Privacy Policy

1. Who We Are

RefCred is an invite-only professional hiring marketplace that connects companies with candidates through verified recommenders. The data controller for all personal data processed on the platform is RefCred ('the Company'). For all privacy-related queries, contact us at [email protected].

2. Data We Collect

2.1 Data you provide directly

• Company users: company name, registered address, trade documents, contact name, email address, job posting content, referral fee settings.
• Recommenders: full name, email address, LinkedIn profile URL, professional CV, employment history, endorsement letters, bKash mobile number or Stripe account details.
• Candidate data submitted by recommenders: name, CV file, LinkedIn URL, professional history, skills, and the recommender's written endorsement. Candidates do not register directly.
• All users: login credentials (email and hashed password), support ticket content, messages sent through the platform.

2.2 Data collected automatically

• IP address, browser type, operating system, referring URL.
• Pages visited, time spent, clicks, and other usage analytics.
• Device identifiers and session tokens.

2.3 Data from third parties

• LinkedIn: publicly visible profile data, employment history, mutual connections — used solely for recommender verification.
• Stripe: payment and identity verification data processed under Stripe's own privacy policy.
• bKash: mobile wallet number and transaction reference — processed under bKash's own privacy policy.

3. How We Use Your Data

4. Data Sharing and Disclosure

We do not sell your personal data. We share data only in the following circumstances:

Between platform users

When a recommender submits a CV to a company, the company sees: candidate name, CV, skills, connection score, and the recommender's profile. The candidate's full contact details are never shown directly to the company.

Payment processors

bKash receives the recommender's mobile number and payout amount. Stripe receives account details for Connected Account onboarding and transfers. Both operate under their own privacy policies.

Identity verification

LinkedIn profile data is accessed to verify recommender and candidate relationship claims. Only data necessary for verification is reviewed.

Service providers

We engage trusted sub-processors for hosting (cloud infrastructure), email delivery (transactional email provider), and analytics. All sub-processors are bound by data processing agreements.

Legal requirements

We may disclose data to comply with a legal obligation, court order, or lawful government request, or to protect the rights, safety, or property of RefCred or its users.

Business transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. Users will be notified in advance.

5. International Data Transfers

RefCred operates globally. Your data may be transferred to and processed in countries outside your own, including countries that may not have data protection laws equivalent to those in your jurisdiction. Where we transfer data from the European Economic Area (EEA) or the United Kingdom (UK) to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

For users in Bangladesh, data processing is conducted in accordance with the Digital Security Act 2018 and applicable data protection principles. bKash transactions are subject to Bangladesh Bank regulations.

6. Data Retention

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any of these rights, contact [email protected]. We will respond within 30 days.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ('right to be forgotten'), subject to our legal retention obligations.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format (GDPR users).
• Right to object: Object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to lodge a complaint: You have the right to complain to your local data protection authority (e.g. ICO in the UK, supervisory authority in your EU member state).

IMPORTANT: Candidates whose CVs have been submitted by recommenders may request deletion of their data by contacting [email protected]. We will remove the data within 30 days subject to any outstanding legal or financial obligations.

8. Cookies and Tracking

RefCred uses cookies and similar technologies to operate the platform, remember your session, and understand how users interact with the site.

• Essential cookies: Required for login, session management, and platform security. Cannot be disabled.
• Analytics cookies: Used to understand usage patterns and improve the platform. You may opt out via your browser settings.
• Payment cookies: Set by Stripe for fraud prevention during payment flows. Subject to Stripe's cookie policy.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include:

• Encryption of data in transit using TLS 1.3.
• Encryption of data at rest using AES-256.
• CV and document files stored in private cloud buckets — no public URLs.
• Role-based access controls (RBAC) limiting internal access to personal data.
• Regular security audits and penetration testing.
• Mandatory two-factor authentication for all admin accounts.

Despite our best efforts, no system is completely secure. In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

10. Children's Privacy

RefCred is a professional platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that a minor has provided personal data, we will delete it promptly. Contact us at [email protected]if you believe a minor's data has been submitted.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the 'Last updated' date at the top of this document. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

12. Contact Us — Privacy

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact our Privacy team at: