RayCruit Privacy Policy

Version 1.0 | Effective date: 25 August 2026

RayCruit is a product of dolani GmbH, Kolbenacker 14, CH-8052 Zurich, Switzerland.

This Privacy Policy describes processing of personal data by dolani GmbH ("dolani") where dolani itself determines the purposes and essential means of processing, in particular in connection with the public RayCruit website, business contacts, contract initiation, customer accounts, support, security and dolani’s own operations.

It does not fully describe processing of candidate, customer, contact or other personal data that a RayCruit customer processes under its own responsibility within RayCruit. Where dolani processes such data solely on behalf of a customer, the Data Processing Agreement ("DPA") concluded with that customer applies.

1. Controller

The controller for dolani’s own processing described in this Privacy Policy is generally:

dolani GmbH

Kolbenacker 14

CH-8052 Zurich

Switzerland

Privacy requests may be sent by post to this address or through the contact details published in the legal notice/imprint of the RayCruit website.

2. Role Allocation: Controller and Processor

2.1 Dolani typically acts as controller for operation of the public website, handling of contact and demo requests, contract initiation and administration, account and user administration, billing for its own services, support, information security, abuse prevention and statutory compliance processes.

2.2 Where a business customer provides personal data in RayCruit and determines the purposes and permitted use, the customer generally acts as controller and dolani as processor. This particularly concerns candidate, applicant, customer, contact, recruiting, communications and placement data.

2.3 Data subjects whose data is processed solely by a RayCruit customer should generally address privacy requests to that customer. Dolani supports the customer in accordance with the DPA.

3. Categories of Personal Data

Depending on context, we may process in particular:

• identity and contact data;
• company affiliation, role and business communications;
• account, authentication and permission data;
• contract, order, payment and billing data;
• support, demo and sales information;
• IP address, device, browser, session, usage, telemetry and security logs;
• marketing preferences and interaction data.

When processing on behalf of customers, data may additionally include:

• CVs and candidate profiles;
• career history, education and qualifications;
• skills, capabilities and languages;
• leadership experience and budget responsibility;
• compensation information and availability;
• location information;
• interview notes and recruiter or customer feedback;
• match, scoring and evidence information;
• career gaps and other information extracted from documents;
• mandate, submission, placement and process history;
• documents and attachments;
• customer and contact data;
• commercial terms where they contain personal data.

Depending on customer inputs, data may also include information extracted or inferred from unstructured documents or text.

4. Sources of Data

We receive data directly from you, your employer or company, other persons in your organisation, a RayCruit customer, through forms and user accounts, from support and sales communications, from systems connected by the customer, and from lawfully accessible sources where permitted for the relevant purpose.

Where a RayCruit customer provides personal data, that customer is responsible for the lawfulness of collection, transfer and use.

5. Purposes of Dolani’s Own Processing

Dolani processes personal data as controller in particular to:

• provide and secure the RayCruit website and accounts;
• handle enquiries and product demos;
• enter into and perform contracts and manage customers;
• administer users and permissions;
• provide support and analyse errors;
• improve product and security;
• authenticate users;
• detect abuse, fraud and attacks;
• bill its own services and perform accounting;
• defend legal claims;
• comply with legal obligations;
• conduct lawful business and marketing communications.

Where dolani acts as processor, the purposes and permitted processing are determined by the documented instructions of the relevant customer and the DPA.

6. Lawful Bases

Where the GDPR applies, dolani relies depending on the circumstances in particular on:

• Art. 6(1)(b) GDPR: contract performance and pre-contractual steps;
• Art. 6(1)(c) GDPR: legal obligations;
• Art. 6(1)(f) GDPR: legitimate interests;
• Art. 6(1)(a) GDPR: consent, where required.

Legitimate interests include secure and efficient operation, abuse and fraud prevention, customer service, business development, internal administration, service improvement and legal defence.

For processing carried out on behalf of a customer, the customer generally determines the lawful basis applicable to its processing.

7. Candidate and Recruiting Data Processed for Customers

RayCruit supports professional recruiting, executive-search and placement processes. In ordinary platform use, dolani does not itself decide which candidate is admitted, interviewed, rejected, placed or hired.

The relevant customer is generally responsible for lawful basis, transparency, purpose limitation, data minimisation, retention, deletion and the lawfulness of its recruiting and selection processes.

Dolani processes such data on the customer’s instructions and under the DPA.

8. AI, Matching and Profiling

RayCruit may use AI-enabled functions and rule-based analytics to structure CVs and job information, categorise information, compare candidates and mandates, prepare evidence, calculate scores, and generate interview questions or text suggestions.

Depending on the specific use, such operations may constitute profiling under data-protection law.

As part of the standard RayCruit service, dolani does not make final hiring, rejection or employment decisions about candidates.

The customer is responsible for ensuring that its specific use is lawful, including required human oversight, transparency and, where applicable, data-protection or other impact assessments.

9. Processing by Mistral AI

For certain AI functions, RayCruit may transmit inputs or required excerpts of Customer Data to Mistral AI, France.

Mistral AI processes such data as a subprocessor for delivery of the relevant AI/LLM function.

