1. Who We Are and What This Policy Covers
Zocalo LLC, a Delaware limited liability company doing business as ZOCALO (“ZOCALO,” “we,” “us,” or “our”), provides recruiting, staffing, candidate-presentation, client-collaboration, communication, artificial-intelligence, engagement-analytics, and related services.
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through our websites, applications, candidate-profile pages, recruiting services, integrations, communications, and other related products and services collectively, the “Services.”
This Privacy Policy applies to:
- Recruiting and staffing agencies, employers, and other ZOCALO customers;
- Recruiters, administrators, and team members;
- Candidates and prospective candidates;
- Hiring managers, client stakeholders, and other recipients of candidate profiles;
- Individuals who access shared candidate profiles;
- Professional contacts who receive recruiting or business communications;
- Visitors to our websites; and
- Individuals who contact or otherwise interact with us.
For purposes of this Policy:
A “Customer” is an agency, employer, or other organization using the Services.
An “Authorized User” is a person permitted by a Customer to use or receive information through the Services.
A “Candidate” is an individual whose professional or recruiting information is processed through the Services.
A “Profile Viewer” is an individual who accesses or interacts with a shared candidate profile.
“Customer Content” means candidate, recruiting, communication, job, client, and related information submitted to the Services by or for a Customer.
2. When ZOCALO Acts for a Customer
Customers may use ZOCALO to upload candidate information, connect recruiting systems, communicate with hiring stakeholders, share candidate profiles, manage recruiting workflows, and review engagement activity.
When ZOCALO processes Customer Content on a Customer’s behalf, the Customer generally determines why and how the information is processed. In that context, the Customer generally acts as the controller or business, and ZOCALO generally acts as its processor, service provider, or contractor.
Questions or privacy requests concerning Customer Content may need to be directed to the Customer that supplied or controls the information. Where required, ZOCALO will assist the Customer with responding to valid requests.
ZOCALO generally acts as the controller or business for information used for its own:
- Website operations;
- Account and relationship management;
- Billing;
- Customer support;
- Security and fraud prevention;
- Business communications;
- Recruiting and staffing services;
- Service administration and improvement;
- Legal compliance; and
- Aggregated or de-identified analytics.
3. Information We Collect
A. Account, Customer, and Business Information
We may collect information such as:
- Name;
- Work email address;
- Telephone number;
- Employer or organization;
- Job title and professional role;
- Account and organization identifiers;
- Authentication information;
- Team membership;
- Communication preferences;
- Subscription and billing information; and
- Information submitted in support requests or other communications.
B. Candidate and Recruiting Information
Customers, Candidates, integrations, or other authorized sources may provide information such as:
- Names and contact information;
- Resumes and CVs;
- Employment history;
- Education;
- Skills, qualifications, certifications, and experience;
- Current or desired role;
- Geographic location;
- Compensation expectations;
- Work-authorization information;
- Job preferences;
- Professional-profile links;
- Recruiter notes, assessments, and summaries;
- Interview notes;
- Job descriptions and hiring criteria;
- Client and stakeholder feedback;
- Candidate status and workflow history;
- Files and attachments; and
- Other information relevant to a recruiting or staffing process.
Candidate documents may incidentally contain sensitive information. Customers should avoid submitting sensitive information that is not reasonably necessary for the applicable recruiting process.
C. Shared Candidate Profile Access and Usage
When a Profile Viewer enters or verifies a work email address or accesses or interacts with a shared candidate profile, we collect information relating to that access and interaction.
This information may include:
- Work email address;
- Employer, company, or email domain;
- Internet Protocol address;
- Browser and device information;
- Session and authentication identifiers;
- The candidate profile, page, or material accessed;
- Date and time of access;
- First and repeat visits;
- Duration of interaction;
- Links, sections, or features used;
- Actions taken within the profile;
- Sharing or referral activity, where available;
- Introduction or interview requests;
- Comments, messages, or feedback;
- Workflow and status activity; and
- Related access and security events.
We may associate this information with the work email address, organization, domain, account, device, browser, or session involved.
