Privacy Policy

1. Who We Are

Jaluru Trust (ABN 18 596 203 312) is the operator of jaluru.com and the jaluru Platform. Our registered address is 6 Scarborough Ct., Terrigal, NSW 2260, Australia.

For data protection enquiries, please contact us at privacy@jaluru.com.

2. Scope of This Policy

This Policy applies to personal data relating to three groups of people:

• Platform users — HR managers, administrators, and other Authorised Users who access and use the jaluru web application on behalf of the Customer.
• Talent — employees, workers, and contractors of the Customer whose personal data is processed through the Platform (e.g. via outbound survey calls or inbound absence reporting calls).
• Applicants — people who apply for a job with the Customer and whose application the Customer uploads to the Recruitment Screener, which invites them to an AI screening call and prepares a report for the Customer.

Our role for Talent and Applicant data. In respect of Talent and Applicant personal data, jaluru acts as a data processor under UK GDPR: we process that data only on the documented instructions of the Customer (the data controller). Talent members and Applicants should direct their primary data protection enquiries to the Customer (their employer, the business they applied to, or the operator of the relevant Store), who is responsible for that processing.

Our role for Platform user data. In respect of Platform users, jaluru acts as a data controller.

3. Personal Data We Collect

3a. Platform users (HR managers and administrators)

• Name and work email address
• Hashed password (we do not store plain-text passwords)
• Role and permissions within the account
• Login timestamps and session activity logs
• Device type, browser, and IP address
• Billing contact details (where the user is the account holder)

3b. Talent (processed on behalf of the Customer)

• Name and mobile phone number
• Employment details (Store, role, tenure information) as provided by the Customer
• Voice recordings of AI-conducted calls
• Call transcripts and AI-generated summaries of conversations
• Survey responses and performance data
• Absence records (including type, dates, duration, reason, and self-reported details)
• Generated PDF reports (including SSP reports)
• Preferred language for calls

3c. Applicants (processed on behalf of the Customer)

• The application file the Customer uploads (for example a McHire application export or a CV)
• Details taken from the application: name, mobile phone number, email address, the restaurant applied to, and a summary of experience, education and availability
• The mobile number the Applicant texts from to start their screening call
• Voice recordings of AI-conducted screening calls
• Call transcripts, answers to screening questions, and AI-generated summaries
• AI-assisted assessment scores, the evidence behind them, and the screening report (including a brief for any in-person interview)

We do not take the following from an application, even where the file contains them: date of birth (only whether the Applicant is under 18), health or disability declarations, criminal-record declarations, parent or guardian details, a full home address, a photograph, marital or family status, National Insurance number, nationality or immigration status, languages spoken, or referees. These remain only in the original application file, which is deleted as described in clause 8.

3d. All users

• IP address and approximate geolocation
• Browser type and version
• Pages accessed and features used within the Platform
• Error and diagnostic logs

We do not collect special category personal data (such as health data in a medical context, biometric data, or genetic data) except to the extent that absence information (including sickness symptoms and reasons) is provided voluntarily by Talent through the absence tracking Service. The original application file uploaded for an Applicant may contain health or criminal-record declarations; jaluru stores that file but does not extract, analyse or use those declarations. Such data is processed only on the Customer's instructions and for the purposes described in clause 4.

4. How We Use Personal Data

We use the personal data described above for the following purposes:

5. Legal Basis for Processing (UK GDPR)

The Platform is used to manage employees based in the United Kingdom. Our processing activities are subject to UK GDPR and the UK Data Protection Act 2018.

Platform users

We process Platform user data on the basis of contractual necessity (to provide the Services under the Terms of Service) and, where applicable, our legitimate interests in operating and improving the Platform securely.

Talent data

As processor, jaluru processes Talent data on the Customer's instructions. The Customer (as controller) is responsible for identifying and maintaining the appropriate legal basis for that processing. Typical bases may include:

• Legitimate interests — conducting HR surveys and performance conversations as part of employment management;
• Legal obligation — processing absence data for Statutory Sick Pay and attendance compliance;
• Contract — where processing relates to the fulfilment of the employment contract.

Applicant data

As processor, jaluru processes Applicant data on the Customer's instructions, and the Customer is responsible for the legal basis — typically legitimate interests in recruiting, or steps taken at the Applicant's request before entering into a contract. The Customer is responsible for telling Applicants, in its own privacy information for job applicants, that it uses an AI screening service.

No solely automated decisions. The Recruitment Screener does not make decisions about Applicants. It produces an assessment and a recommendation, calculated by a fixed and published rule from scores that each rest on what the Applicant said; it never rejects an Applicant. A person at the Customer reviews the evidence and makes every decision about who progresses. The assessment never takes account of protected characteristics, or of how an Applicant speaks (accent, fluency or grammar).

Where absence data or other special category data is involved, the Customer is responsible for ensuring an additional condition for processing applies (e.g. Schedule 1 of the Data Protection Act 2018 for employment and occupational medicine purposes).

6. Third Parties and Sub-Processors

To deliver the Services, jaluru engages specialist third-party technology providers to perform specific processing functions. All such providers are bound by appropriate data processing agreements and are required to process personal data only on jaluru's instructions, with appropriate security measures in place.

Jaluru does not publicly disclose its full list of sub-processors. Customers may request the current list of sub-processors by contacting privacy@jaluru.com. Prior to engaging any new sub-processor that will process Customer Data, jaluru will provide advance notice to affected Customers in accordance with the Data Processing Addendum.

