Privacy Policy

1. Who we are and the scope of this policy

BUSCOS is a service provided by B&P Media S.L. that turns a vacancy, need or selection process into an Evidence Process: role context, practical scenarios, written responses and, if the person chooses to continue, an optional voice conversation, with qualitative outputs intended for human review.

This policy explains how we process personal data when you visit buscos.es, request information, use a demo, purchase a service or take part in an evidence process. The specific information displayed within each process supplements this policy and identifies the organisation managing that process.

2. Controller and the parties' roles

For our own forms, commercial enquiries, demos, support, billing and direct communications, B&P Media S.L. normally acts as controller. Where a company, agency or other organisation creates and manages a process for invited participants, that organisation will usually determine the purpose and legal basis, while BUSCOS may act as processor or technical provider under the applicable contract and instructions. The exact role of each party depends on the process configuration and context.

3. Data minimisation and the use of codes

BUSCOS's recommended model uses codes. In this mode, the organisation keeps the link between the code and the person, so BUSCOS does not need to know the person's name, email address or telephone number. If the organisation can link a code back to a person, this is pseudonymisation rather than complete anonymisation.

4. Data we may process

4.1 Visitors, forms and commercial contacts

• Name, professional email address, telephone number and message, if you provide them.
• Organisation, role, sector, commercial interest and data needed to handle the request.
• Basic technical data such as IP address, device, browser, date, security logs and cookies according to your preferences.

4.2 Company or customer accounts

• Identification and contact details of authorised users.
• Company details, configuration, processes created, operational activity and support.
• Billing data when a paid service is purchased.

4.3 Scenarios

• Process code or identifier visible to the organisation.
• Scenario received, language, response submitted and dates needed to manage the process.
• Aggregate response activity: approximate timing, pauses and writing bursts, editing, saving, pasting, window focus or visibility and movement between scenarios.
• Signals, labels, observations, suggested questions and, where enabled by the configuration, an automated 0–100 numeric value for a specific item of evidence.
• Version of the notice displayed and acknowledgement of reading, with the date needed to show that the information was presented.

The button used to start Scenarios records an acknowledgement of reading: it confirms that the information was displayed and that the person states that they have read it. It is not general acceptance of this policy or blanket consent to all processing. The applicable legal basis is determined as described in section 7.

For applications started from a public vacancy, BUSCOS sends a link to the email address provided. The application is not created until the person opens the page and expressly confirms the request.

4.4 Optional voice conversation about your answers: audio, transcription and analysis

• Confirmation of availability to continue, which is not consent to recording.
• If the person continues and gives specific consent: conversation audio, transcript, language, duration and technical data needed to provide the feature.
• Automated analysis of oral evidence, signals, observations and, where enabled by the configuration, an automated 0–100 numeric value for that specific item of evidence.
• A record of the version and time at which recording consent is given or withdrawn.

Separate, specific consent is requested before the microphone is enabled and recording begins. The person may choose not to continue with this conversation. That choice does not itself generate a score, ranking or adverse automated decision.

4.5 Optional identified mode

If BUSCOS sends invitations, reminders or communications to a specific person, we may process the name, email address or other data needed for that communication. This mode must be agreed with the organisation responsible for the process.

5. Response activity, automated analysis and limits

When enabled by the process configuration, BUSCOS may record aggregate activity while a written answer is being prepared to provide traceability, identify access incidents and help prepare human review. This may include approximate timing, pauses and writing bursts, editing and saving operations, the number and approximate size of pasted content, window focus or visibility and movement between scenarios. When this capability is disabled, no new activity is captured. Historical records that must be retained are not deleted by this change. This capture is separate from analytics cookies.

• We do not record the screen or video or store the text of each keystroke.
• We do not read clipboard content outside the answer fields; we record the event and an approximate measure of content pasted into them.
• We do not record audio during the Scenarios or before specific consent is given for the optional Conversation by voice.
• We do not use voice or responses to infer health, emotion, personality, honesty or biometric traits.
• When scores and Trace are disabled by configuration, the organisation's panel does not display values, averages, colour bands or historical activity signals. Historical data that must be retained remains stored and is not used to rank, recommend or decide.
• BUSCOS does not make hiring decisions based solely on automated processing.

6. Why we use the data

• To respond to enquiries, meetings, demos, support requests or proposals.
• To create and manage customer accounts, configurations and processes.
• To present scenarios, collect answers and aggregate activity, moderate and analyse each item of evidence and prepare signals, observations, questions and automated per-evidence values for human review.
• If the optional voice conversation about the answers is selected and the applicable confirmation is given, to provide, record, transcribe and analyse it for human review.
• To record the information presented, acknowledgement of reading and, where relevant, consent or its withdrawal.
• To protect the service, prevent abuse, resolve incidents and meet legal or contractual obligations.
• To improve the service using aggregated, anonymised or minimised data where appropriate.