Dolani limits transmission to data required for the relevant function. Processing takes place within Europe. Details on instructions, confidentiality, security and subprocessing are governed by the DPA.

10. Hosting by Hetzner

RayCruit’s production core infrastructure is operated with Hetzner Online GmbH, Germany.

Platform and Customer Data are stored and processed there to the extent the relevant function does not require processing by Mistral AI.

This European data residency supports compliant use but does not replace the customer’s responsibility for the lawfulness of its specific recruiting and data-processing activities.

11. Current Subprocessors

For the RayCruit core service, dolani currently uses the following subprocessors:

Changes or additions to subprocessors are handled in accordance with the DPA and the notice or objection mechanisms agreed there.

12. European Data Residency and International Transfers

The RayCruit core service is designed for European data residency. The current core subprocessors are located in Germany and France; dolani itself is established in Switzerland.

For normal core processing, no routine transfer of Customer Data to third countries outside the EU/EEA or Switzerland is intended.

If an international transfer becomes necessary in an individual case in the future, it will take place only under a legally permitted transfer mechanism, for example an adequacy decision or appropriate safeguards.

13. Third-Party Integrations Activated by the Customer

A customer may be able to connect RayCruit to third-party services of its own choice.

Where the customer selects such a service and has its own contractual relationship with it, further processing by that provider is governed by that provider’s terms and privacy information.

The customer is responsible for lawfulness of activation, required internal approvals, any applicable co-determination requirements and selection of data transmitted.

14. Website, Cookies and Similar Technologies

We use strictly necessary cookies or similar technologies where required for operation, security, language settings, session management or consent management.

Non-essential analytics, personalisation or marketing technologies are used, where legally required, only after consent.

Consent may be changed or withdrawn at any time with future effect.

15. Business Communications and Marketing

We may send business contacts information about RayCruit, events or related services to the extent permitted by law.

Direct marketing may be objected to at any time. Transactional, security, support and contractual communications are not affected by a marketing objection.

16. Special Categories and Highly Protected Data

RayCruit is not intended for large-scale processing of special categories of personal data under Art. 9 GDPR or criminal-offence data without a specific need.

Customers should process such data only where necessary for the specific purpose, an appropriate lawful basis exists and suitable safeguards are in place.

17. Retention and Deletion

Dolani retains data for which it acts as controller only for as long as necessary for the relevant purpose, contractual relationships, statutory retention, security, evidence, limitation periods, and establishment or defence of claims.

For Customer Data processed by dolani as processor, retention and deletion are governed by customer instructions, the DPA and legal obligations.

After termination, data is deleted or anonymised under the agreed deletion process. Protected backups may remain until overwritten under normal cycles.

18. Data Security

Dolani implements appropriate risk-based technical and organisational measures. Depending on the system these may include:

• role-based access control;
• multi-factor authentication;
• encryption in transit and at rest;
• logging and monitoring;
• backup and recovery procedures;
• vulnerability management;
• supplier review;
• incident response.

Absolute security or prevention of every attack cannot be guaranteed.

19. Role-Based Access Control

RayCruit supports role-based access control (RBAC).

Depending on configuration, customers can control which users may view or edit specific candidate, customer, mandate, administrative or commercial information.

The customer is responsible for its concrete role and permission configuration.

20. Data Subject Rights

Where dolani itself acts as controller and the GDPR or comparable privacy law applies, data subjects may in particular have rights of:

• access;
• correction;
• deletion;
• restriction of processing;
• data portability;
• objection;
• withdrawal of consent;
• complaint to a competent data-protection authority.

Dolani may reasonably verify identity, jurisdiction and authority before handling a request and may apply statutory exceptions.

21. Requests Relating to Customer Data

Where personal data is processed in RayCruit by a customer, that customer is generally responsible for handling data-subject rights.

Data subjects should therefore first contact the recruiting organisation or company that processes their data in RayCruit.

Where dolani acts as processor, dolani does not independently decide on deletion, correction or disclosure of Customer Data but supports the customer under the DPA.

22. Automated Decisions

RayCruit is designed to support human recruiting decisions.

As part of the standard platform service, dolani does not make solely automated hiring or rejection decisions about candidates that produce legal or similarly significant effects.

Where a customer uses RayCruit in a manner that could result in such a decision, the customer is responsible for assessing lawfulness and implementing required safeguards.

23. Children and Minors

The public RayCruit website and general B2B service are not directed to children.

Where customers process minors’ data in a lawful recruiting context, they are responsible for the required lawful bases and safeguards.

24. Changes to this Privacy Policy

Dolani may update this Privacy Policy when law, organisation, RayCruit, infrastructure or processing activities change. The version then published applies.

An update to this Privacy Policy does not automatically amend a valid DPA or Individual Agreement.

25. Contact and Supervisory Authorities

Privacy requests may be sent to:

dolani GmbH

Kolbenacker 14

CH-8052 Zurich

Switzerland

or through the contact details published in the legal notice/imprint of the RayCruit website.

Data subjects may also contact the data-protection supervisory authority competent for them.