Privacy Policy
Plain English - no legal maze
Oryx | oryx.so
Version 3 | Effective Date: September 2026
00
The short version
oryx does two different things with personal data, and which one applies changes your rights and who to contact.
When you use candidate.so or our website, we decide how your data is used. We are the controller. This policy governs it and you exercise your rights with us.
When you apply for a job through an employer using oryx, that employer decides how your data is used. They are the controller. We are the processor, which means we hold and handle the data on their instructions and do not use it for our own purposes. This policy explains what we do on their behalf, but your rights are exercised with the employer. Every application form links to a notice naming that employer.
We never use data from an employer's hiring process to market to you, to build a candidate.so profile, or to train AI models.
01
Company Information
oryx is operated by oryx technologies LLC, Avenue de Tivoli 19b, 1007 Lausanne, Switzerland.
Controller for candidate.so, oryx.so and business account data
Processor for candidate data held inside an employer's oryx account
Privacy enquiries: info@oryx.so
If you are located in the European Union or the United Kingdom and wish to exercise your rights, contact info@oryx.so - where we hold your data on behalf of an employer, we will pass your request to them and tell you who it went to.
02
Where this policy applies
oryx is used by employers and candidates in several countries. The commitments in this policy apply everywhere. Where a country gives you additional rights, we apply those too.
European Union - GDPR. Full access, erasure, portability and objection rights. Retention limits set per country.
United Kingdom - UK GDPR and the Data Protection Act 2018. As above.
Switzerland - the revised Federal Act on Data Protection. Our home jurisdiction.
United States, federal - EEOC and OFCCP recordkeeping rules. Employers must keep application records for a minimum period. This limits how quickly data can be deleted.
United States, states - CCPA and CPRA in California, plus Colorado, Connecticut, Virginia, Texas and others. California job applicants have access, correction and deletion rights. Most other state privacy laws exclude applicant data.
Canada - PIPEDA, Quebec Law 25, and the Alberta and British Columbia PIPA. Data is kept only as long as necessary. Quebec adds an explicit deletion right.
Australia - the Privacy Act 1988 and the Australian Privacy Principles. Job applicants are covered. The employee records exemption does not apply to applicants.
New Zealand - the Privacy Act 2020. Includes rules on sending data overseas.
Where laws conflict we apply the stricter rule, unless a law requires otherwise. The clearest example is deletion. US law requires employers to keep application records for a minimum period, so a deletion request from a US applicant results in the record being suppressed immediately and destroyed once that period ends, rather than deleted straight away.
03
Information we collect
What we collect depends on whether you are using candidate.so, running a business account, or applying to a job through an employer.
3.1
Website visitors
Contact details you give us: name, email address, company name and role, when you request a demo, start a trial, subscribe to updates or contact support
Communications: messages, support requests and feedback
Technical: IP address, device and browser type, language
Usage: pages visited, clicks and navigation patterns
Cookies: as described in section 11
3.2
Business accounts
Company name and business address
Names, email addresses and roles of the users you invite to your account
Billing contact, payment method details processed by our payment provider, and transaction history
Job listings, application forms, interview guides and other content you create
Login activity and platform usage
Subscription plan, contract dates and agreed terms
Messages exchanged with oryx support
3.3
Candidates applying through an employer
We hold whatever the employer's application form asks for. Typically:
Name and contact details
Resume or CV, and any documents the employer requests
Answers to the employer's application questions
Interview scheduling data, evaluation scores and interviewer notes created by the employer's team
Email correspondence between the employer and the candidate sent through oryx
The employer decides what to ask. We do not add to it.
3.4
What we do not collect
We do not ask for date of birth, home address, government identification numbers, or financial details as part of a job application. We do not run background checks. We do not process biometric data, and we do not use facial or voice analysis in interviews.
05
Legal bases
Where the GDPR, UK GDPR or Swiss FADP applies, we rely on the following legal bases.
Responding to enquiries and providing trials - steps taken at your request before entering a contract
Product marketing email - consent, which you can withdraw at any time
Business account administration and billing - performance of a contract
Security, fraud prevention and platform integrity - legitimate interests
Legal and tax obligations - legal obligation
Holding candidate data for an employer - the employer's legal basis, not ours. We act on their documented instructions
Where we rely on legitimate interests you can ask us for the balancing assessment.
