Privacy Policy

1. Introduction

Presco ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered recruitment platform, including our WhatsApp screening service.

We comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information

• Name and contact details (email, phone number)
• Professional information (resume, work history, qualifications)
• Account credentials
• Organization details (for employers)

2.2 WhatsApp Communication Data

• WhatsApp phone number (encrypted and masked for privacy)
• Messages exchanged during AI screening interviews
• Screening session metadata (timestamps, completion status)

2.3 Technical Data

• IP address and device information
• Browser type and settings
• Usage data and analytics

3. How We Use Your Information

• To provide and maintain our recruitment platform services
• To conduct AI-powered screening interviews via WhatsApp
• To match candidates with suitable job opportunities
• To generate screening reports and assessments for employers
• To provide AI-powered screening assessments (Note: Anthropic's API does not use your data for model training)
• To communicate with you about our services
• To comply with legal obligations

4. Data Security

We implement industry-standard security measures to protect your data:

• AES-256-GCM encryption for sensitive data including WhatsApp messages
• Phone number masking to protect candidate identity
• Secure HTTPS connections for all data transmission
• Role-based access control for organizational data
• Regular security audits and monitoring

5. Data Sharing and Disclosure

We may share your information with:

• Employers (for candidates who participate in screening)
• Service providers (cloud hosting, AI processing)
• Legal authorities when required by law

We do not sell your personal data to third parties.

6. Third-Party Services

Our platform integrates with the following third-party services:

• WhatsApp Business API (Meta) for messaging
• Anthropic Claude AI for screening conversations
• Supabase for authentication and database services

Each service has its own privacy policy and data handling practices.

Your data may be transferred to and processed in the following locations:

• Anthropic (Claude AI): United States
• Supabase: AWS ap-southeast-1 (Singapore)
• Meta (WhatsApp): United States

6.1 Cross-Border Data Transfers

Pursuant to Section 129 of the Personal Data Protection Act 2010 (PDPA), personal data may only be transferred to a place outside Malaysia where the recipient country ensures an adequate level of data protection or where the transfer falls within a specified exception.

We have entered into data processing agreements (DPAs) with both Anthropic and Meta to ensure that your personal data is processed in accordance with the requirements of the PDPA 2010. These agreements contractually require these parties to maintain adequate levels of data protection that are consistent with the standards set forth by Malaysian data protection law.

• Anthropic (United States): AI processing of screening conversations. A DPA is in place ensuring data protection standards equivalent to PDPA requirements. Anthropic's API does not use your data for model training.
• Meta (United States): WhatsApp Business API for messaging. A DPA is in place ensuring data protection standards equivalent to PDPA requirements.

7. Your Rights Under PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Access your personal data held by us
• Correct any inaccurate personal data
• Withdraw consent for data processing
• Request deletion of your personal data
• Object to processing of your personal data

To exercise these rights, please contact us using the details below.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Screening session data is retained for the duration specified by the employer, after which it may be anonymized or deleted.

• Candidate personal information: 2 years from last activity
• Screening session data: 1 year from completion
• Audit logs: 7 years

9. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Data Protection Officer (DPO)