Using Obvelum (referred to as "Platform", "we", "us") involves the processing of your personal data. We are committed to a privacy-first approach (our core principle of processing only what is strictly necessary and giving you granular control over your data): facilitating connections between companies and job seekers to close matches efficiently and without spam.
Data Controller
Obvelum acts as data controller for all core platform functionality, including user profiling, matching, communication facilitation, and session coordination. The service providers we use for this (for example Daily.co for video calls) act as our processors; they are listed under "Data Processing & Subprocessors".
The Data Controller is Amedeo Viscido, sole trader, trading as Obvelum, based in Zürich, Switzerland. Obvelum is not incorporated; it is operated by Amedeo Viscido as a sole trader. You can contact us at [email protected]. The GDPR and, where applicable, the Swiss Federal Act on Data Protection (FADP) apply to our processing of personal data.
EU representative under Article 27 GDPR: Europe Services, SE, Na Čečeličce 425/4, Smíchov, 150 00 Praha 5, Czech Republic. Data subjects may contact the representative at [email protected] regarding the processing of their personal data.
We have not appointed a Data Protection Officer as we are not legally required to do so at this time.
Privacy at a Glance
Obvelum connects job seekers with companies to help find the right opportunities.
We collect information like your email, skills, and job preferences to make matching possible.
This data helps us suggest relevant jobs to you and help companies discover candidates.
You are in control: you can view, edit, delete, or export your data and manage your cookie preferences.
We protect your information with encryption and access controls, and this policy names the providers that receive it and where they process it.
Legal Basis for Processing
We process personal data on the following legal bases:
Performance of Contract: To provide the Service (matching, application management).
Consent: For optional functional cookies; for the weekly job digest email, which is off unless you switch it on; and to show employers a field of study that may reveal sensitive information, such as religious beliefs, only if you switch this on for that education entry (explicit consent, Art. 9(2)(a) GDPR).
Legitimate Interest: Our legitimate interests include ensuring platform security, preventing fraud, and improving the Service. We have assessed that these interests do not override your fundamental rights and freedoms, as they are essential to providing a safe and functional platform for all users.
Profiling & Automated Matching:
We use automated profiling to suggest suitable job matches based on:
Skills and certifications you've added to your profile
Anonymized industry tags generated from your work history
Education history and qualifications
Languages you speak
Country and location preferences
This profiling helps us show you relevant job opportunities and helps companies discover suitable candidates. These are assistive recommendations only - you remain in full control of which opportunities to pursue, and no legally significant decisions are made solely by automated means.
This processing is necessary for the performance of the contract (providing the matching Service).
Candidate Profile Visibility and Identity Disclosure
Obvelum is built on a privacy-first matching model. During the discovery and matching phase, companies receive only pseudonymised professional information - such as skills, experience level, languages, and location preferences. Obvelum does not share direct identifiers (such as name, email address, or photograph) at this stage.
Obvelum does not transmit personal identifiers to the other party when a direct interaction begins. When you join a scheduled call or start a message exchange, Obvelum provides the communication channel only. Any personal information you share during that interaction - your name, contact details, or anything else - is disclosed by you, at your own discretion. When and how direct interaction becomes possible depends on your availability mode:
• Open to work: Obvelum schedules a video conference and sends separate invitations to you and the company. No identifying information is exchanged in advance. You become identifiable to the other party only when you voluntarily join the call. This applies to all job types, including market research sessions.
• Open to chat (networking): when you are open to networking, direct text messaging may be enabled between you and a company without a prior video call. Any information you choose to share in that exchange is shared directly by you.
In both cases the disclosure is initiated by your own action, not by Obvelum proactively sharing your data.
Obvelum acts as a facilitator of discovery and connection and does not control or monitor the content of communications between users once direct interaction has begun.
Categories of Personal Data
We may process the following categories of personal data:
Account Data (Email address, profile settings)
Voluntarily Provided Professional Data (CVs, work history, job preferences)
Company Data (Business name, address, history, logos, job postings) used to verify legitimacy and facilitate hiring.
Technical Data (IP address, device info, server access logs - which may include authenticated session identifiers for security monitoring and incident investigation purposes)
Usage Data (Matching results, AI-generated features)
We do not knowingly process personal data of children under 16 years of age.
