1. Introduction
Rekom ("we", "Rekom") is an artificial intelligence (AI) powered recruiting platform serving two groups of users: Company Users, meaning HR teams and recruiters who search for and shortlist candidates, and Candidate Users, meaning job seekers who create an account to search for jobs, build a CV, and track their applications. In operating this service, we process the personal data of both groups, as well as candidate profile data we obtain from third-party sources.
We are fully committed to protecting the privacy and security of the personal data you entrust to us. This Privacy Policy transparently explains what data we collect, why we collect it, how we use it, who we share it with, and what rights you have as a data subject.
This policy applies to all Rekom products and services, including the rekom.ai website, the company platform at app.rekom.ai, the candidate platform at talent.rekom.ai, and Rekom's other official channels.
2. Data Controller Identity
In accordance with the PDP Law, the party responsible as the Personal Data Controller for this service is:
| Item | Details |
|---|---|
| Company Name | PT Dibimbing Digital Indonesia |
| Service Name | Rekom |
| Website | rekom.ai |
| Privacy Email | admin@rekom.ai |
| Domicile | Jakarta, Indonesia |
For any question or request relating to data privacy, you can reach us by email at admin@rekom.ai.
3. Data We Collect
We collect three main groups of data in operating the Rekom service:
3.1 Company User Data (HR Teams & Recruiters)
Data collected from individuals and companies that register for and use the Rekom company platform:
| Category | Type of Data | Nature |
|---|---|---|
| Account Identity | Full name, email address, phone number, job title | Required |
| Company Data | Company name, industry, company size, office address | Required |
| Payment Data | Billing information (processed by certified third-party payment providers — Rekom does not store credit card data directly) | Required (paid accounts) |
| Usage Data | Search history, shortlists created, features used, recruiting preferences | Automatic |
| Technical Data | IP address, device type, browser, operating system, access time | Automatic |
| Communications | Messages sent to the Rekom team by email or contact form | Optional |
3.2 Candidate User Data (Job Seekers)
Data you voluntarily provide when you register for and use the Rekom candidate platform at talent.rekom.ai. Unlike the data in section 3.3, this group comes directly from you and is processed on the basis of your consent:
| Category | Type of Data | Nature |
|---|---|---|
| Account Identity | Full name, email address, encrypted password | Required |
| Phone Number | Phone number and its verification status | Optional |
| Professional Profile | Personal summary, work experience, education, skills, languages, certifications, portfolio, and location | Optional |
| Linked Account Imports | Profile data you import yourself from third-party accounts you connect, such as Google or LinkedIn | Optional |
| CV Documents | CVs you build with the CV builder, including versions tailored to specific job openings | Optional |
| Job Search Activity | Your job search conversation history, jobs you save, and application statuses you record yourself | Automatic |
| Technical Data | IP address, device type, browser, operating system, access time | Automatic |
Important to know: the professional profile you complete can be found and viewed by Company Users through the candidate search feature. This is what allows companies to reach out to you without you applying first. Your job search history, saved jobs, and application statuses are not shown to Company Users. The full explanation, including how to withdraw your profile, is in sections 6.1 and 10.
3.3 Candidate Profile Data from Third-Party Sources
Rekom aggregates candidate profile data from publicly available sources and from data partners that hold a valid legal basis to share such data. This data is used to enable candidate search by Company Users.
| Type of Candidate Data | Description |
|---|---|
| Professional Identity | Name, current and past job titles, names of companies worked for |
| Career History | Work experience, duration in each role, role descriptions |
| Education | Education level, institution, field of study, graduation year |
| Professional Skills | Technical and non-technical skills listed on public profiles |
| Location | City or region of residence/work |
| Contact Information | Shown only within the access limits of the applicable subscription plan |
Important note: Rekom does not collect sensitive candidate data such as health information, religious beliefs, political views, biometric data, or personal financial data. We only process data relevant to professional recruiting purposes. If you find your profile on Rekom and do not want us to process your data, you can request deletion at any time — no account required — through the procedure in section 11.