We use this information to:
- Verify and authorize access;
- Protect candidate confidentiality;
- Prevent unauthorized access;
- Operate the shared-profile experience;
- Provide recruiting-workflow and engagement information;
- Support collaboration;
- Diagnose technical issues; and
- Maintain security.
Profile-access and related activity information may be visible to the Customer that shared or manages the profile and to its Authorized Users.
We disclose this information to the applicable Customer and Authorized Users, and to service providers supporting the Services. We do not use private candidate-profile activity for cross-context behavioral advertising.
We retain this information under the criteria described in Section 9.
D. Communications and Outreach Information
When communications are created, sent, received, or managed through the Services, we may process:
- Email and message content;
- Group-chat and direct-message content;
- Recipient and sender information;
- Attachments;
- Date and time information;
- Delivery and bounce information;
- Replies;
- Unsubscribe and suppression information;
- Link interactions; and
- Open information, where that feature is enabled.
We may also maintain records of communications with ZOCALO regarding demonstrations, onboarding, implementation, support, billing, or other business matters.
E. Information From Third Parties and Public Sources
We may receive professional, employment, company, recruiting, or business-contact information from:
- Customers and their users;
- Candidates;
- Applicant tracking systems;
- Customer relationship management systems;
- Email and calendar integrations;
- Recruiting and sourcing providers;
- Commercial data providers;
- Professional networking sources;
- Publicly available websites;
- Company websites;
- Authentication providers;
- Analytics and security providers; and
- Other service providers and integration partners.
This information may include:
- Name;
- Job title;
- Employer;
- Work email address;
- Business telephone number;
- Professional profile;
- Company or domain information;
- Hiring responsibility;
- Professional experience;
- Job and hiring information; and
- Business or recruiting signals.
F. Technical, Device, and Log Information
We may automatically collect:
- Internet Protocol address;
- Browser type;
- Device type;
- Operating system;
- Device or application identifiers;
- Referring and exit pages;
- Dates and times;
- Session identifiers;
- Approximate location derived from an IP address;
- Log and diagnostic information;
- Error reports;
- Cookie and local-storage identifiers; and
- Security events.
ZOCALO does not ordinarily need precise GPS location to provide its core Services.
G. AI-Generated Information and Inferences
ZOCALO may generate information or inferences from candidate, job, company, communication, and engagement information.
These may include:
- Candidate-to-role alignment;
- Candidate summaries;
- Candidate strengths or potential concerns;
- Interview-question suggestions;
- Hiring-manager or stakeholder identification;
- Engagement level;
- Stakeholder participation;
- Account activity;
- Workflow status;
- Communication suggestions;
- Recommended follow-up actions; and
- Other recruiting or client-alignment insights.
H. Payment Information
When a Customer purchases the Services, we may collect billing contacts, subscription information, payment status, transaction records, and associated accounting information.
Complete payment-card information is generally processed by a third-party payment processor rather than stored directly by ZOCALO.
4. How We Use Personal Information
We may use personal information to:
- Provide, operate, maintain, and secure the Services;
- Authenticate users and Profile Viewers;
- Control access to private candidate profiles;
- Present Candidates to intended clients and hiring teams;
- Match or compare Candidates with job opportunities;
- Identify relevant companies, hiring managers, decision-makers, and recruiting stakeholders;
- Generate candidate summaries, recruiter insights, and recruiting recommendations;
- Generate and personalize Customer-directed outreach;
- Send and manage recruiting or business communications;
- Track delivery, responses, and communication preferences;
- Provide profile-access and engagement information, including views, repeat activity, timing, and actions;
- Produce stakeholder, account, and workflow insights;
- Support group chat, direct communications, comments, and feedback;
- Maintain time-stamped recruiting stages and workflow events;
- Produce Customer reporting;
- Process subscriptions and payments;
- Provide onboarding, implementation, training, and customer support;
- Detect unauthorized access, fraud, abuse, and security incidents;
- Monitor availability, reliability, and performance;
- Diagnose technical issues;
- Improve existing features and develop new features;
- Conduct internal research and analysis;
- Maintain legal, accounting, and business records;
- Enforce agreements and policies;
- Comply with legal obligations; and
- Protect the rights, safety, and property of ZOCALO, our Customers, Candidates, users, and others.