Mandatory and Optional Data
To use Obvelum, certain data is required, while other data is optional:
Required Data
Email address (for account creation and authentication)
Basic profile information (location) when activating your profile
Without this data, we cannot create or maintain your account or provide the core matching Service.
Optional Data
Skills, certifications
Work history
CV uploads and AI-assisted profile generation
Open to work status
Providing more detailed information improves matching accuracy but is entirely your choice.
Data Retention
We keep personal data only for as long as we need it for the purposes described in this policy. The periods below describe what our systems do today.
Retention Periods:
• Profile and account data: kept for as long as your account exists.
• Messages, email records, interview and assessment records: kept for as long as your account exists. There is currently no shorter automatic deletion for these records.
• Self-Hosted Analytics (Umami): Anonymous page view data is retained for as long as the Platform operates. No personal data is stored.
• Application logs: kept for up to 14 days in Grafana Cloud for security monitoring and incident investigation.
• Encryption key access log: your encrypted data is protected by a key of its own, held in Azure Key Vault (Switzerland). Each time our services read that key, Key Vault records it under a name derived from your user identifier. These records are kept for 90 days for security monitoring and incident investigation. Deleting your account destroys the key.
• Backups: encrypted database backups are kept for up to 31 days and then expire.
• Legal Requirements: Records required by law (e.g., tax, fraud prevention) may be retained for statutory periods.
When you delete your account:
Deleting your account removes your profile and deletes or de-identifies the data linked to you in our services: your messages and conversations, contact requests, interview attendance, assessments, email records and blog comments. Deletion normally completes immediately. If any part fails, it is retried automatically until it completes, and you are shown a reference number.
Some data remains after deletion:
• Backups: your data stays in encrypted backups until they expire, at most 31 days later. Backups cannot be edited to remove one person, and we keep them to meet our legal obligation to be able to restore data after an incident (Art. 17(3)(b) GDPR, with Art. 32).
• Security audit records: records of security-relevant events, such as your deletion request, which contain your user identifier and, for some events, an IP address. The archived copy is write-once and deleted after 365 days. We keep these records to meet our security and accountability obligations and to establish or defend legal claims (Art. 17(3)(b) and (e) GDPR). A second copy is held in our database; its automatic deletion after 365 days is not yet in place, so that copy is currently kept without a time limit.
• Application logs: log lines containing your user identifier or IP address are not removed early and expire within 14 days.
• Our sign-in system: we run our own identity provider (Zitadel). When you delete your account, your sign-in account is removed, but the identity provider's internal event log keeps the email address you registered with and either a hash of your password or the identifier of the Google account you signed in with. No released version of this software can erase them, and we have decided against modifying the software ourselves because a change of that kind could break sign-in for every user. This is a technical limitation, not a legal requirement, and we do not rely on any legal exemption to keep this data. None of our services reads this log, and only administrators of the identity provider can access it.
Your Rights under GDPR
The GDPR and, where applicable, the Swiss FADP give you the following rights. You can exercise them by contacting us at [email protected] or through our EU representative (see "Data Controller"):
Right of Access: You can view the data we hold about you in your profile and request a full copy anytime in your dashboard by clicking on the top-right menu and then clicking "Export my data".
Right to Erasure ('Right to be Forgotten'): You can delete your account at any time from the account menu at the top right ("Delete account"). Some data remains after deletion, including your email address in our sign-in system. "Data Retention" explains what remains and why.
Right to Rectification: You can request correction of inaccurate or incomplete personal data.
Right to Restriction of Processing: You can request limitation of processing under certain circumstances.
Right to Object: You may object to processing based on legitimate interest at any time.
Data Portability: You can request a machine-readable export (JSON format) of your data.
Right to Withdraw Consent: Where we process your data based on consent (optional functional cookies, the weekly job digest, or showing a sensitive field of study to employers), you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent via Cookie Settings, your account settings, the switch on the education entry, or by contacting us.
