Privacy policy

SoWhat AI Inc. and its subsidiary SoWhat AI SAS (hereinafter “SoWhat AI”) endeavor to ensure that the collection and processing of your data, carried out via its clients’ websites or via www.sowhat.ai, comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

This “Privacy Policy” is intended to inform visitors to this website, SoWhat AI’s client companies, and individuals using the Service of specialized and innovative conversational engines called “Assistants” in the form of smart chats, designed to facilitate recruitment, employee relations, order placement, customer relations, and lead qualification, developed by SoWhat AI, regarding the use of their personal data (hereinafter the “Data”).

‍

General information about the Company

‍

SoWhat AI Inc., developer of the SoWhat AI Service, a Delaware corporation with its registered office at 44 Tehama Street, San Francisco, CA 94105, USA

SoWhat AI SAS, distributor of the SoWhat AI Service in Europe, a simplified joint stock company (SAS) with share capital of €1,000, with its registered office at 54 Rue René Boulanger, 75010 Paris, France, registered with the Paris Trade and Companies Register under number 882 852 213

Email : contact@sowhat.ai

Data Protection Officer (DPO) contact details : dpo@sowhat.ai

‍

Purposes of processing and the Company’s roles

‍

Case 1 : SoWhat AI acts as a Processor

‍

The main purpose of the SoWhat AI Service is, depending on the implementation decided by SoWhat AI’s Clients, to facilitate the recruitment process and/or employee relations and/or order placement and/or customer relations and/or lead qualification for SoWhat AI’s Clients.
In this context :

• The Client using the Service acts as the Data Controller, and SoWhat AI acts as its Data Processor within the meaning of Article 4 of the GDPR
• The processing of Data collected via the Assistant has the sole purpose of transmitting, analyzing, and organizing the collected data for the Client
• As a processor, SoWhat AI undertakes to process the Data only on documented instructions from the Data Controller and will immediately inform the latter if, in its view, an instruction constitutes a breach of applicable regulations
  ‍

SoWhat AI therefore invites each user (the “User”) to read the information notice provided by the Data Controller.

‍

Case 2 : SoWhat AI acts as a Data Controller

‍

Processing of your conversation data beyond the conversation phase : SoWhat AI also wishes to use the Data provided by a User during and after their conversation via the Service deployed at one of the Company’s Clients, for the purpose of improving its Service, in particular by enriching its algorithm. In this case, SoWhat AI acts as the Data Controller, and this processing is based on our legitimate interest (Art. 6.1(f) GDPR).
‍

It should be noted that after the Service usage phase as decided by the Client, the Company removes the User’s identifying data. The non identifying data enables the creation of a model intended to enrich the Assistant’s algorithm and improve the Service.

Collection on this website : when you contact the Company via the website www.sowhat.ai, in particular by providing your email address to book a meeting or stay in touch, SoWhat AI acts as the Data Controller. The collection and use of the data transmitted are solely intended to respond to your requests for information. This processing is therefore based on our legitimate interest (Art. 6.1(f) GDPR).

‍

What data ?

‍

The Data listed below are those typically requested by the SoWhat AI Service, but the list of requested Data is adapted to meet the specificities of the business sector or the particular needs of the Client acting as Data Controller.
The User must only provide complete and up to date information that relates to them and does not infringe third party rights.

‍

A) Data provided by the User :

‍

In response to questions asked by the Assistant, the User directly provides the data useful for their application/order/information request for the purpose of their recruitment/order/project, including, depending on the Service use case, the following categories of information :

• Civil status / identity, such as last name, first name, age…
• Personal life, including postal address, email address, phone number, for example whether the User holds a driving license, their availability dates and time slots by day of the week, their choice regarding an order, their income levels and/or down payment for their project, the type of property or service sought…
• Professional life, such as their profession, their resume (as an attachment, where applicable sent by email following the conversation with the Assistant, depending on the Client’s choice), education level or degrees, professional experience and roles held, the type of contract sought (fixed term / permanent or other) as well as the desired weekly hours…
• Other, including the User’s answers to open ended questions, such as their motivation, their experience in customer facing roles in the case of a job applicant, or choices or preferences regarding an order or a project…

‍

B) Data collected automatically :

‍

Other data may be indirectly collected by SoWhat AI when the User uses the Assistant. This includes in particular the following categories of Data : connection data, including the URL by which the User arrived on the website (to identify and compare the different communication channels), a user identifier and a conversation identifier, both stored as cookies valid for 30 days.

