Version 2026-10-11
Privacy Notice
1. Scope and Identification
1.1 Scope
This Privacy Notice explains how personal data is processed in connection with the website hexacrewtools.com, enquiries, Customer-issued accounts, Candidate recruitment workflows, the Provider’s earlier online testing platform and AI interview practice.
It provides the information required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), taking account of the distinct roles of the relevant controllers and processors.
1.2 Provider Identity and Data Protection Contact
The Provider is HexaCrewTools, a trading name of a Polish sole trader. The Provider’s full legal identity and business address are stated in clause 1.1 of the Master Subscription Terms and Candidate Terms of Use (the “Terms”).
Data protection requests concerning processing controlled by the Provider may be directed to dataprotection@hexacrewtools.com. The Provider has not appointed a data protection officer, as an appointment is not required.
2. Controller and Processor Roles
2.1 Provider as Controller
The Provider is the controller for website visitor data, contact-form enquiries, Authorised User account management and security data, account and testing records held on its earlier online testing platform, and AI interview practice. For these activities, the Provider determines the purposes and means of processing described below.
2.2 Customer as Controller of Recruitment Data
An airline or recruitment agency using the Services (a “Customer”) is the controller of Candidate recruitment data. The Provider processes that data on the Customer’s behalf as processor under a separate data processing agreement (“DPA”) complying with Article 28 GDPR.
The Customer determines the lawful basis, recruitment criteria, purposes and final decisions, and must provide its own Candidate privacy information, including information about AI assistance.
2.3 AI Interview Practice
The Provider is the controller for AI interview practice. Microphone audio is processed to deliver the practice session the user requests (Article 6(1)(b) GDPR). Session limits, based on a hashed IP address and a device cookie, rely on the Provider’s legitimate interest in preventing misuse (Article 6(1)(f) GDPR). Camera data remains on the user’s device and is not recorded or scored by the Provider.
2.4 Meaning of Defined Terms
“Candidate”, “Authorised User”, “Customer”, “Customer Data”, “Services”, “Agreement” and “Order Form” have the meanings given in the Terms.
3. Personal Data, Sources, Purposes and Legal Bases
3.1 Overview by Data Subject Group
| Group | Data processed | Purposes | Legal basis |
|---|---|---|---|
| Website visitors | IP addresses and HTTP request information, received through Cloudflare; one security and CSRF session cookie. | Delivery of the website, secure sessions, defence against abusive requests and protection of the Provider’s infrastructure. | Article 6(1)(f) GDPR: the Provider’s legitimate interests in secure and reliable website operation. |
| Contact-form enquirers | Name, email address and message. IP addresses are temporarily counted to prevent repetitive submissions. Messages are forwarded through Microsoft 365 email and are not stored on the website server. | Reading and responding to enquiries and preventing form abuse. | Article 6(1)(f) GDPR: legitimate interests in handling business communications and maintaining service security; Article 6(1)(b) GDPR where an enquiry is a request to take pre-contractual steps. |
| Authorised Users | Account identity and access information provided by the Customer or Authorised User, assigned permissions, and information generated in managing and securing account access. | Provisioning accounts, enforcing role-based permissions, administering Customer access and protecting the Services. | Article 6(1)(f) GDPR: the legitimate interests of the Provider and Customer in managing and securing business access. |
| Candidates in Customer recruitment processes | Candidate submissions, Customer-supplied details, recruitment entries from Authorised Users and results received from the Customer’s testing provider (detailed in clause 3.2). | Organising information days and assessment days; enabling check-in, document review, assessments and recruiter review. | Determined by the Customer, including any applicable Article 9 GDPR condition. The Provider processes Candidate data on documented Customer instructions under the DPA. |
| Earlier online testing platform account holders | Registration details, authentication information, test answers and results, and related security and integrity records (detailed in clause 3.5). | Supplying requested account and testing functionality, protecting accounts and maintaining test integrity. | Article 6(1)(b) GDPR where necessary to perform the account holder’s service agreement; Article 6(1)(f) GDPR for preventing misuse and maintaining reliable services. Where a company assigned an assessment through the platform, that company was the controller of that assessment and the Provider processed it on the company’s behalf. |
| AI interview practice users | Microphone audio transmitted through a Daily room to Simli for a live AI interaction; session activity records, hashed IP addresses and the “hxi_device” cookie. Camera information remains on the user’s device. | Enabling requested AI interview practice and limiting session misuse. | Article 6(1)(b) GDPR for the practice session; Article 6(1)(f) GDPR for session limits. |
3.2 Candidate Recruitment Records
Depending on the Customer’s recruitment workflow, the Provider processes the following categories on the Customer’s behalf:
- Information-day registration: name, email address, telephone number, registration answers and IP address, transferred into the Customer’s workbook.