4. How We Collect Data
We collect data through three main mechanisms:
4.1 Directly from You
When you register an account, complete your company profile, subscribe, contact our team, or actively use Rekom's platform features. For Candidate Users, this includes the data you fill in on your profile, the data you import from third-party accounts you connect, and the CVs you build on the platform.
4.2 Automatically
When you use the platform, our systems automatically record technical and usage data through cookies, server logs, and similar technologies. This data is used to keep the service running properly and to improve the user experience.
4.3 From Third-Party Sources
Candidate profile data is obtained from:
- Professional networking platforms and publicly available online sources
- Data partners that hold valid consent or another lawful basis from the candidates concerned
- Other sources permitted by applicable laws and regulations
5. Purposes & Legal Bases for Processing
Under Article 20 of the PDP Law, every processing of personal data must rest on a valid legal basis. Our processing purposes and their legal bases are:
| Purpose of Processing | Data Processed | Legal Basis |
|---|---|---|
| Creating and managing accounts | Identity data, company data | Performance of a contract |
| Providing candidate search and shortlisting features | Usage data, search queries | Performance of a contract |
| Processing payments and billing | Payment data, company data | Performance of a contract; legal obligation |
| Improving platform and AI quality | Anonymised/aggregated usage data | Legitimate interest |
| Service communications and important notifications | Email, name | Performance of a contract; legitimate interest |
| Marketing communications and product updates | Email, name | Consent (withdrawable at any time) |
| Complying with legal obligations | Data required by law | Legal obligation |
| Fraud prevention and platform security | Technical data, account data | Legitimate interest; legal obligation |
| Showing third-party sourced candidate profiles to Company Users | Candidate profile data (section 3.3) | Legitimate interest (professional recruiting) |
| Providing job search, CV builder, and application tracking | Candidate User data (section 3.2) | Performance of a contract |
| Personalising job search results using your profile | Candidate User professional profile | Consent (withdrawable at any time) |
| Showing Candidate User profiles to Company Users | Candidate User professional profile | Consent (withdrawable at any time) |
6. Sharing Data with Third Parties
Rekom does not sell your personal data to any third party for commercial purposes. We only share data in the following circumstances:
6.1 Candidate Profiles Shown to Company Users
Rekom's core function is to connect companies with candidates. Accordingly, the candidate profiles described in sections 3.2 and 3.3 can be found, viewed, and saved to a shortlist by Company Users subscribed to our platform.
If you registered as a Candidate User, the limits are as follows:
- What Company Users can see is the professional profile you completed — the data you intended prospective employers to see.
- What is not shared: your job search conversation history, the jobs you saved, the application statuses you recorded, and your password.
- Company Users are bound by Terms of Service requiring them to use candidate data solely for legitimate recruiting purposes.
Withdrawing your profile: you can withdraw this consent at any time by emailing admin@rekom.ai. Once the request is processed, your profile is removed from candidate search results, and you can continue using job search, the CV builder, and the application tracker as usual. Note that data a Company User saved to their shortlist before we processed your request sits under that company's control as a separate data controller.
6.2 Service Providers Supporting Our Operations
We work with trusted service providers that support platform operations, including:
- Cloud infrastructure and hosting — to store and run the platform
- Payment providers — to process transactions securely
- Analytics services — to understand platform usage (data aggregated/anonymised)
- Email and communication services — to deliver notifications and updates
- Customer support tools — to help us respond to User requests
All of these service providers are bound by confidentiality agreements and may only process data on Rekom's instructions.
6.3 Legal Obligations
We may disclose personal data where required by law, a court order, or a formal request from a competent government authority in accordance with applicable regulations.
6.4 Protecting Rights and Safety
Where necessary to protect the rights, safety, or legitimate interests of Rekom, our Users, or the public — including preventing fraud, security breaches, or illegal acts.
6.5 Corporate Transactions
In the event of a merger, acquisition, reorganisation, or asset sale, data may be transferred to a successor entity. We will give notice before your data becomes subject to a different privacy policy.