06
How we share information
We do not sell personal information and we do not share it for cross-context behavioural advertising.
6.1
Employers
Candidate data is available to the employer whose account it belongs to, and to the users that employer has authorised. We do not make candidate data from one employer's account visible to another employer.
6.2
Service providers
We use a small number of vendors to run the platform. They are named at oryx.so/sub-processors, act only on our instructions, and are contractually barred from using your data for their own purposes. We give 30 days notice before adding a new one.
6.3
Legal and regulatory disclosures
We may disclose information when required by law, court order or government authority, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of oryx, our users or the public.
6.4
Business transactions
If oryx is involved in a merger, acquisition, asset sale or restructuring, personal information may be transferred as part of that transaction. We will notify you by email or a prominent notice on our website if your data becomes subject to a different privacy policy.
07
Automated decisions and artificial intelligence
We use AI to help employers write job advertisements, draft interview questions, and summarise their own interview notes.
AI is not used to score, rank, filter or disqualify candidates. Hiring decisions on oryx are made by people
No solely automated decision produces a legal or similarly significant effect on you
Where AI processes text, the provider is named at oryx.so/sub-processors and is contractually barred from training on your data
Employers can turn AI features off for their account
If this changes we will update this section and notify affected users before the change takes effect.
08
Your rights
Where to send a request. If you applied to a job through an employer using oryx, that employer is the controller and you exercise your rights with them. Their details are on the notice linked from the application form. If you contact us instead we will pass the request on and tell you who it went to, normally within 5 working days. For the oryx website and business accounts, contact info@oryx.so.
8.1
Everywhere
Access, correction, deletion subject to legal retention requirements, portability, withdrawal of consent, and the right to complain to your regulator.
8.2
United States
California. Right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information. Submit requests to privacy@oryx.so. We respond within 45 days.
Other states. Colorado, Connecticut, Virginia, Texas and others give similar rights. Most exclude job applicant data, in which case your route is through the employer.
A limit worth knowing. Federal rules require employers to keep application records for a minimum period, normally one year and two years for some federal contractors. A deletion request cannot override that. We suppress the record immediately and destroy it when the period ends.
8.3
Canada
Access and correction under PIPEDA. Quebec residents additionally have deletion and de-indexing rights, and the right to be informed of automated decisions, under Law 25. Complaints go to the Office of the Privacy Commissioner of Canada or the Commission d'acces a l'information du Quebec.
8.4
European Union, United Kingdom and Switzerland
In addition to the rights above: restriction of processing, objection to processing based on legitimate interests, and the right not to be subject to solely automated decisions with legal or similarly significant effects. We respond within one month. You can complain to your national supervisory authority, the UK ICO, or the Swiss FDPIC.
8.5
Australia and New Zealand
Access and correction under the Australian Privacy Principles and the New Zealand Privacy Act 2020. Complaints to the OAIC or the New Zealand Privacy Commissioner. In Australia the employee records exemption does not apply to job applicants, so applicants have full rights.
09
Data retention
How long we keep data depends on whose data it is and which of our two roles applies.
9.1
Website visitors and marketing contacts
Enquiry and demo request records are kept for 24 months from your last interaction with us, then deleted. Marketing contacts are removed as soon as you unsubscribe. Website analytics data is retained for 14 months.
9.2
Business accounts
Kept for the life of the subscription and for 7 years after closure, as required for tax, audit and legal compliance. Payment records are retained in accordance with applicable financial regulations. You can request deletion of anything not legally required by contacting info@oryx.so
9.3
Candidate data held for employers
The employer sets this, within limits we enforce. We apply the Oryx Standard Retention Model at oryx.so/retention by default, which sets a period for each region based on that country's rules.
Two things we enforce regardless of what an employer wants:
We will not hold applicant data longer than the maximum permitted in a region
We will not delete records earlier than a legal minimum requires. In the United States this means an application record survives a deletion request until that minimum expires. The record is suppressed immediately, excluded from all use, and then destroyed
Where consent is required to keep an application on file beyond the initial hiring process, we send that request on the employer's behalf before the period ends. No reply means the data is deleted or anonymised. Silence is never treated as consent.
Anonymised means name, contact details, resume and answers are permanently removed. Interview recordings are always deleted outright, never anonymised.
10
International data transfers
oryx is based in Switzerland and hosts data in Europe. Sub-processor locations are listed at oryx.so/sub-processors.
To the United States: Standard Contractual Clauses with our sub-processors, plus the UK Addendum where relevant
EU and UK to Switzerland: Switzerland benefits from an EU adequacy decision and equivalent UK recognition, so no additional safeguard is required
From Canada: contractual protections comparable to PIPEDA
From Australia and New Zealand: we take reasonable steps to ensure overseas recipients handle data consistently with APP 8 and IPP 12
11
Cookies and tracking
We use cookies and similar technologies on our website to operate it, understand how it is used, and measure our marketing.
Strictly necessary cookies: required to operate the website and the platform, and cannot be disabled
Analytics cookies: help us understand how visitors navigate our website. Opt out via your browser settings or the Google Analytics Opt-out Add-on
Marketing cookies: used to measure our advertising and show oryx product ads to business audiences on third-party sites. Opt out via the Digital Advertising Alliance at optout.aboutads.info
Application forms and interview pages carry strictly necessary cookies only. We do not run analytics or advertising cookies on a page you were asked to visit as part of a job application
Where required, we ask for consent before setting non-essential cookies, and you can change your choice at any time. Disabling certain cookies may affect website functionality.
12
Data security
We implement industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security assessments to protect your personal information. However, no system is completely secure. In the event of a data breach that poses a risk to your rights or freedoms, we will notify affected users and relevant authorities as required by law.
Access to candidate data held for an employer is restricted to that employer's authorised users and to oryx staff who need it to provide support, and every access is logged.
13
Children's privacy
Our services are not directed to anyone under 16, or under the minimum working age in your country if that is higher. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such information, we will delete it promptly. If you believe a child has provided us with personal information, contact privacy@oryx.so.
14
Employers and business account holders
This section applies to businesses, employers and recruiters using oryx to hire.
14.1
Who is responsible for what
You are the controller of your candidate data. We are your processor. You decide what to ask, who to hire, and how long to keep records within the limits we enforce. We hold and process that data only on your documented instructions. Those instructions are the terms you accept at signup and the settings you configure in your account.
Our processing obligations are set out in our Data Processing Agreement, which forms part of your contract with us.
14.2
Your obligations
By accessing candidate data through oryx you agree to:
Use candidate data solely for legitimate hiring and recruitment purposes
Not resell, redistribute or transfer candidate data to any third party without the candidate's separate consent
Comply with all applicable employment and anti-discrimination laws
Respond to candidate rights requests where you are the controller
Maintain appropriate security measures and keep your account access secure
These obligations survive termination of your subscription.
14.3
The standard we apply, and changing it
When you sign up you accept the Oryx Standard Retention Model at oryx.so/retention. It sets a retention period per region, decides when candidates are asked for consent, and determines what happens when a period ends. Every account starts configured this way and most never need to change it.
You can adjust retention within the legal bounds shown in your settings. Some limits cannot be changed because they are not ours or yours to waive. When you change a setting we regenerate your candidate privacy notice and ask you to approve it. Nothing changes for candidates until you do.
15
Candidate privacy notices
Every job application form published through oryx links to a notice naming the employer as the controller of your data.
The notice is generated automatically from information already in the employer's account: their company name, the questions on their form, the retention period for the region, and a contact for data requests. Employers do not write it. It is created for them and approved when they accept our terms.
If an employer changes a retention setting, the notice is regenerated and they must approve it before it goes live. Notices are versioned, and we record which version each candidate saw and when.
You can open the notice from any application form. It is hosted at hiring.oryx.so and shows the employer's name and logo.
16
Third-party links
Our platform and website may contain links to employer websites, job boards and other third-party services, including candidate.so. We are not responsible for the privacy practices of those services and encourage you to review their privacy policies before submitting any personal information.
17
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy. We keep previous versions available on request.
18
Contact Us
If you applied to a job through an employer using oryx, contact that employer first. Their details are on the notice linked from the application form.
If you are located in the European Union or the United Kingdom and wish to exercise your rights, contact privacy@oryx.so. Where we hold your data on behalf of an employer, we will pass your request to them and tell you who it went to.
Questions, concerns, or requests related to this Privacy Policy or your personal data:
Get in touch
info@oryx.so · oryx Technologies LLC, Avenue de Tivoli 19b, 1007 Lausanne
Contact us ->
