Privacy Policy

Orvensa is operated by Kobenski BV.

For the activities described in this policy, Kobenski BV may act either as a controller or as a processor, depending on the context explained below.

Orvensa is used by recruiting organizations to manage recruitment workflows and to run AI-assisted candidate review. In that context, roles differ depending on the type of data and the activity.

Each recruiting organization remains responsible for ensuring that it has an appropriate legal basis for applicant-data processing, that candidates receive an adequate privacy notice, and that recruitment decisions remain lawful, fair, and transparent.

This policy applies to personal data processed in connection with:

• the Orvensa marketing website and contact channels,
• user accounts and authentication flows,
• organization administration inside the platform,
• billing and subscription management,
• support and customer communications,
• applicant and recruitment data processed within the platform, and
• security, audit, and compliance records linked to the service.

This policy does not replace a recruiting organization’s own applicant privacy notice. Where a candidate applies through a recruiting organization using Orvensa, that organization should provide its own recruitment privacy notice, while this policy explains the role and processing carried out through the Orvensa service.

The legal basis depends on the relevant processing context.

In the platform, Orvensa allows the recruiting organization to configure a default applicant-data legal basis and to record the privacy notice URL and notice version associated with collection. It also snapshots the configured legal basis and notice details at applicant intake.

Orvensa provides AI-assisted candidate evaluation as a decision-support tool. The system may use job context and CV-derived text to generate structured outputs such as summaries, strengths, risks, interview questions, score-related outputs, and confidence indicators.

Orvensa is designed so that a human reviewer remains responsible for the final hiring decision. The platform also includes controls that can disable AI screening or AI evaluations at organization level, require human review, and block automated processing where a candidate has objected, where processing is restricted, or where policy requirements are not met.

Orvensa applies a data-minimization step before sending CV text to the AI provider by redacting obvious direct identifiers such as email addresses and phone-like numbers. This is a pragmatic minimization measure, not full anonymization.

At the current stage of implementation, extracted raw CV text may be stored in evaluation metadata in the platform. For that reason, Orvensa does not state that CV text is never persisted. Recruiting organizations should take this into account in their internal legal review, retention configuration, and candidate notices.

We obtain personal data from different sources depending on the context:

• directly from users who create accounts, request support, or manage an organization,
• from recruiting organizations that upload candidate files and related recruitment data,
• from candidates’ CVs and application materials uploaded into the platform,
• from authentication, audit, and system-generated events created during platform use, and
• from payment and subscription events generated through Stripe.

Personal data may be disclosed to the following categories of recipients where necessary:

• authorized users within the relevant recruiting organization, based on role-based access permissions,
• Kobenski BV personnel and contractors who need access for support, maintenance, security, or compliance purposes,
• hosting, infrastructure, email, and payment providers engaged to operate the service,
• AI model providers engaged to process candidate evaluation inputs on behalf of the service, and
• public authorities, courts, regulators, or advisers where disclosure is legally required or reasonably necessary to establish, exercise, or defend legal claims.

Current key service-provider categories include infrastructure/hosting providers, SendGrid for transactional email, Stripe for subscription billing, and OpenAI for AI inference functionality.

Orvensa aims to structure processing in a GDPR-compliant way. Where personal data is transferred outside the European Economic Area, appropriate safeguards should be used, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism as applicable to the relevant processor relationship.

If a recruiting organization uses Orvensa to process applicant data, that organization should review the processor list, transfer setup, and contractual safeguards as part of its own legal review.

Retention depends on the type of data and the processing context.

The platform includes automated retention enforcement for applicant records where enabled by the organization. Applicants marked as processing-restricted are skipped by the retention deletion routine unless separately resolved.

Orvensa applies technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse, or unlawful destruction. These measures include, among other things:

• authenticated access controls and organization-scoped permissions,
• role-based access management for owners, admins, and members,
• audit logging of sensitive actions,
• security incident tracking,
• transactional email notifications for certain account-security events,
• controlled deletion of CV files when applicant records are deleted, and
• separate billing-provider handling for payment and subscription events.

No security measure can guarantee absolute security. If you suspect misuse, unauthorized access, or a security issue, contact support immediately.

Under applicable law, data subjects may have the right to request access, rectification, erasure, restriction, objection, portability, and not to be subject to a decision based solely on automated processing where the legal conditions are met.

In recruitment workflows, the recruiting organization is usually the first point of contact for candidate rights requests because it is the controller for that applicant-data processing. Orvensa provides functionality that can support:

• access exports,
• rectification workflows,
• erasure workflows,
• restriction of processing,
• objection to automation, and
• human review and contestation of evaluations.

If your request concerns your account, billing, support communications, or website interaction with Kobenski BV directly, you may contact Kobenski BV using the details below.

For privacy questions concerning Orvensa as operated by Kobenski BV, you can contact:

If you are a candidate and your request concerns a recruitment process run by a recruiting organization through Orvensa, you should normally contact that recruiting organization first.

You also have the right to lodge a complaint with the competent supervisory authority, including in Belgium the Gegevensbeschermingsautoriteit / Autorité de protection des données.

We may update this Privacy Policy from time to time to reflect legal, operational, or product changes. The latest version will be published on this page with an updated revision date.