Privacy Policy — Wilma

This Privacy Policy describes how Wilma (“Wilma”, “we”, “our”, or “us”) collects, uses, and discloses personal information when you use our website, recruitment platform, and related services.

Wilma is currently operated as an early-stage service by Brendan Marry from Rüschlikon, Switzerland. This policy will be updated if Wilma transitions to a registered legal entity.

Wilma provides recruitment software that helps organisations manage applications, communicate with candidates, and run hiring processes more efficiently.

Where Wilma processes personal information on behalf of an organisation using the platform, that organisation acts as the data controller and Wilma acts as the data processor or service provider, depending on the applicable law.

If you are an administrator using Wilma to create an organisation, invite teammates, or connect workplace systems, you are acting with authority from that organisation and your choices determine who can access the account and which integrations are enabled.

When Wilma is used by one of our customers:

• The customer organisation is responsible for the hiring process and related decisions.
• Wilma processes personal information on that organisation’s behalf and according to its instructions.

If you are a candidate applying for a job through Wilma, the organisation you apply to is generally responsible for how your application data is used. If you want to exercise your rights in relation to that data, you should usually contact that organisation first.

3.1 Candidate Information

When customers use Wilma to manage applications, personal information may include:

• Name, email address, phone number, and other contact details
• CVs, resumes, cover letters, work history, education, and skills
• Application form responses and screening answers
• Interview recordings, audio responses, video submissions, and transcripts
• Notes, summaries, interview feedback, and hiring workflow history
• Scheduling details such as interview date, time, meeting link, and participants

3.2 Recruiter and Customer User Information

For recruiters, hiring managers, and customer users, we may collect:

• Name, email address, organisation, role, and account profile details
• Login and authentication details
• Connected account details for email and calendar integrations
• Support, onboarding, and customer success communications

3.3 Website and Product Usage Information

We may also collect technical and usage information, including:

• IP address, browser type, device information, and language settings
• Logs, access timestamps, navigation events, and product usage patterns
• Security and integrity signals used to help prevent misuse or unauthorised access

We collect personal information:

• Directly from users, candidates, and customers
• From our customers when they upload or manage candidate data in Wilma
• From connected third-party services that users choose to enable
• Automatically through normal use of our website and services

We use personal information to operate, secure, and improve Wilma, including to:

• Provide applicant tracking and recruitment workflow functionality
• Enable communication between recruiters, candidates, and interviewers
• Support interview scheduling and hiring coordination
• Generate transcripts, structured summaries, and related workflow outputs
• Provide customer support, onboarding, and account administration
• Monitor usage, diagnose issues, and improve product performance
• Maintain platform security and detect fraud, abuse, or unauthorised access

We do not use candidate or recruiter data for:

• Advertising targeting
• Selling personal information
• Training general-purpose AI models without explicit permission

Wilma allows users to connect third-party services such as Google Workspace and Microsoft 365 using secure OAuth authentication.

Depending on the integration and the permissions granted, Wilma may access information to:

• Send candidate emails on behalf of the connected user
• Read candidate-related replies and message metadata
• Support calendar-based scheduling and interview coordination
• Detect interview bookings and related calendar changes where enabled

We use this data only to provide the user-facing functionality requested by the customer or connected user. We do not process unrelated mailbox contents for advertising or profiling.

For Google connections, Wilma currently requests scopes for basic sign-in openid, email, and profile, and, when a user connects email/calendar access, the minimum Gmail and Calendar permissions needed to send mail, read relevant replies, and observe booking activity gmail.send, gmail.readonly, calendar.readonly, and calendar.events.readonly.

You may revoke connected-account access in Wilma settings or with the provider directly. When an account is deleted, we remove the connected access information we control and revoke Google tokens where possible.

Google API Services

Wilma’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Wilma may use AI systems to support recruitment workflows, including to:

• Transcribe candidate submissions or interview content
• Generate summaries of candidate-provided information
• Help recruiters structure and review information more efficiently

These tools are designed to support human decision-making. Wilma does not:

• Make autonomous hiring decisions on behalf of customers
• Assess personality, protected characteristics, or sensitive traits as hiring outcomes

We may disclose personal information in the following circumstances:

• To service providers and subprocessors who help us operate the platform
• To professional advisers such as lawyers, auditors, and insurers where necessary
• To comply with law, regulation, legal process, or lawful government requests
• To protect the rights, safety, security, and integrity of Wilma, our users, or others
• In connection with a merger, acquisition, financing, or sale of all or part of our business

We may also share information with third-party integrations that a user or customer chooses to enable. Those third parties act under their own terms and privacy practices.

We use cookies and similar technologies to operate our website and services, keep users signed in where applicable, understand product usage, and improve performance and security.

You can control cookies through your browser settings, although disabling some cookies may affect site functionality.

We retain personal information for as long as necessary to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and meet customer-configured retention settings where applicable.

Because Wilma is often used as a processor, retention periods for candidate data may be set by the customer organisation using the platform.

We implement technical and organisational measures designed to protect personal information, including:

• Encryption in transit and at rest where appropriate
• Access controls, authentication, and role-based permissions
• Monitoring, logging, and security review processes

No system can be guaranteed to be completely secure, but we take reasonable measures designed to safeguard the information we process.

Depending on your location and applicable law, you may have rights to:

• Access personal information
• Correct inaccurate or incomplete information
• Request deletion of personal information
• Restrict or object to certain processing
• Request portability where applicable

If your information is processed by Wilma on behalf of one of our customers, you should direct your request to that organisation first. Wilma will support our customers in responding to valid requests where required.

Customer users can also delete their Wilma account from their account settings. That action removes their access and revokes connected integrations where applicable.

Where personal information is transferred internationally, we rely on appropriate safeguards under applicable law, which may include contractual safeguards such as Standard Contractual Clauses.

If you have questions about this Privacy Policy, contact:

Wilma
Email: privacy@withwilma.com
Address: [Full street address, Rüschlikon, Switzerland — founder to confirm]

We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements, or operational practices. When we do, we will post the updated version on this page and revise the “Last updated” date.