7. Cross-Border Data Transfers
As a platform operating in Southeast Asia, some of the data we process may be stored on or accessed from infrastructure located outside Indonesia, including but not limited to countries in the Asia-Pacific region.
In accordance with Article 56 of the PDP Law, every transfer of personal data abroad is carried out by ensuring that:
- The destination country provides a level of personal data protection equal to or higher than that required by the PDP Law, or
- Adequate safeguards or agreements are in place with the data recipient in the destination country, or
- Valid consent has been obtained from the data subject after adequate information about the transfer has been provided.
Rekom ensures that each of our international infrastructure partners meets strict security and data protection standards, including security certifications such as ISO/IEC 27001 or equivalent.
8. Data Retention & Deletion
We retain personal data only for as long as necessary for the purposes described in this policy, or for as long as required by applicable law:
| Type of Data | Retention Period |
|---|---|
| Active account data | For as long as the account is in active use |
| Account data after deletion | Up to 90 days, unless a longer period is required by law |
| Transaction & payment data | At least 5 years, per tax and accounting obligations |
| Usage data / technical logs | Up to 12 months |
| Records of communications with the Rekom team | Up to 3 years |
| Candidate User profiles, CVs, and saved jobs | For as long as the account is in active use, and deleted together with the account |
| Candidate profile after a request to withdraw from search | Removed from search once the request is processed; deleted entirely if you also request account deletion |
| Data required to resolve disputes | Until the dispute is finally resolved |
| Deletion request record (hashed marker) | Retained indefinitely, solely to keep deleted data from re-entering our systems from third-party sources |
Once the retention period ends, data is permanently deleted or anonymised so it can no longer be attributed to a specific individual.
9. Data Security
Rekom applies reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction, including:
- Encryption in transit using TLS/HTTPS for all communication between users and our servers
- Encryption at rest for sensitive data in our databases
- Role-based access control limiting data access to employees who need it
- Multi-factor authentication for internal access to systems holding personal data
- Regular security audits and monitoring to detect potential vulnerabilities
- Standardised incident response procedures for handling potential data breaches
Incident reporting: if a data security breach occurs that significantly affects your rights, we commit to notifying you and the Personal Data Protection Authority (BPDP) within the timeframe set out in the PDP Law.
10. Your Rights as a Data Subject
Under Law No. 27 of 2022 on Personal Data Protection, you hold the following rights over the personal data we process:
Right to Information
To be told who we are, why we process your data, and how it is used.
Right of Access
To request a copy of the personal data we hold and process about you.
Right to Rectification
To request correction or updating of personal data that is inaccurate or incomplete.
Right to Erasure
To request deletion of your personal data from Rekom — the full procedure is in section 11.
Right to Object
To object to the processing of your data, including for direct marketing purposes.
Right to Restriction
To request that processing of your data be restricted in certain situations set out by law.
Right to Portability
To receive your data in a structured, machine-readable format so it can be moved to another service.
Right to Withdraw Consent
To withdraw consent you have given at any time, without affecting the lawfulness of prior processing.
For Candidate Users: Withdrawing Your Profile from Search
If you no longer want to be discoverable by companies but still want to use job search, the CV builder, and the application tracker, you do not need to delete your account. Email admin@rekom.ai with the subject "Withdraw Profile from Search" along with your account email address, and we will remove your profile from candidate search results.
You can re-enable it at any time through the same email address. We process this request within the same timeframe as the other data subject rights requests below.
How to Submit a Request
To exercise your rights, email admin@rekom.ai with the subject "Data Subject Rights Request" and include:
- Your full name and the email address registered to your Rekom account
- The type of request you are making (access, rectification, erasure, and so on)
- Any additional information relevant to your request
We will respond to your request within 14 (fourteen) business days of receiving it.
Complaints to the authority: if you are not satisfied with how we handled your request or complaint, you have the right to lodge a complaint with the Personal Data Protection Authority (BPDP) or the competent data protection supervisory authority under applicable rules.