Right to Lodge a Complaint: You have the right to lodge a complaint with a competent supervisory authority if you feel your personal data has been processed unlawfully. You may in particular contact your local data protection authority in the EU/EEA or the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Data Security & Encryption
Security is a high priority for us. We implement appropriate technical and organizational measures, including encryption at rest, TLS 1.3 encryption in transit, and Application-Layer Encryption (sensitive data like emails and messages are encrypted using AES-GCM 256-bit before storage). We minimize data exposure by using internal identifiers (Pseudonymization) protected by strict Role-Based Access Control (RBAC) and continuous monitoring.
International Data Transfers
The Platform is hosted by Microsoft Azure in Switzerland. The European Commission has recognised Switzerland as providing an adequate level of data protection.
Some of our providers are established outside the EU/EEA and Switzerland, mainly in the United States, or may process data there:
• Azure OpenAI (Microsoft): our resources are in Sweden and requests are processed in the EU and EFTA countries, but Microsoft may access data from outside these countries in limited cases, such as security operations.
• Slack (Salesforce, Inc.), Grafana Cloud (Grafana Labs), Mailgun (Mailgun Technologies, Inc.), Daily.co and Cloudflare are based in the United States. Grafana Cloud, Mailgun and Daily.co store or process our data in the EU, but it may still be accessed from the United States.
• Google, if you choose to sign in with your Google account.
Our agreements with Microsoft, Salesforce (Slack), Grafana Labs, Mailgun and Daily.co include the EU Standard Contractual Clauses for these transfers.
When you access the Platform from outside the EEA, your data is displayed to you wherever you are located. This is a display of data you request, not a transfer initiated by us.
Data Processing & Subprocessors
Independent Controllers
Company Accounts and Uploaded Content
When companies create accounts and upload content (such as job postings, logos, descriptions, or contact details), they may include personal data relating to their employees or representatives. In this context, companies act as independent data controllers for such personal data, and Obvelum acts as a data processor, processing this data solely on the company's documented instructions for the purpose of providing the Platform. This processor relationship applies only to personal data included in company-uploaded content (job postings, company descriptions, employee contact details), not to user profile data.
Companies are responsible for ensuring they have the legal right to upload and publish any personal data included in their content.
Data Processors
We use third-party providers to host our infrastructure and provide essential services. Our current subprocessors are: • Microsoft Azure (hosting, databases and backups, Switzerland North region) • Azure OpenAI Service (Microsoft; AI features). Our resources are in Sweden, and requests are processed in Microsoft's EU Data Zone, which covers data centres in the EU and in the EFTA countries Iceland, Liechtenstein, Norway and Switzerland. Details below. • Cloudflare (CDN, routing, and web security monitoring). Cloudflare processes IP addresses temporarily to detect malicious traffic and prevent client-side attacks. • Mailgun (Mailgun Technologies, Inc., US; transactional email, sent through Mailgun's EU region). Mailgun receives your email address and the content of the emails we send you. • Daily.co (Daily, US; video calls for interviews and sessions, with call media handled in Daily's Frankfurt region). Obvelum does not send Daily your name or email address. Daily processes your IP address, your audio and video streams and any name you choose to show in the call, for the duration of the call. In-call chat is disabled, and Obvelum does not enable call recording. • Slack (Slack Technologies Limited, Ireland, with Salesforce, Inc., US; internal security alerts). An alert can contain your user identifier, and a one-way fingerprint and the length of a text that triggered our AI safety filter. An IP address is included only in alerts about access to our administration console, together with the account's roles. Alerts do not contain the text or files you submit. • Grafana Cloud (Grafana Labs, US; EU data region; application logs). Our services' logs contain IP addresses and account identifiers and are kept for up to 14 days.
Azure OpenAISweden Central
We use Azure OpenAI Service for AI feature extraction. Our Azure OpenAI resources are deployed in the EU (Sweden) and use Microsoft's EU Data Zone, so requests are processed in Microsoft data centres in the EU or in the EFTA countries Iceland, Liechtenstein, Norway and Switzerland. Microsoft's terms allow limited exceptions, such as remote access by its staff and security operations, which can take place outside these countries. Prompts and completions sent to Azure OpenAI are not used to train or improve Microsoft's or OpenAI's foundation models and are processed under Microsoft's data protection terms, which incorporate the EU Standard Contractual Clauses. Microsoft stores prompts and completions for up to 30 days to detect abuse of the service. This applies to every request and is not something we can switch off. The stored data stays in the EU region of our resources, and only authorised Microsoft staff located in the European Economic Area may review it, and only for requests flagged as potential misuse.
