How we look after your data

rézolu limited (“rézoluHR”, “we”, “us”) runs the rézoluHR HR, payroll and recruitment platform, the job board at jobs.rezoluhr.com, and the website rezoluhr.com. This policy explains how we collect and use personal data, and the rights you have under Malawi's Data Protection Act, 2024. The Malawi Communications Regulatory Authority (MACRA) is the Data Protection Authority that oversees the Act.

Our role depends on whose data it is and why we hold it:

As a processor, we use the data only on the employer's instructions. If you work for, or applied to, one of our customers, please contact that employer first about your data.

We collect only the data we need for each purpose.

When you pay for a plan, you enter your card or mobile money details on our payment provider's checkout page. We never see or store them.

We don't ask for criminal records, religion, ethnicity or political views, and customers shouldn't collect them through rézoluHR.

The Act only allows processing on certain legal grounds. These are the ones we rely on. Where we're a processor, the employer chooses the ground.

We won't use personal data for a new purpose that doesn't fit the one we collected it for. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent doesn't affect what we did before.

We don't sell personal data.

Sensitive data

The Act gives extra protection to sensitive data, such as health information. In rézoluHR this mostly means sick leave records. Sensitive data is processed only with the person's consent for a specific purpose, or where the employer needs it to meet a duty under the law, such as employment law. Access to it depends on each person's role.

AI CV scoring

When a hiring company switches on AI scoring for a job, rézoluHR compares each CV with the job description and shows a match score. This helps the hiring team decide which applications to read first.

• A person at the hiring company makes every decision. The AI never rejects or shortlists anyone.
• Before a CV is scored, we remove the applicant's name, email address, phone number and links.
• Each score belongs to one application for one job.

We share personal data only when we need to, and only with:

• The employer or hiring company whose account the data belongs to.
• Service providers that help us run rézoluHR, such as hosting, email delivery, website analytics, AI CV scoring and payment processing. They may use the data only to provide their service to us.
• Professional advisers such as our lawyers, auditors and accountants, who must keep it confidential.
• Authorities such as MACRA, the Malawi Revenue Authority, the courts or the police, when the law requires it.

Some of our service providers are based outside Malawi. For example, AI CV scoring uses a provider outside Malawi, which receives the CV text with the applicant's name and contact details removed. Google Analytics is also run outside Malawi.

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires, such as for tax records.

We protect personal data with measures including:

• Role-based access, so people see only the records their role allows.
• An audit log of changes made in each company's account.
• Removing names and contact details from CVs before AI scoring.

If a breach happens

• Where we're the processor, we tell the affected customer within 72 hours of finding out, with the details they need.
• Where we're the controller, we tell MACRA within 72 hours and keep a record of the breach.
• If the breach is likely to put people's rights at high risk, we tell them what happened, what it could mean for them and what we're doing about it.

No system is completely secure. Keep your password private, and email [email protected] straight away if you think someone has got into your account.

You can ask to see, correct or delete the personal data we hold about you, object to how we use it, or withdraw your consent. Email [email protected]. If your data is in an employer's rézoluHR account, contact that employer first and we'll help them respond.

We use cookies to keep you signed in and your account secure.

On our public pages, such as the homepage, pricing, blog and job boards, we use Google Analytics to count visits and see which pages people find useful. Its cookies record things like the pages you view, your rough location, and the device and browser you use.

Google Analytics doesn't run on the pages inside your account, so the HR records you work with are never sent to it. We don't use advertising cookies.

You can block these cookies in your browser settings, or install Google's Analytics opt-out browser add-on.

rézoluHR isn't meant for anyone under 18. If we find we've collected a child's data by mistake, we'll delete it promptly.

We update this policy as rézoluHR or the law changes. When we do, we'll change the date at the top of this page. Significant changes will be highlighted via site notice or email.

For any question about this policy or your data, email [email protected] or call +265 883 355 538.

If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain in writing to the Data Protection Authority, the Malawi Communications Regulatory Authority (MACRA).