring AI assists but humans decide: hiring AI is used only on anonymized data — no AI model receives personally identifying information (PII) — and no candidate is ever auto-rejected. A human makes, and is recorded for, every person-affecting decision. These controls support obligations under the EU AI Act, the GDPR/UK GDPR rules on automated decision-making (Article 22), NYC Local Law 144, and equivalent rules. You may contact us to obtain meaningful information about the logic involved and to contest a decision where such rights apply.
5. How we share data
We share personal data only with: (a) service providers / sub-processors under contract (see our Sub-processors); (b) professional advisers; (c) authorities where legally required; and (d) a successor in a corporate transaction, under equivalent protections. We do not sell personal data, and we do not "share" it for cross-context behavioral advertising as defined under the CCPA/CPRA and comparable US state laws.
6. International transfers and residency
CalHire supports in-region data residency for the EU, UK, India, and the UAE for application data. Where personal data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, recognized adequacy decisions where available, and equivalent mechanisms under the PDPL and DPDP Act, together with transfer risk assessments where required. A copy of the relevant safeguards is available on request at privacy@calhire.com.
7. Retention
We keep contact and lead submissions only as long as needed to handle your enquiry and meet legal obligations, then delete or anonymize them. Consent records are retained as compliance evidence for as long as required by law. Billing records are retained for statutory tax and accounting periods. Platform data retention is governed by the customer agreement / DPA.
8. Security
We apply encryption in transit and at rest, least-privilege access, network controls, audit logging, and regular review. No method of transmission is perfectly secure, but we work to protect your data and to notify you and regulators of any personal-data breach as required by applicable law.
9. Your rights — general
Subject to applicable law you may have the right to access, correct, delete, port, restrict, or object to processing, and to withdraw consent at any time (without affecting prior processing). To exercise any right, email privacy@calhire.com; we verify requests and respond within the statutory timeframes described below. You will not be discriminated against or denied service for exercising your privacy rights. The region-specific sections below add detail; where more than one applies, we honor the protections most favorable to you.
10. United States — CCPA/CPRA and comparable state laws
If you are a California resident (and, to the extent applicable, a resident of other US states with comprehensive privacy laws), you have the right to:
- Know / access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
- Delete personal information we have collected, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of the "sale" or "sharing" of personal information and of targeted advertising. CalHire does not sell or share personal information, so there is nothing to opt out of; nonetheless, a "Do Not Sell or Share My Personal Information" control and honoring of the Global Privacy Control (GPC) signal are provided via our cookie controls.
- Limit the use of sensitive personal information — we do not use sensitive personal information for purposes requiring such a limit.
- Use an authorized agent to submit requests on your behalf, subject to verification.
- Non-discrimination — we will not deny goods or services, charge different prices, or provide a different level of quality because you exercised your rights.
To exercise these rights, email privacy@calhire.com. We respond to verifiable consumer requests within 45 days (extendable by a further 45 days where permitted, with notice). You may appeal a decision where your state law provides an appeal right.
11. European Union — GDPR
If you are in the EU/EEA, you have the rights to access, rectification, erasure ("right to be forgotten"), restriction, data portability, and to object to processing (including profiling), and to withdraw consent at any time. We process your data on the legal bases set out in Section 3 (chief among them consent, contract, legitimate interests, and legal obligation). Our DPO and EU representative are reachable at privacy@calhire.com. International transfers rely on SCCs and adequacy as described in Section 6. You have the right to lodge a complaint with your local supervisory authority. We respond to requests without undue delay and within one month (extendable by two further months for complex requests, with notice).
12. United Kingdom — UK GDPR
If you are in the UK, you have the same rights as under the EU GDPR (access, rectification, erasure, restriction, portability, objection, and withdrawal of consent), enforced under the UK GDPR and the Data Protection Act 2018. International transfers rely on the UK International Data Transfer Addendum to the SCCs or adequacy. You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. Response timelines mirror the GDPR (one month, extendable for complex requests).
13. United Arab Emirates — PDPL
If you are in the UAE, under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) you have the rights to access, rectification, erasure, restriction of processing, portability, and to object, and to withdraw consent. We rely on consent for marketing/analytics and on contractual necessity / legal obligation otherwise, and apply appropriate cross-border transfer safeguards. Requests can be made to our privacy team at privacy@calhire.com, and you may raise concerns with the UAE Data Office where applicable.
14. India — DPDP Act 2023
If you are a Data Principal under India's Digital Personal Data Protection Act, 2023, and CalHire is the Data Fiduciary, you have the rights to:
- Access a summary of the personal data we process and the processing activities.
- Correction, completion, and updating of your personal data.
- Erasure of your personal data, subject to legal retention requirements.
- Grievance redressal — contact our Grievance Officer at privacy@calhire.com, who will respond within the period prescribed by the DPDP Act and its rules.
- Nomination — nominate another individual to exercise your rights in the event of death or incapacity.
We process your personal data primarily on the basis of your consent (or certain legitimate uses recognized by the Act), provide clear notice, and enable you to withdraw consent as easily as you gave it. You may also approach the Data Protection Board of India if your grievance is not resolved.
15. Cookies and choices
We ask for your consent on first visit and you can change it anytime via "Cookie settings" in the footer. We honor the Global Privacy Control (GPC) and "Do Not Sell or Share" signals where required. See our Cookie Policy.
16. Children
The service is not directed to children under 16 (or the age set by local law, including under the DPDP Act for children in India), and we do not knowingly collect their data. Where the DPDP Act applies, we do not undertake tracking, behavioral monitoring, or targeted advertising directed at children.
17. Changes
We may update this policy; material changes are reflected by the "last updated" date and, where required, by notice. Continued use after changes take effect constitutes acceptance.
18. Contact
Privacy questions or requests: privacy@calhire.com. General enquiries: hello@calhire.com.