quikfy

Privacy policy

Last updated: July 2026

1. Data controller

The controller of the personal data collected through the Quikfy platform is:

  • Company name: BAC MST SL
  • Tax ID (CIF): B72887136
  • Registered address: C/ Argantonio 10, Of. 6, 11004 Cádiz (Spain)
  • Data protection contact: [email protected]

2. Purposes of processing and dual role

We process personal data for different purposes depending on the group:

  • Companies: creation and management of the account, provision of the recruitment service, billing and payment, and support.
  • Candidates: participation in the relevant company’s selection processes, communications about the process, and help or support.

Dual role (important): with regard to candidate data processed within a selection process, the client company is the data controller and Quikfy acts as a data processor, following its instructions. However, with regard to the candidate’s Quikfy account (registration, credentials and use of the platform), Quikfy is the data controller.

3. Decisions supported by artificial intelligence (Art. 22 GDPR)

The assessment of applications is supported by artificial intelligence, but with meaningful human involvement: the relevant decisions of the process are reviewed by a person before being made. No decisions producing legal or similarly significant effects are made based solely on automated processing without such review.

You have the right to obtain human intervention, to express your point of view and to contest the decision. To exercise it, you may reply to the email of the selection process or write to [email protected].

4. Legal bases

We process your data on the following legal bases:

  • Performance of a contract or pre-contractual measures: account management, provision of the service and participation in selection processes.
  • Legitimate interest: platform security, fraud prevention, support and service improvement.
  • Consent: where applicable, for example for push notifications or other optional communications. You may withdraw it at any time.
  • Compliance with legal obligations: billing and accounting or tax obligations.

5. Recipients, processors and international transfers

To provide the service we rely on providers acting as data processors, under contract and with appropriate safeguards:

  • Hetzner: infrastructure hosting (European Union).
  • Cloudflare: network, content delivery and security.
  • Stripe: payment processing.
  • Resend: transactional email delivery.
  • Zoho: email service.
  • Anthropic: AI processing for the assessment of applications and for the assistant.

Some providers may process data outside the European Economic Area. In such cases, international transfers are carried out with the appropriate safeguards provided for by law (for example, standard contractual clauses or the transfer frameworks in force).

6. Retention periods

We retain data for the following indicative periods:

  • Account data: while the account remains active and, after closure, for the time needed to handle liabilities.
  • Selection process data: for the duration of the process and the period determined by the responsible company, in accordance with its criteria and applicable law.
  • Audit logs: for the time needed to evidence the proper operation and traceability of the service.
  • Early-access and contact requests: for the time needed to handle them and, where applicable, until the service goes live.

Once the periods have elapsed, data is securely deleted or anonymised.

7. Your rights

You may exercise the rights of access, rectification, erasure, objection, portability and restriction of processing, as well as the right to obtain human review of AI-supported decisions.

To exercise them, write to [email protected] stating the right you wish to exercise. If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

Where your data is processed within a selection process, the client company is the controller; we will help you route your request to it where appropriate.

8. Additional commitments

We do not sell your personal data nor share it for third-party advertising purposes. The platform does not display third-party advertising.

Conversations with the assistant are logged to improve help and service quality.