‍

C) Data recorded by the Client :

‍

The Client, acting as Data Controller, may add a comment or an assessment about a candidate/employee/customer/prospect.

‍

Recipients and retention periods

‍

Case 1 : Data collected by the SoWhat AI Service during the conversation is first intended for the Client, which, as Data Controller, decides how long it processes and retains it. Location information via your IP address or postal address is not disclosed to the Client and is only used to find the nearest Client location for the User, or to calculate an estimated travel time to the requested workplace. SoWhat AI does not provide for, nor offer, automated decision making based on the Data provided by the User when using the Service.
‍

Case 2 : Beyond the post conversation management phase by the Client (Case 1), SoWhat AI also wishes to use the Data provided by a User during their conversation for the purpose of improving its Service, in particular by enriching its algorithm. SoWhat AI then deletes identifying data (last name, first name, postal address except postal code, email address, phone number, resume, etc.) and retains the other information without time limitation in a form that is no longer directly identifying, in order to feed a database enabling SoWhat AI to improve the quality and performance of the SoWhat AI Service.

You may object to this or exercise your other rights by contacting SoWhat AI (see the sections “What are your rights ?” and “How to exercise your rights ?”).

‍

Transfers of data outside the EU

‍

All personal data collected via the Service are hosted and processed by staff within the EU under SoWhat AI’s responsibility. Therefore, SoWhat AI does not transfer your information outside the European Union (EU).

‍

Security measures

‍

SoWhat AI strives to protect the Data you entrust to it, directly or indirectly when you use the Service on a Client’s website, in particular by :

• Restricting access to the Data to duly authorized SoWhat AI personnel. In addition, SoWhat AI undertakes to ensure that personnel do not make any copies of IT media or collected Data except those strictly necessary to perform SoWhat AI’s obligations (e.g., backups)
• Ensuring that employment contracts include confidentiality clauses relating to any Data personnel may access
• Encrypting data both during the User’s interaction with the Service and afterwards when the data are stored in databases
• More generally, implementing all appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures to guarantee the confidentiality, integrity, availability, and ongoing resilience of processing systems and services, and to ensure that the Data are not altered, damaged, or disclosed to unauthorized third parties

‍

Cookies and audience measurement

‍

A cookie is a file sent to your browser via the visited website. This cookie makes it possible to store and collect information, for example to know which pages you visited, how long you stayed on this website, which link(s) you clicked, how often you return to the website, etc.

Cookie collection is based on your consent (Article 6.1(a) GDPR) except where the cookie is strictly necessary for the operation of the website.

‍

Trackers on this website www.sowhat.ai

‍

The SoWhat.ai website requires a session cookie linked to the technical foundation used to build the website. It cannot be disabled, otherwise the website would no longer be accessible.
‍

PostHog statistical cookies are also placed on the sowhat.ai website. In addition, SoWhat AI runs occasional campaigns to better understand how this website is used and improve your user experience. These campaigns rely on a tool using third party trackers that record data relating to visitors and their device, including part of the IP address, screen size, browser type, country, language used, etc. The provider of this service is contractually prohibited from reselling the data collected for SoWhat AI.

Tracker used by the Assistant : as indicated above, a cookie is used to store for 30 days the identifier assigned to the Service user and the identifier assigned to the conversation, in order to allow the exchange to continue after an interruption by the user.

‍

What are your rights ?

‍

In accordance with the GDPR and the French Data Protection Act, you may access and/or obtain a copy of your data. Depending on the context :

• You may object to the processing of these data, request rectification, or request erasure
• You have the right to restriction of processing and the right to data portability

Where you have given your consent, you have the right to withdraw it at any time.

‍

How to exercise your rights ?

‍

You may exercise your rights at any time by contacting, as applicable :

• The designated contact point at the Company’s Client using the SoWhat AI Service, or
• SoWhat AI’s Data Protection Officer (DPO) at dpo@sowhat.ai
  ‍

For security reasons, you must prove your identity (for example by providing your last name, first name, postal or email address). Where applicable, a valid ID document may be requested. Please note that if you submit a request to SoWhat AI that concerns a Client, SoWhat AI undertakes to forward your request to the relevant Client as quickly as possible. If you believe, after contacting us, that your data rights are not being respected, you may lodge a complaint with a supervisory authority.

Updates to this policy

We may amend this privacy policy. In the event of significant changes, we will publish a notice on the relevant website.

‍