7. Legal bases

The legal basis depends on the flow, the relationship and who manages the process:

• Steps prior to entering into a contract or performance of a contract: this may apply to an application initiated directly by the person, a requested demo or the provision of services to customers.
• Consent: this is requested for non-essential cookies and, for the optional voice conversation, before recording, transcribing and analysing it where consent is the applicable basis. It can be withdrawn as described in section 11.
• Legitimate interests: these may apply to security, prevention of abuse, service continuity and proportionate handling of professional enquiries, following the relevant assessment.
• Legal obligation: to meet tax, accounting or regulatory duties and valid official requests.
• Processing on behalf of an organisation: where BUSCOS acts as processor, the controller organisation determines and communicates the legal basis and BUSCOS follows its documented instructions.

The acknowledgement before the written response shows that the information was presented; it does not replace the legal basis or turn the privacy notice into a contract accepted by the person.

8. Artificial intelligence, OpenAI and human review

BUSCOS uses artificial intelligence tools to prepare scenarios and, during the Scenarios, to moderate and analyse answers, aggregate activity and process context, and to produce signals, observations, questions and values about specific items of evidence. For these functions, BUSCOS may send OpenAI the process context and instructions, written answers, aggregate activity, a pseudonymous technical identifier and the data needed to produce the output. In the optional voice conversation about the answers it may also send the audio, transcript, written answers and conversation instructions to provide the voice interaction, transcribe it and analyse the oral evidence.

For written responses, the analysis compares each answer with the scenario, its context and the configured observable criteria. It may assess directness, clarity and structure, concreteness and applicability, examples or observable elements, internal consistency and acknowledgement of limits. For voice, it may also compare whether the expansion answers the question, makes decisions or steps concrete, remains consistent with the written answer and handles uncertainty responsibly. These outputs do not by themselves verify that stated facts are true. They may guide reviewer attention and later questions; when scores are disabled by configuration they do not generate averages or colour bands for the organisation.

Outputs may contain errors or require context. They may include labels and, when enabled by configuration, an automated 0–100 value for a specific item of evidence. When scores and Trace are disabled, the panel does not display values, averages, colour bands or historical activity signals. The organisation must review the original evidence, its signals, the transcript and context with human involvement before deciding how to proceed. The person may request access or rectification, or challenge the output and ask the organisation to review the original evidence and context, through the channels described in sections 11 and 12.

9. Recipients and international transfers

• Organisation managing the process: it receives the evidence associated with the relevant code or identity.
• Technical providers: hosting, email, security, storage, consented analytics, billing, support and artificial intelligence, including OpenAI for written Scenario answers and the optional Conversation about them.
• Authorities and advisers: where there is a valid legal obligation or need.

Some providers may process data outside the European Economic Area. Where applicable, the transfer is supported by an adequacy decision, Standard Contractual Clauses or another valid mechanism, together with the contractual and technical measures appropriate to the service and each party's role.

10. Retention criteria

There is no single retention period for every process. The controller organisation determines the period or criterion applicable to the process. You may request this information from the organisation or at soporte@buscos.es; certain data may remain restricted where required by law.

• Contacts, accounts and billing: while the relationship continues or as needed to handle the request and, afterwards, for periods required by tax, accounting or contractual duties or the defence of claims.
• Scenario answers: according to the criterion communicated for the process, the responsible organisation's instructions or contract and the obligations that apply.
• Optional voice-conversation audio, transcript and analysis: according to the criterion communicated for the process, the applicable legal basis, the organisation's instructions and the technical storage, backup and provider cycles. There is currently no self-service control that guarantees immediate and complete deletion from every such store.
• Acknowledgements, consent records and security data: for as long as needed to demonstrate choices, protect the service and deal with responsibilities or obligations.

11. Choosing not to continue and withdrawing consent

The voice conversation about your answers is optional. You may choose not to continue before enabling the microphone. Confirming that you are available to take part is not consent to recording: specific consent is requested on the voice screen immediately before recording starts.

You may withdraw consent or exercise the applicable rights by contacting the organisation managing the process or by writing to soporte@buscos.es. Withdrawal takes effect for processing based on consent once it is received and does not retrospectively affect the lawfulness of earlier processing. The request will be handled according to the rights exercised, the applicable legal basis, the roles of BUSCOS and the organisation, and any ongoing obligations. Effective deletion or restriction may require coordination between BUSCOS, the organisation and providers, and does not require immediate deletion of data that must be retained under another valid basis, a legal obligation or a duly limited technical backup cycle.

12. Your rights

Where applicable, you may request access, rectification, erasure, objection, restriction, portability and withdrawal of consent. To exercise these rights, write to soporte@buscos.es or contact the organisation managing your process.

If BUSCOS only knows your code, the organisation may need to verify your identity and forward the request to us. You may also lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.

13. Cookies

Necessary cookies are used to provide and protect the service. Analytics or similar cookies are loaded according to the choice made in the consent manager where applicable. You can review or change your preferences in the cookie settings. These preferences are separate from the optional voice conversation and Evidence Trace.

14. Security

We apply technical and organisational measures intended to protect data against unauthorised access, alteration, loss or misuse, including access restrictions, security logs, data separation where appropriate and provider review. No system can eliminate every risk.

15. Children

BUSCOS is not intended for anyone under 18. If we identify the processing of a child's data without an appropriate basis, we will assess and take the measures required in the circumstances.

16. Changes to this policy

We may update this policy to reflect legal, technical, contractual or product changes. The current version and its date will be published on this page and, where appropriate, additional information will be provided within the process.