We may use professional business-contact information to communicate about recruiting opportunities, candidates, partnerships, demonstrations, products, or services where permitted by law.
Recipients may opt out of marketing or recruiting communications using the method included in the communication.
5. Artificial Intelligence and Automated Processing
ZOCALO uses artificial intelligence and other automated technologies to support recruiting workflows.
Depending on the feature used, these technologies may process:
- Candidate information;
- Resumes;
- Job descriptions;
- Recruiter notes;
- Hiring criteria;
- Professional contact information;
- Customer instructions;
- Communications;
- Profile-access information;
- Engagement information;
- User prompts; and
- Other information submitted through the Services.
AI-assisted features may help Customers:
- Summarize candidate experience;
- Compare Candidates with job requirements;
- Identify possible candidate strengths or concerns;
- Position Candidates for an opportunity;
- Generate interview questions;
- Identify relevant hiring stakeholders;
- Generate or personalize recruiter-reviewed outreach;
- Organize recruiting information;
- Produce workflow and engagement insights;
- Recommend possible next actions; and
- Create reporting and analysis.
ZOCALO may use third-party AI service providers to process information and generate outputs on our behalf.
AI-generated information may be incomplete, incorrect, or inappropriate for a particular circumstance. Customers and Authorized Users should review outputs before relying on them or using them in a recruiting or employment process.
ZOCALO is designed to support human recruiting professionals. It does not itself make final hiring decisions on behalf of Customers.
Customers are responsible for using the Services lawfully and for providing any employment, candidate, privacy, or automated-decision notices required for their use of the Services.
6. How We Disclose Information
Customers and Authorized Users
We disclose Customer Content, recruiting information, communications, candidate-profile activity, and workflow information to the applicable Customer and its Authorized Users.
For example, a Customer that shares a candidate profile may receive information about who accessed the profile, when it was accessed, repeat activity, interaction duration, and actions taken.
Intended Recruiting Recipients
At a Customer’s direction, we may disclose candidate information to prospective employers, hiring managers, client stakeholders, or other intended recruiting recipients.
Service Providers and Subprocessors
We may disclose information to service providers supporting:
- Hosting and cloud infrastructure;
- Databases and storage;
- Authentication;
- Artificial-intelligence processing;
- Email delivery;
- Communications;
- Analytics;
- Error monitoring;
- Cybersecurity;
- Payment processing;
- Customer support;
- Implementation; and
- Other operational functions.
These providers may process information only in connection with the services they perform for ZOCALO, subject to applicable contracts and legal restrictions.
Integrations
We may disclose information to applicant tracking systems, customer relationship management systems, email providers, calendar providers, data providers, and other integrations enabled or directed by a Customer or user.
Legal and Safety Reasons
We may disclose information when reasonably necessary to:
- Comply with a law, regulation, subpoena, court order, or legal process;
- Respond to a lawful government or regulatory request;
- Investigate fraud, abuse, security incidents, or illegal conduct;
- Protect the rights, property, or safety of ZOCALO or others; or
- Enforce our contracts and policies.
Professional Advisers
We may disclose information to attorneys, accountants, auditors, insurers, and other professional advisers where reasonably necessary.
Corporate Transactions
Information may be disclosed or transferred in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction.
7. Sale, Sharing, and Advertising
ZOCALO does not sell:
- Candidate resumes;
- Private candidate profiles;
- Customer Content; or
- Private candidate-profile engagement information.
ZOCALO does not use private candidate-profile information or private-profile activity for cross-context behavioral advertising.
ZOCALO may obtain professional business-contact information and related company or recruiting information from Customers, public sources, commercial data providers, and integrations. We may use or make this information available as part of recruiting intelligence, stakeholder identification, candidate marketing, or Customer-directed outreach.
Some privacy laws define a “sale” more broadly than an exchange for money. Where applicable law treats a ZOCALO professional-contact-data practice as a sale or sharing, we will provide the notices, opt-out mechanisms, and other rights required by that law.