- Assessment-day check-in: name, email address and telephone number.
- Identity and application documents: passport, full-length photograph, CV and explanations of gaps in work history.
- Assessments: answers and results from the Services’ tests or a testing provider used by the Customer; for online tests, the IP address and events recording when the test window is left.
- Recruiter records: scores, notes, interview outcomes, assessment forms and suitability questions specified by the airline or recruitment agency.
- Automated processing outputs: extracted work and education history, questions concerning passport expiry or employment gaps exceeding 12 months, and suggested points for written answers.
Candidate data may be received directly from a Candidate following a Customer-issued link, from the Customer or its recruiters, or from the Customer’s testing provider. Where data is received indirectly, the Customer is responsible for providing the disclosures required by Article 14 GDPR. The nature of particular suitability questions may call for additional safeguards or an Article 9 condition; the Customer is responsible for establishing any such condition before processing.
3.3 Passport, Photograph and CV Processing
Passports and full-length photographs are read within the Provider’s own server environment for optical character recognition, machine-readable zone checks and full-length photograph checks. They are not sent to third-party passport, image-analysis or AI services. This does not exclude infrastructure hosting and storage by the Provider’s contracted sub-processors.
CVs are converted to text on the Provider’s server. Identifying information, including names, contact details, passport numbers and dates of birth, is replaced with placeholders before redacted content is submitted to the paid Google Gemini API to list work and education history. Where a page cannot be read as text, the page may be submitted as an image after identifying areas have been redacted. Under the applicable paid Gemini API terms, submitted data is not used to improve Google products. Technical redaction reduces exposure but cannot be treated as a guarantee that every identifier is removed.
3.4 Recruitment Decision-Making
Recruiters acting for the Customer make all recruitment and selection decisions. Automatic passport-expiry and employment-gap checks are displayed as questions, not determinations. AI-suggested points for written test responses are presented for recruiter review. The Services do not perform solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR, and do not perform emotion recognition.
3.5 Earlier Online Testing Platform
The Provider holds the following data in connection with earlier testing-platform accounts: name; email address; password hash where password authentication was used; test answers and results; IP address at the start of a test; and an integrity summary. Written and spoken answers were marked with AI assistance; spoken-answer audio was not stored.
Where an account holder used Google sign-in, the requested OAuth scopes were “openid”, “email” and “profile”. The Provider read the email address, name and “email_verified” status, and stored the email address and name; the Google account ID and profile picture were not stored. Google sign-in information was used only for sign-in, was not shared by the Provider, and was not used for advertising or AI training.
3.6 AI Interview Practice
Signed-in users of AI interview practice are told that they are interacting with an AI system. Microphone audio is transmitted to Simli via a Daily room to provide the live interaction. The camera remains on the user’s device; the Provider does not record or score camera or microphone content in this feature. A hashed IP address and the “hxi_device” cookie are used to limit practice sessions. Practice records and activity logs are subject to the retention period in clause 6.
4. Recipients, Service Providers and Sub-processors
4.1 Recipients by Function
Access to data is restricted according to the function and the role of the relevant recipient. The following providers are used for the described purposes; a provider named below does not necessarily receive every data category.
| Provider | Function | Location and transfers |
|---|---|---|
| Oracle Cloud | Hosting of the Services, databases and files, and encrypted backups, including Customer-controlled recruitment records. | Frankfurt, Germany. |
| Cloudflare | Website delivery, request processing, security and bot protection (Turnstile); encrypted backup copy. | Encrypted backup copy held in the EU; other processing subject to applicable transfer safeguards. |
| Microsoft 365 | Delivery and storage of enquiry emails; operation of Customer recruiter workbooks, including information-day submissions. | Subject to the provider’s terms and relevant transfer safeguards. |
| Google (Gemini API) | AI-assisted extraction of work and education history from redacted CV content. | Paid API terms; relevant transfer safeguards where needed. |
| Google (Sign-in) | Authentication for earlier testing-platform accounts using the specified scopes and limited account fields. | Relevant transfer safeguards where needed. |
| ClassMarker | Online assessments and results where a Customer elects to use that testing provider. | Provider terms and transfer safeguards where required. |
| Simli | Live AI interview practice interaction using microphone audio. | Provider terms and transfer safeguards where required. |
| Daily | Communication room through which microphone audio is transmitted for AI interview practice. | Provider terms and transfer safeguards where required. |
4.2 Other Disclosures
Customer-controlled Candidate records are made available to the Customer’s authorised recruiters in accordance with their roles. Personal data may also be disclosed to competent authorities where disclosure is required by applicable law. The Provider does not use Google sign-in information for advertising or AI model training.