Third-Party Organisations and Data Responsibility
Obvelum connects candidates with three categories of organisations: direct employers, recruitment agencies, and paid research platforms. In all cases Obvelum's role is limited to facilitating discovery, matching, and initial connection. We do not act on behalf of any organisation and we do not determine how each organisation processes data collected during or after an interaction.
• From the moment you engage directly with an organisation - whether joining a scheduled call, exchanging messages, or participating in a session - that organisation acts as an independent data controller for any data it processes in connection with that interaction.
• Obvelum does not access or review the content of user communications or session content in the ordinary operation of the service. Communications are stored in encrypted form and are only accessed in strictly limited, documented circumstances: legal obligation, security or abuse prevention, or user-requested support.
• Live calls that Obvelum schedules run on Daily.co (see "Data Processing & Subprocessors"). Obvelum does not enable call recording and does not receive the audio or video. It records only when each participant joins and leaves a call, to establish whether the interview took place.
• You may withdraw from any confirmed booking at any time before the interaction begins by cancelling through the platform. Once you have joined and chosen to disclose personal information, that disclosure is governed by the organisation's own privacy policy and applicable law.
We recommend reviewing the privacy policy of each organisation before disclosing personal information.
Additional considerations for research platforms
Paid research platforms may collect data beyond what a standard employer interaction involves - including session recordings, survey responses, and behavioural data. Obvelum does not determine the scope, purpose, or means of that data collection. All such data is processed under the Research Platform's own privacy policy, not Obvelum's.
Recipients and Categories of Recipients
We share personal data only when necessary with the following categories of recipients:
Cloud Infrastructure Providers: Microsoft Azure, for hosting, data storage and backups (Switzerland)
Email Service Providers: Mailgun for transactional emails (registration, notifications)
Authentication Providers: Google Sign-In (provided by Google Ireland Limited for users in the EEA), used only if you choose to register or log in with your Google account. In that case we receive only your email address - we do not receive your name, profile photo, or any other Google profile data. Google acts as the identity provider for that sign-in.
AI Services: Azure OpenAI (EU resources in Sweden; requests processed in the EU and EFTA countries) for profile extraction and matching
Web Security & Content Delivery Networks: Cloudflare, for DDoS protection, traffic routing, and monitoring malicious script activity on the Platform.
Video Conferencing: Daily.co, for interview and session calls (what Daily receives is described under "Data Processing & Subprocessors")
Security Alerting: Slack (Salesforce), for internal security alerts that can contain user identifiers; IP addresses are included only in alerts about administration console access attempts
Application Logging: Grafana Cloud (Grafana Labs), for application logs containing IP addresses and account identifiers, kept for up to 14 days
Legal & Regulatory Authorities: When required by law or to protect our rights
Microsoft, Salesforce (Slack), Grafana Labs, Mailgun, Daily.co and Cloudflare process personal data on our behalf under data processing agreements that limit them to our instructions.
Cookie Policy
We use cookies only to keep the Platform working and to remember your preferences. We do not use any advertising, marketing, or third-party tracking cookies.
Self-Hosted Analytics: To understand how the Platform is used, we rely solely on Umami, a privacy-focused, open-source analytics tool hosted entirely within our own infrastructure. No data is transferred to any third party. Umami collects anonymous page view and navigation data (page URL, referrer, browser type, country), does not use cookies, and does not track individuals across sessions.
Strictly Necessary: Required for authentication, security, and session management. These cannot be disabled.
Functional: Used to remember your app preferences (e.g. theme, language). These are optional but enhance your experience.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date at the top of this page. Continued use of the Platform after changes become effective constitutes your acknowledgment of the updated Privacy Policy. Where required by law (e.g., for material changes affecting your rights or processing purposes), we may seek your explicit consent before the changes take effect.
This is the original English version, produced with the assistance of AI tools. The English version remains the legally binding text.