We do not knowingly sell or share the personal information of individuals under 16 years old.
8. Cookies and Similar Technologies
We may use cookies, local storage, pixels, session identifiers, and similar technologies for:
- Authentication;
- Access control;
- Security;
- Session management;
- Preferences;
- Service functionality;
- Analytics;
- Error monitoring; and
- Website and application performance.
Strictly necessary technologies may be required to sign in, verify a work email address, access a private candidate profile, maintain a session, or prevent unauthorized access.
We may use analytics technologies on our public websites to understand usage and improve performance.
Where applicable law requires consent for nonessential cookies or technologies, we will request that consent before using them.
Browser or device settings may allow users to block or delete cookies. Some portions of the Services may not function properly when necessary cookies are disabled.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy.
| Information category | Retention criteria |
|---|---|
| Customer Content and candidate information | Based on Customer instructions, the Customer agreement, the duration of the recruiting workflow or Customer relationship, and applicable legal, security, dispute, and backup requirements |
| Candidate-profile access and engagement information | Based on the duration of the applicable recruiting workflow and Customer relationship, together with security, analytics, legal, dispute-resolution, and backup needs |
| Account, support, and billing information | For the Customer relationship and as required for account administration, support, accounting, tax, legal, and dispute purposes |
| Professional contact and outreach information | While reasonably relevant to recruiting or business purposes, subject to opt-outs, suppression requirements, legal obligations, and Customer instructions |
| Communication records | Based on the communication purpose, Customer relationship, recruiting workflow, security needs, and legal requirements |
| Technical and security logs | For the period reasonably necessary for security, fraud prevention, diagnostics, system integrity, and legal compliance |
| Backup copies | Until overwritten or deleted through our ordinary backup and disaster-recovery cycle |
| Aggregated or de-identified information | May be retained for a longer period when it can no longer reasonably be associated with an identifiable individual or Customer |
We may retain limited information after a deletion request where necessary to:
- Complete deletion across backups;
- Comply with law;
- Maintain security records;
- Prevent fraud;
- Resolve disputes;
- Enforce agreements; or
- Honor an unsubscribe or do-not-contact request.
10. Aggregated and De-Identified Information
We may create aggregated, statistical, or de-identified information from information processed through the Services.
We may use that information to:
- Understand product usage;
- Analyze recruiting and engagement trends;
- Develop benchmarks;
- Improve matching and workflow features;
- Improve AI-assisted functionality;
- Improve security and reliability;
- Develop new products and features;
- Conduct research; and
- Produce industry or business insights.
We will not attempt to re-identify information that we maintain as de-identified except where permitted by law, such as to test whether the de-identification process remains effective.
11. Data Security
We use administrative, technical, and organizational safeguards designed to protect personal information.
Depending on the applicable system and information, these measures may include:
- Authentication and access controls;
- Restricted personnel access;
- Encryption in transit and at rest where appropriate;
- Logging and monitoring;
- Secure development practices;
- Vendor review;
- Backup procedures;
- Incident-response procedures; and
- Confidentiality obligations.
No internet transmission, storage environment, or security program can be guaranteed to be completely secure.
Users are responsible for protecting their devices, credentials, and private candidate-profile links and for promptly reporting suspected unauthorized activity.
12. Privacy Rights and Choices
Depending on location and applicable law, an individual may have the right to:
- Request access to personal information;
- Request information about how personal information is collected, used, or disclosed;
- Correct inaccurate information;
- Request deletion;
- Obtain a portable copy of certain information;
- Restrict or object to certain processing;
- Withdraw consent where processing depends on consent;
- Opt out of certain sales, sharing, targeted advertising, or profiling;
- Limit certain uses of sensitive personal information;
- Appeal the denial of a privacy request; and
- Exercise privacy rights without unlawful discrimination.
To submit a privacy request, contact:
Email: [email protected]
Subject: Privacy Request
We may need to verify the requester’s identity and authority before completing a request.
Where permitted, an authorized agent may submit a request on another person’s behalf. We may require proof of authorization and identity verification.