We will never sell personal data to third parties. We will never use Talent Data to serve advertising.

7. International Data Transfers

Customer Data is stored primarily on cloud infrastructure located in the United Kingdom. Certain Services require processing by providers located outside the UK, including in the United States of America.

Where personal data is transferred outside the UK, jaluru ensures that appropriate safeguards are in place as required by UK GDPR, including:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO); or
• Transfer to countries covered by an adequacy decision; or
• Other legally permitted transfer mechanisms.

For further information about the safeguards in place for international transfers, please contact privacy@jaluru.com.

8. Data Retention

During the account lifetime: We retain Customer Data (including Talent Data) for the duration of the Customer's account.

Voice recordings: Voice recordings of AI-conducted calls are retained for 90 days from the date of the call by default. Customers may request a shorter retention window. After the configured period, recordings are automatically and permanently deleted. Call transcripts and AI summaries derived from recordings are not subject to this shorter window and are retained for the duration of the account.

Applicants: The uploaded application file is automatically and permanently deleted 180 days after upload. Voice recordings of screening calls follow the recordings rule above. The rest of an Applicant's data (details taken from the application, transcripts, answers, assessment and report) is kept until the Customer deletes the Applicant, which it can do at any time from the Recruitment page. Deleting an Applicant erases their personal data - their details, recordings, transcripts, answers, assessment and report - keeping only an anonymous record that a screening took place, which the Customer's invoice relies on. Where an Applicant is hired, their screening becomes part of their Talent data.

Following termination: Following termination of the Customer's account, Customer Data remains accessible to the Customer for a 30-day export period. After that period, we will securely delete all Customer Data from our systems within 30 days, unless we are required to retain it for longer by applicable law (for example, financial records required for tax purposes).

Platform user data: Account information for Platform users is retained for the duration of the account. After account closure we may retain limited information (such as billing records) for as long as required by law.

Anonymised data: Aggregated, anonymised data derived from usage of the Platform may be retained indefinitely as it does not constitute personal data.

9. Your Rights Under UK GDPR

UK GDPR grants individuals a number of rights over their personal data. The rights available depend on the basis and purpose of processing.

For Talent members and Applicants

Because jaluru processes Talent and Applicant data as a data processor acting on the Customer's instructions, rights requests from Talent members and Applicants (such as access requests, erasure requests, or objections) should be directed in the first instance to the Customer (your employer, the business you applied to, or the operator of your Store). Applicants can also ask the Customer for a person to review their screening assessment. jaluru will assist the Customer in responding to such requests in accordance with its obligations under the Data Processing Addendum.

For Platform users (HR managers and administrators)

You may exercise the following rights by contacting us at privacy@jaluru.com:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate data corrected (you can also update most profile information directly in the Platform settings).
• Right to erasure — to request deletion of your data, subject to our legal obligations.
• Right to restriction — to request that we restrict processing of your data in certain circumstances.
• Right to data portability — to receive your data in a commonly used machine-readable format.
• Right to object — to object to processing based on legitimate interests.

We will respond to rights requests within one calendar month. We may need to verify your identity before processing a request. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.

10. Security

jaluru implements technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls and multi-factor authentication for Platform users
• Identity and access management provided by a managed cloud authentication service
• HMAC-SHA256 signature verification for all inbound webhook data (transcripts and call status updates)
• Segregated AWS environments for development and production
• Regular review of security controls and access permissions

Notwithstanding these measures, no internet transmission or electronic storage is completely secure. We cannot guarantee absolute security. In the event of a personal data breach affecting Customer or Talent data, we will notify the affected Customer without undue delay in accordance with our Data Processing Addendum obligations.

11. In-Call Disclosure

Every AI voice call conducted through the Platform begins with an automated verbal announcement informing the person called that:

• the call is being conducted by an AI assistant; and
• the call may be recorded and transcribed.

Applicants are also told, in the email inviting them to their screening call and again at the start of the call, that they will speak to an AI assistant, that the call is recorded for the Customer's hiring team, that a person at the Customer makes every hiring decision, and that they can ask to speak to a person at any time.

The Customer is responsible for ensuring that its use of the Service (including outbound calls to Talent) is consistent with applicable employment law obligations and any workplace policies relating to monitoring and recording of communications.

12. Children

The Platform is not intended for use in connection with individuals under the age of 16. Customers must not use the Platform to process the personal data of any person under 16 without the prior explicit consent of that person's parent or guardian. If jaluru becomes aware that data relating to an under-16 has been processed without appropriate consent, it will take reasonable steps to delete that data.

13. Cookies and Tracking

The jaluru web application uses only strictly necessary session cookies required for authentication and secure access to the Platform. We do not use tracking, advertising, or analytics cookies that process personal data without consent.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make material changes we will notify the Customer by email at least 30 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy. A Customer may agree in writing to an updated Policy taking effect for its account before its effective date — for example, to start using a new Service such as the Recruitment Screener.

Previous versions of this Policy remain available at their own addresses (for example the version effective 22 April 2026).

The "Last updated" date at the top of this page reflects the most recent revision.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or wish to raise a data protection concern, please contact us:

Jaluru Trust
6 Scarborough Ct., Terrigal, NSW 2260, Australia
ABN 18 596 203 312
Email: privacy@jaluru.com

For UK GDPR matters you may also contact the UK Information Commissioner's Office: ico.org.uk / 0303 123 1113.