Privacy Policy

1. Introduction

Cayus (Agen, France) is a recruitment service that sources, contacts, and qualifies job candidates on behalf of hiring companies ("clients"). This Privacy Policy explains how we handle personal data belonging to two different groups: our clients, and the candidates we source and contact on a client's behalf. Candidates are not our users, and this policy explains how their data is handled under Article 14 GDPR (see Section 5).

2. Data Controller

EI - ENZO ROMA
Agen, France
SIRET: 98972292100024
Email: contact@cayus.io

3. Client Data We Collect

Contact information: name, work email, company, role
Engagement details: role requirements, qualification criteria, compensation range shared for a search
Payment information: processed securely through Stripe. We do not store card numbers.
Communications between Cayus and the client

4. Candidate Data We Collect

To fill a client's open role, we source publicly available professional profile data (name, current title, employer, tenure, skills, public contact details) through a third-party sourcing platform. We contact a small number of sourced candidates directly. For candidates who respond, we additionally record:

Their reply and stated reason for being open to a conversation
Self-reported availability and compensation expectations, if shared
Whether they were qualified against the client's criteria

Candidate names and identifying details are not shared with the client until the client has signed engagement terms for that specific role.

5. Legal Basis for Processing Candidate Data (GDPR Article 14)

Because candidate data is not collected directly from the candidate in the first instance, GDPR Article 14 requires this notice. We process candidate data on the basis of legitimate interest: matching a professional to a specific, named job opening they may not otherwise have heard about. We balance this interest against the candidate's rights as follows:

We only contact candidates whose public profile indicates they are plausibly qualified and currently employed in a comparable role.
We verify the profile is current before contacting, and again before an interview is scheduled.
The first message we send discloses who we are and why we are reaching out, and always offers an opt-out.
A candidate who does not respond, or who asks not to be contacted, is not contacted again for that search or a future one.

Candidates can object to this processing or request erasure at any time by emailing privacy@cayus.io, or by replying "opt out" to any message from us.

6. How We Use This Data

To identify and contact candidates who may be a fit for a specific client role
To verify and record a candidate's qualification against the client's agreed criteria
To coordinate and schedule interviews
To invoice clients based on interviews held
To comply with legal obligations

We do not sell candidate or client personal data.

7. AI-Assisted Processing

We use AI tools internally to help draft outreach and structure qualification notes from candidate replies. A person reviews every candidate-facing message and every qualification claim before it is sent or shared with a client. Data processed by our AI tooling provider is governed by their data processing terms and is not used to train their general-purpose models.

8. Sub-processors

We share data with a small number of vetted service providers acting as processors on our behalf, each bound by a data processing agreement:

A professional-network sourcing and enrichment platform, used for candidate and company sourcing and outreach sequencing
A cloud hosting provider, used for this website
An AI-assisted drafting and qualification support tool
A payment processor, used for client billing only

We describe these by function rather than by brand for competitive reasons; the identity of each provider is available on request to clients and candidates exercising their data rights under Section 12.

9. International Data Transfers

Cayus is based in France. Some sub-processors are located outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Data Security

We use TLS 1.2+ in transit, encryption at rest, and role-based access control. In the event of a personal data breach that poses a risk to affected individuals, we will notify the CNIL within 72 hours and affected individuals without undue delay.

11. Data Retention

Client account data: retained for the duration of the relationship, deleted within 30 days of a written request thereafter.
Candidate data for a search that did not lead to contact: not retained beyond the active search.
Candidate data for a contacted candidate: retained for up to 12 months to avoid re-contacting the same person on an unrelated search, then deleted or anonymized, unless the candidate requests earlier deletion.
Financial records: 10 years, as required under French law.

12. Your Rights

Under GDPR, both clients and candidates have the right to:

Access the personal data we hold
Correct inaccurate data
Request erasure
Object to processing based on legitimate interest
Data portability, where applicable
Lodge a complaint with the CNIL (cnil.fr)

California residents have equivalent rights under the CCPA, including the right to know, delete, and opt out of sale (we do not sell personal data).

To exercise any right, contact privacy@cayus.io. We respond within 30 days.

13. Cookies

The Cayus website does not set cookies. No advertising, analytics, or cross-site tracking. See our Cookie Policy for detail.

14. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly source or contact minors as candidates.

15. Changes to This Policy

We may update this Privacy Policy. Material changes are notified by email to active clients at least 30 days before taking effect.

16. Contact and Complaints

Questions about this policy or your data: privacy@cayus.io. EU complaints: CNIL at cnil.fr.