Privacy Notice

1. Introduction

Ami AI provides an AI-powered recruitment and candidate voice-screening platform to employers and recruitment businesses (our “Clients”). This Privacy Notice explains how personal data is handled in connection with our services and, importantly, who is responsible for it.

For the personal data of candidates and other individuals processed through our platform on behalf of a Client, the Client is the data controller and Ami AI acts as a data processor under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. We process that data only on the documented instructions of the relevant Client, under a written data processing agreement that complies with Article 28 UK GDPR.

Ami AI acts as a data controller only in respect of visitors to our website, as described in section 10. In all other respects we act as a processor on behalf of our Clients.

2. Our Role: Controller vs Processor

• Where Ami AI is a processor: candidate profiles, CVs, applications, interview and voice-screening recordings and transcripts, assessment outputs, and messages exchanged with employers or recruiters through the platform. The Client (the employer or recruitment business you are engaging with) determines the purposes and means of this processing. If you are a candidate, the Client’s own privacy notice governs this processing, and questions about why your data is processed should be directed to them.
• Where Ami AI is a controller: data about visitors to our website only – for example IP address, browser and device information, and cookies and analytics used on our website for our own purposes.

3. Personal Data We Process on Behalf of Our Clients

Depending on the services a Client has engaged us to provide, we may process the following categories of personal data as a processor:

• Identity and Contact Data: name, email address, phone number, postal address and other contact details.
• Employment Data: CVs, cover letters, job preferences, employment history, education, skills and certifications.
• Interview and Screening Data: call recordings, transcripts and outputs from voice-screening interactions conducted on behalf of a Client.
• Communication Data: messages exchanged between candidates, employers and recruiters through the platform.
• Account Data: username, password, security questions and related account security information for platform users, processed to provide and secure access to the platform as part of the services we deliver to the Client.

We do not determine what data is collected through the platform for recruitment purposes – this is decided by the Client.

4. How We Process Client Data

As a data processor, we:

• process personal data only on the documented instructions of the relevant Client, including with regard to any international transfers, unless we are required to process it by UK law (in which case we will inform the Client unless prohibited from doing so);
• do not use candidate data for our own purposes;
• ensure that all personnel authorised to process personal data are bound by obligations of confidentiality;
• assist Clients, by appropriate technical and organisational measures, in responding to requests from individuals exercising their data protection rights;
• assist Clients in meeting their obligations relating to security, breach notification, and data protection impact assessments;
• make available to Clients the information necessary to demonstrate compliance with Article 28 UK GDPR, and allow for and contribute to audits and inspections; and
• at the end of the provision of our services, delete or return all personal data to the Client (at the Client’s choice), and delete existing copies unless UK law requires their storage.

5. Sub-Processors

We engage third-party sub-processors (for example, hosting, analytics infrastructure and communications providers) to help us deliver the platform. We do so only with the general or specific written authorisation of our Clients, as set out in our data processing agreement. Where we appoint a sub-processor, we impose data protection obligations on it equivalent to those in our agreement with the Client, and we remain fully liable to the Client for the sub-processor’s performance. A current list of our sub-processors is available on request, and we give Clients advance notice of any intended changes so they may object.

We may also disclose personal data to courts, regulators or law enforcement authorities where required by law; where possible and lawful, we will notify the relevant Client before doing so.

6. Data Retention and Deletion

Retention periods for candidate data processed on behalf of Clients are determined by the relevant Client. On termination or expiry of our services to a Client, we delete or return personal data in accordance with section 4 above and the Client’s instructions.

7. Security

In accordance with Article 32 UK GDPR, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Details of our security measures are set out in our data processing agreement with each Client.

8. Personal Data Breaches

If we become aware of a personal data breach affecting data we process on behalf of a Client, we will notify that Client without undue delay and provide the information reasonably required to enable the Client to meet its own notification obligations to the Information Commissioner’s Office (ICO) and affected individuals. As a processor, we notify the Client rather than the regulator or individuals directly, unless otherwise required by law or instructed by the Client.

9. International Data Transfers

We transfer personal data processed on behalf of Clients outside the UK only in accordance with the relevant Client’s documented instructions and where appropriate safeguards are in place, such as the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism under UK GDPR.

10. Website Visitors – Data for Which Ami AI Is the Controller

The only personal data for which Ami AI acts as a data controller is data relating to visitors to our website: IP address, browser type, device information and interactions with our website, together with cookies and similar technologies. We process this data to operate, secure and improve our website, relying on our legitimate interests (and, for non-essential cookies, your consent).

For this website visitor data only, you may exercise your UK GDPR rights (access, rectification, erasure, restriction, portability and objection) directly against Ami AI using the contact details in section 13. You also have the right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk).

11. Your Rights as a Candidate

If you are a candidate whose data is processed through our platform on behalf of an employer or recruiter, that Client is the controller of your data. Your rights of access, rectification, erasure, restriction, portability and objection should be exercised against the Client, in accordance with its privacy notice. If you send a rights request to us in relation to data we process as a processor, we will not respond on the Client’s behalf; we will pass your request to the relevant Client without undue delay and assist them in responding to you.

12. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to improve functionality, analyse usage and personalise content. Where we set cookies for our own purposes we do so as a controller, and non-essential cookies are used only with your consent. You can manage cookie preferences through your browser settings or our cookie banner.

13. Contact Us

If you have questions about this Privacy Notice, our role as a processor, or wish to exercise rights in relation to data for which we are the controller, please contact:

14. Updates to This Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be posted on this page with a revised effective date.