When ZOCALO processes the information only on behalf of a Customer, we may direct the requester to the Customer controlling the information.
Marketing and Recruiting Communications
Recipients may unsubscribe using the link provided in an email or by replying with a request not to be contacted.
We may retain limited information on a suppression list so that we can honor the request.
Service, security, transactional, and relationship communications may continue where reasonably necessary.
13. California and Other U.S. State Disclosures
During the preceding 12 months, ZOCALO may have collected the following categories of personal information:
- Identifiers, such as names, work email addresses, telephone numbers, IP addresses, account identifiers, and device identifiers;
- Customer-record information, such as contact, account, subscription, and billing information;
- Commercial information, such as subscription and transaction history;
- Internet or electronic-network activity, such as profile views, repeat visits, interaction duration, clicks, workflow activity, sessions, and access logs;
- Approximate geolocation, such as location inferred from an IP address;
- Professional or employment information, such as resumes, work history, skills, employers, job titles, job requirements, and recruiting information;
- Communications, such as email, chat, feedback, comments, and support content;
- Inferences, such as candidate-role alignment, engagement levels, stakeholder participation, account activity, workflow insights, and recommended actions; and
- Sensitive personal information, such as login credentials, authentication information, communication contents, and sensitive information included in Customer-provided candidate records.
We obtain these categories from:
- Individuals;
- Customers;
- Candidates;
- Devices and browsers;
- Public sources;
- Commercial data providers;
- Recruiting and sourcing providers;
- Integrations;
- Service providers; and
- Interactions with the Services.
We use these categories for the purposes described in Sections 4 and 5.
We may disclose these categories for business purposes to the recipients described in Section 6.
Our sale and sharing practices are described in Section 7.
Our retention criteria are described in Section 9.
Where applicable, California residents may have rights to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal treatment when exercising their rights.
ZOCALO does not use sensitive personal information to infer characteristics unrelated to the recruiting, security, or service functions for which the information was provided.
Where required and applicable to our practices, ZOCALO will process legally recognized opt-out preference signals.
14. Individuals Outside the United States
Where European, United Kingdom, Swiss, or similar privacy law applies, we may process personal information under one or more of the following legal bases:
- Performance of a contract;
- Steps taken at an individual’s request before entering into a contract;
- Compliance with a legal obligation;
- ZOCALO’s or a Customer’s legitimate interests, where those interests are not overridden by the individual’s rights;
- Consent, where required; and
- Establishment, exercise, or defense of legal claims.
Relevant legitimate interests may include:
- Providing and securing the Services;
- Supporting business-to-business recruiting;
- Identifying relevant professional contacts;
- Presenting Candidates to intended recipients;
- Improving product functionality;
- Preventing fraud;
- Providing support; and
- Maintaining business records.
Personal information may be transferred to and processed in the United States and other countries where ZOCALO or its service providers operate.
Where required, we use legally recognized safeguards for international transfers.
15. Children
The Services are intended for professional and business use and are not directed to children under 18.
We do not knowingly permit children under 18 to create accounts or use private candidate-profile functionality.
Customers should not submit information about minors unless they have a lawful and appropriate reason and have provided any required notices or obtained any required authorization.
16. Third-Party Services and Links
The Services may contain links to or integrations with third-party websites, applicant tracking systems, customer relationship management systems, email providers, professional profiles, data providers, and other services.
Those third parties have their own privacy practices. This Privacy Policy does not govern information processed independently by those third parties.
Google API Data
ZOCALO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
17. Changes to This Policy
We may update this Privacy Policy to reflect changes in:
- The Services;
- Our business practices;
- Technology;
- Legal requirements; or
- Regulatory guidance.
We will post an updated Policy with a revised “Last Updated” date.
Where required, we will provide additional notice or obtain consent before applying a materially different use of personal information.
18. Contact ZOCALO
Questions, concerns, or privacy requests may be sent to:
Zocalo LLC
2447 Pacific Coast Hwy, Suite 200
Hermosa Beach, CA 90254
United States
Email: [email protected]
Subject: Privacy Request