5. International Transfers
The Provider’s main hosting and database environment is located in Frankfurt, Germany, and an encrypted backup copy is held with Cloudflare in the EU. Some other service providers or their processing operations may involve access to or transfers of personal data outside the European Economic Area (“EEA”).
Where international transfers occur, the safeguards relied upon under the relevant provider data processing terms include the European Commission’s standard contractual clauses or, where the recipient is certified, the EU–US Data Privacy Framework. Information about the relevant safeguard, and how to obtain a copy where appropriate, may be requested at dataprotection@hexacrewtools.com.
6. Data Retention
| Category | Retention |
|---|---|
| Candidate assessment and selection records | Deleted two years after the assessment day by an automatic weekly deletion process, or sooner at the Customer’s request, subject to backup handling. |
| Earlier testing-platform accounts and tests | Accounts with no test activity for two years are anonymised and associated test records deleted. |
| Authorised User accounts | Retained while in use; deleted at the Customer’s request, subject to backup handling and any mandatory legal obligations. |
| Contact enquiry emails | Retained for as long as necessary to address the enquiry, and no longer than two years. |
| Contact-form and sign-in rate-limit counters (one-way hashes) | Used for one hour; deleted by the weekly clean-up once expired. |
| AI interview practice records and activity logs | Two years. Live microphone and camera content is not recorded by the Provider. |
| Server access and error logs | 14 days. |
| Encrypted backups | 30 days. |
Retention obligations under the DPA and any overriding mandatory legal requirement take precedence where applicable.
7. Cookies and Similar Technologies
| Name | Purpose | Duration |
|---|---|---|
| PHPSESSID | Session security and protection against cross-site request forgery (CSRF); keeps signed-in users signed in. | Browser session; sign-in ends after 8 hours without activity. |
| hxi_device | Identifies a device to limit AI interview practice sessions, together with a hashed IP address. | One year. |
Cloudflare Turnstile runs on sign-in forms to distinguish human users from automated traffic, under Cloudflare’s own terms. The Provider does not use analytics or advertising cookies. A browser setting remembers whether a user has turned animations off.
8. Data Provision and Consequences
Providing a name, email address and message through the contact form is voluntary; without sufficient contact details, the Provider may be unable to respond. An Authorised User requires the account information and permissions necessary to use the relevant Customer functions. A Candidate’s requested fields, documents and answers depend on the Customer’s recruitment process; the Customer must explain any mandatory fields and the consequences of not providing them. Earlier testing-platform accounts require authentication information to sign in. Microphone access is required to take part in audio-based AI interview practice.
9. Rights and Requests
9.1 Rights Where the Provider Is Controller
Subject to the conditions and exemptions in the GDPR, data subjects may request:
- access to their personal data and a copy of the data;
- rectification of inaccurate personal data;
- erasure of personal data where the relevant conditions apply;
- restriction of processing;
- data portability where applicable;
- objection to processing based on Article 6(1)(f) GDPR;
- withdrawal of consent at any time where consent is the lawful basis, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to dataprotection@hexacrewtools.com. Identity verification may be required where reasonably necessary.
9.2 Rights Where the Customer Is Controller
A Candidate seeking access to, correction or deletion of an application, assessment or selection record should contact the airline or recruitment agency conducting the recruitment. The Provider assists the Customer in responding to rights requests in accordance with the DPA. If the Provider receives such a request directly, it handles or refers it consistently with its processor obligations.
9.3 Automated Decisions
The Services do not make solely automated decisions with legal or similarly significant effects. Employment decisions are made by Customer recruiters, who review AI-assisted outputs and automated questions.
10. Complaints and Supervisory Authority
A data subject may lodge a complaint with the competent supervisory authority, including the Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, or with the supervisory authority in the country where the data subject lives or works. The Provider may be contacted first at dataprotection@hexacrewtools.com, but prior contact is not a condition of lodging a complaint.
11. Changes to This Notice
The Provider may update this Privacy Notice when its Services, processing activities or legal obligations change. An updated version carries a revised version date and is made available on the website. Where required by law, affected data subjects receive additional notice before a material new processing activity begins. This Notice does not replace a Customer’s obligation to provide its own recruitment privacy information.