1. Introduction

ReferPal SIA, operating as ReferPal is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, mobile applications, websites, and related services (collectively, the "Services").

This Privacy Policy should be read in conjunction with our Terms of Service. By using the Services, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Providing and Improving Services

• Creating and managing your account
• Facilitating connections between job seekers and referrers
• Matching users with relevant opportunities
• Processing transactions and managing subscriptions
• Providing customer support
• Analyzing and improving platform functionality
• Developing new features and services

3.2 Talent Matching and Recruitment Products

• Creating searchable candidate databases for employers and recruiters
• Developing talent matching algorithms and recommendation systems
• Enabling employer discovery of candidate profiles based on qualifications
• Facilitating direct outreach from employers to candidates
• Building analytics products that provide insights to employers and recruiters
• Creating aggregate and anonymized datasets for recruitment market research

3.3 Communications

• Sending service-related announcements and updates
• Responding to your inquiries and requests
• Sending marketing communications (with your consent)
• Notifying you of new opportunities, referral requests, or messages
• Conducting surveys and gathering feedback

3.4 Security and Compliance

• Detecting, preventing, and addressing fraud and security threats
• Monitoring and analyzing trends, usage, and activities
• Enforcing our Terms of Service and policies
• Complying with legal obligations and protecting legal rights

3.5 Personalization

• Customizing your experience on the Services
• Providing personalized recommendations and content
• Tailoring advertisements and promotions

4. How We Share Your Information

4.1 With Other Users

• Your profile information is visible to other users based on your privacy settings
• When you request a referral, your profile and resume are shared with the referrer
• Communications with other users through the platform

4.2 With Employers and Recruiters

• Your profile may be made discoverable in search results for employers using ReferPal or related products
• Employers may view your resume and professional information when you appear in search results or are recommended as a match
• Employers may contact you directly through the platform or via contact information you provide
• You may adjust visibility settings to control employer access

4.3 With Service Providers

We share information with third-party vendors who perform services on our behalf, including:

• Cloud hosting and storage providers (Google Cloud Platform)
• Payment processors (Stripe)
• Customer support platforms
• Analytics and monitoring services (Sentry)
• Email and communication services
• Authentication providers (Firebase)

4.4 For Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, your information may be transferred to successor entities.

4.5 For Legal Purposes

We may disclose information when required by law, subpoena, court order, or government request, or when we believe disclosure is necessary to:

• Comply with legal obligations
• Protect rights, property, or safety of ReferPal, users, or the public
• Detect, prevent, or address fraud or security issues
• Enforce our Terms of Service

4.6 With Your Consent

We may share information with third parties when you provide explicit consent or direct us to do so.

4.7 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you for any business purpose, including research, analytics, and marketing.

5. Your Rights and Choices

5.1 Access and Portability

You have the right to:

• Access the personal data we hold about you
• Request a copy of your data in a structured, commonly used, machine-readable format
• Transmit your data to another service provider (data portability)

5.2 Correction and Deletion

You may:

• Update or correct your account information through account settings
• Request deletion of your account and associated personal data
• Note: We may retain certain information as required by law or for legitimate business purposes

5.3 Opt-Out Rights

You may opt out of:

• Marketing communications (via unsubscribe links or account settings)
• Employer discovery features (via privacy settings)
• Non-essential cookies (via browser settings)
• Push notifications (via device or app settings)

5.4 Objection and Restriction

You may object to or request restriction of processing of your personal data in certain circumstances, including:

• Processing based on legitimate interests
• Direct marketing activities
• Automated decision-making and profiling

5.5 Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

5.6 Lodge a Complaint

You have the right to lodge a complaint with a supervisory data protection authority, particularly in your country of residence, place of work, or where an alleged infringement occurred.

6. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Services and fulfill the purposes described in this Privacy Policy
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain security and prevent fraud

After account deletion, we may retain:

• Information as required by applicable law
• De-identified or aggregated data
• Information necessary for legal defense or business operations
• Backup copies for a reasonable period

7. International Data Transfers

7.1 Data Processing Locations

ReferPal is currently operated by an individual/sole proprietor based in Latvia, but our Services utilize infrastructure and service providers located globally, including in the United States. Your personal data may be transferred to, processed, and stored in countries outside the European Economic Area (EEA), including the United States (US Central region via Google Cloud Platform).

7.2 Safeguards for Transfers

When transferring personal data outside the EEA, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with service providers ensuring adequate protection
• Adequacy decisions by the European Commission where applicable
• Technical and organizational security measures to protect data during transfer and processing

7.3 Consent to Transfers

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOUR PERSONAL DATA WILL BE TRANSFERRED TO AND PROCESSED IN COUNTRIES THAT MAY NOT PROVIDE THE SAME LEVEL OF DATA PROTECTION AS YOUR HOME COUNTRY, AND YOU CONSENT TO SUCH TRANSFERS.

7.4 Third Country Risks

You understand that countries outside the EEA may have different data protection laws and that government authorities in those countries may have access to your data under certain circumstances.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication mechanisms
• Access controls and authorization systems
• Regular security assessments and audits
• Employee training on data protection
• Incident response procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

9. Children's Privacy

The Services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected information from a child under 16, please contact us immediately at info@referpal.app, and we will take steps to delete such information.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

• Essential Cookies: Required for the Services to function properly
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Services
• Advertising Cookies: Deliver relevant advertisements and measure campaign effectiveness

10.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

10.3 Third-Party Tracking

Third-party services (e.g., Google Analytics, Sentry) may use cookies and similar technologies. We do not control these third-party technologies.

11. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry standard for how to interpret them.

12. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

To exercise these rights, contact us at info@referpal.app.

Note: ReferPal does not "sell" personal information as traditionally defined, but data sharing practices described in this policy may constitute "sale" under broad CCPA definitions.

13. European Union Data Protection Rights

If you are located in the European Union, European Economic Area, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR), including:

• Right of Access: Obtain confirmation of data processing and access to your data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit processing of your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority

13.1 Legal Bases for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for specific purposes
• Contractual Necessity: Processing is necessary to perform our contract with you (Terms of Service)
• Legal Obligation: We must process data to comply with legal requirements
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these interests do not override your fundamental rights

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on the Services
• Updating the "Last Updated" date
• Sending email notifications for significant changes
• Displaying prominent notices on the Services

Your continued use of the Services after changes become effective constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: