Privacy policy

1. Data concerning the data controller

Data Controller: MAIDSCO S.L. (Maids & Co — Domestic Employment Agency), tax ID B88922885, represented by Isabella de Medina Velletri.

MAIDSCO S.L. is a placement agency authorised by the Spanish National Employment System (SNE no. 1300000318). Under Law 3/2023 on Employment, its services are entirely free of charge for candidates.

• Address: Calle Marqués del Riscal, 2, 3º int., 28010 Madrid, Spain.
• CIF: B88922885.
• Contact: [email protected].
• Data protection contact: [email protected] (subject “Protección de datos”).

2. Data collected by the data controller

Maids & Co collects information from both job candidates and clients requesting recruitment services. Once the User completes the form, an interview will be conducted, during which information provided directly by the User will be collected. The information provided by the User includes:

• Registration Data: information provided by the User when completing the form on the Website or via WhatsApp.
• Profile Data: once registered, and if the profile is suitable, an interview will be conducted (whether for job applications or for those seeking to hire), with a series of questions according to the client's needs in order to match the candidate as successfully as possible.
• Additional Profile Data: the User may provide additional information such as a photograph, date of birth, mobile phone number, or ID number.
• Data relating to communications: information provided by Users to resolve queries or complaints regarding the use of the Website, whether through the contact form, email, or customer service by telephone.
• Data relating to requests made: the information completed by Users when requesting a service.

3. Purpose of processing the collected data

The collected data is processed for the following purposes:

• Service management: managing any incidents that may arise during the provision of services, both by the end user and by the professional.
• Communications: sending communications by email and/or SMS regarding the operation of the service, and sharing the professional's data with the end user so that they may evaluate the candidacy.
• Service improvement: researching and analysing how to improve the services provided, and developing and enhancing the features of the service offered.
• Fraud investigation: detecting and investigating fraud and other illegal activities, disclosing the relevant information to the competent authorities.

4. Processing of images, photographs and audiovisual recordings

Maids & Co may process image and voice data of candidates, including photographs, interview recordings and short videos, exclusively to assess the candidate's professional suitability, prepare their presentation profile, and show their profile to clients interested in recruitment processes.

Such data will be processed only with the candidate's explicit and verifiable consent, granted in advance through digital confirmation (including WhatsApp communication). The candidate will be informed before any recording starts and may take the interview without recording if they prefer. Refusal to grant such consent will not affect the application, although it may limit the presentation of the profile to certain clients who require this format.

From the photograph provided, Maids & Co may use automated tools to prepare a professional presentation image that preserves the candidate's likeness. The candidate may ask for their original photograph to be used, or for no image to be included. Images and recordings may be shared exclusively with Maids & Co clients to evaluate the candidacy; clients are expressly prohibited from copying, storing, forwarding, publishing or disseminating such material for purposes other than the recruitment process.

Interview recordings are kept for 90 days; photographs, presentation images and presentation videos are kept while the candidate's profile remains active or until consent is withdrawn, in which case they will be deleted without undue delay. Image and voice are not analysed automatically to infer emotions or personal characteristics. The written transcript of the interview forms part of the candidate's professional profile (see section 5).

5. Artificial intelligence and automated decisions

Maids & Co uses artificial-intelligence tools to support its processes. In accordance with Articles 13.2.f and 22 GDPR and Regulation (EU) 2024/1689 on Artificial Intelligence, here is how they affect you depending on your relationship with us.

If you are a candidate: after your application, the first contact via WhatsApp is handled by an automated assistant based on artificial intelligence (María, Maids & Co's AI assistant), not by a person; the team follows those conversations and steps in when needed. We use automated tools to compare your professional profile with the requirements of each offer, based on the information you provide about experience, availability, area, languages, salary expectations and work authorisation, together with any references and interview feedback. The result may mean that you are not proposed for a specific offer, that you are proposed for other, more suitable offers, or that your application to an offer is archived; none of these decisions prevents you from applying again. Team members can review and change any result.

You have the right to obtain human intervention, to express your point of view and to contest any decision made by these systems (Art. 22.3 GDPR). To do so, write to [email protected] with the subject “Review of my application”: a member of the team will review your case, explain the main reasons for the result and reply within one month at most. You may also request information about the logic applied in your case (Art. 15.1.h GDPR). These systems do not analyse your face or voice to infer emotions or personal characteristics.

If you are a client: no automated decisions are made about you. The candidate profile summaries you receive are drafted with the help of artificial intelligence from what the candidates have told us and are reviewed by the team before being sent; they may still contain errors, which we would be grateful if you reported to us.

6. Sign in with Google

Some Maids & Co portals (such as private management or client areas) allow Users to sign in with a Google account. When this option is used, we receive from Google only the User's basic profile data: their name, their email address and, where applicable, their profile picture.

This data is used exclusively to authenticate the User, manage their access and keep their account secure. It is not used for advertising purposes, is not sold or shared with third parties, and is not combined with other data for purposes other than those described.

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (available at https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The User may revoke the access granted at any time from their Google account security settings (https://myaccount.google.com/permissions) or request the deletion of this data by writing to [email protected].

7. Disclosure of the collected data and international transfers

The collected data will be processed exclusively for the purposes described. For the correct provision of services, the controller may share Users' personal data with the professionals who provide the services and, where necessary to comply with the law, with security companies and Law Enforcement Agencies. Users' data will not be transmitted to any third party except in the following cases:

• When necessary for the requested services: the candidate's professional profile is disclosed to the client offering the position, solely so that they can evaluate the candidacy, and the client undertakes not to use it for any other purpose.
• When the controller has express and unequivocal authorisation from the User.
• When requested by a competent authority in the exercise of its functions, including the periodic reporting that placement agencies submit to the public employment services.
• When required under the regulations in force.
• Data processors providing services on behalf of Maids & Co under Art. 28 GDPR agreements, by category: messaging and calls (Meta Platforms Ireland, WhatsApp Business); web analytics (Google Analytics, only with consent); hosting, infrastructure and database; and artificial-intelligence and automatic-transcription services used in the selection process (section 5). Full list on request at [email protected].
• International transfers: the main database is located in the European Union. Some of the above providers are based or have servers in the United States; transfers rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified and, otherwise, on the Standard Contractual Clauses approved by the European Commission. You may request a copy of these safeguards at [email protected].

8. Users' rights

Retention periods: application data is kept for 24 months from the last interaction with Maids & Co; client data, for the duration of the relationship and thereafter for the statutory retention periods (up to 6 years under commercial and tax obligations); recordings, as set out in section 4. In all cases unless the User requests earlier erasure or a different legal period applies.

The User may withdraw their consent at any time by sending an email to [email protected]. They may also exercise the following rights:

• Access: ask the controller whether it processes any of their data.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure: request the deletion of their personal data in the cases provided for.
• Restriction: request that the controller restrict the use of their data.
• Objection: object to the processing of the personal data held by the controller.
• Portability: request the portability of their data.

9. Exercising rights and complaints

The exercise of these rights is personal, so the data subject must prove their identity. It must be done in writing signed by the data owner, indicating their address and attaching a copy of their ID, addressed to the controller. We have forms available for exercising your rights; request them by email or use those provided by the Spanish Data Protection Agency.

Response times depend on the right, but will be a maximum of one month from the request, or two months if the matter is particularly complex, in which case you will be notified. You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).