11. Data Deletion Requests
If you do not want your personal data held by Rekom, you have the right to request its deletion. This section explains who can submit a deletion request, how to do it, how long it takes, and what happens once we have processed it.
11.1 Who Can Submit a Request
- Company Users — for your account and company data.
- Candidate Users — for your account, professional profile, CVs, job search history, and all other data you created on the platform.
- Individuals without a Rekom account — if your profile came from a third-party source as described in section 3.3, you still have the right to request deletion even though you never registered with Rekom.
You do not need an account. To have your data deleted from Rekom, you are not required to register, subscribe, or create an account first. Simply send your request by email to admin@rekom.ai. Deletion requests are free of charge.
11.2 How to Submit a Request
Email admin@rekom.ai with the subject "Data Deletion Request" and include the following:
- Your full name as it appears on the data you want deleted
- The email address of your Rekom account — or, if you do not have an account, a link to or screenshot of your profile page on Rekom so we can locate the data in question
- One identity document for verification (you may redact part of the identity number). We use this document solely to confirm the request comes from you, and we delete it once the request has been processed
- The scope of your request: deletion of all data, or only specific parts of it
We verify identity to protect you — without this step, someone else could misuse the deletion process to remove your data without your knowledge.
11.3 Processing Timeline
| Stage | Timeframe |
|---|---|
| Confirmation that we received your request | Within 3 business days |
| Identity verification and formal response to the request | Within 14 business days |
| Deletion from active systems and the candidate search index | Within 30 calendar days of the request being verified |
| Deletion from backup systems | Within 90 days |
11.4 What Happens After Deletion
- Your profile is removed from the search index, so Company Users can no longer find, view, or save it.
- Your account and everything in it — profile, CVs, saved jobs, and application history — is permanently deleted and cannot be restored.
- We keep one minimal record: a hashed marker of your identity on an internal suppression list. It exists solely to ensure your data does not re-enter our systems if it reappears at a third-party source, and it is not used for any other purpose.
11.5 Limitations You Should Know About
Under the PDP Law, there are situations where we cannot delete all data immediately:
- Legal obligations — transaction and payment data must be retained for at least 5 years for tax and accounting purposes. This data is segregated and not used for any other purpose.
- Dispute resolution — data needed for ongoing legal proceedings is retained until the dispute is finally resolved.
- Copies held by Company Users — data a Company User downloaded or saved into their own systems before we processed your request is outside Rekom's control, because that company acts as a separate data controller. At your request, we can forward your deletion request to the Company Users on record as having saved your profile.
- Anonymised data — aggregate data that can no longer be linked to you personally falls outside the scope of deletion.
If we reject your request in whole or in part, we will explain the reasons in writing along with the legal basis. You have the right to challenge that decision with us and with the Personal Data Protection Authority (BPDP).
11.6 Alternatives to Deletion
If what you actually want is to stop being discoverable by companies — rather than to delete your account — you can choose to withdraw your profile from search results as described in section 10. You can also use your right to rectification if your data simply needs correcting, or your right to object if you want to limit only certain processing purposes.
13. Protection of Children's Data
Rekom's services are designed and intended solely for individuals aged 18 (eighteen) and over in a professional context. We do not knowingly collect personal data from individuals under the age of 18.
If you become aware that someone under the age of 18 has submitted personal data to us without valid consent, please contact us immediately at admin@rekom.ai and we will promptly take the steps needed to delete that data.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes to the service, or new legal obligations. We will mark any change by updating the "Last updated" date at the top of this document.
For material changes that could significantly affect your rights, we will give advance notice through:
- An email to the address registered to your account, and/or
- A prominent notice displayed inside the platform
Your continued use of Rekom's services after a policy change takes effect will be treated as your acceptance of the updated policy.
15. How to Contact Us
If you have questions, concerns, or requests about this Privacy Policy or how we handle your personal data, please contact us at:
Privacy Email: admin@rekom.ai
Book a Call: calendly.com/rekom-info/30min
Website: rekom.ai
We are committed to responding to every privacy question and request within 14 business days.