Privacy Policy

The data controller is COWONDER d.o.o., with its registered office in Zagreb, Croatia. For all privacy-related questions, please contact us at hello@cowonder.com.

We collect data through several separate flows. Here we list them as they are recorded by the form and the system.

Membership Application

• First and last name, email, phone number in international format and city.
• LinkedIn profile and other links you provide, for example, Instagram or a personal website.
• Professional role, company, industry (up to three values from the provided list) and years of experience.
• Free-form answers: what you are building, current priorities, career stage, what people know you for, what you are looking for, three words about yourself, what gives you energy, one interesting fact about yourself and why COWONDER.
• How you found out about us and, where applicable, who recommended you or which event you attended.
• Consents and tags: acceptance of terms, interest in the founding generation and subscribing to event notifications.

Partnership Application

• Details of the person submitting the application: name, role, email and phone; if this is not the main contact person, also the contact details of the main contact person.
• Organisation details: name, website, LinkedIn, year of foundation, size, markets, primary and secondary industry and description.
• Motivation, the value you offer, target audience within the community, desired result in the first 12 months, previous results and reference clients.
• References and, optionally, public recommendations.
• Answers about regulatory or reputational risks and confirmation of the four partnership principles: respecting the rules, no guarantee of outcome, relevance and disclosure of conflicts of interest.

CV (optional)

• A file in PDF, DOC or DOCX format that you upload yourself, maximum 10 MB.
• Uploading is always voluntary. You can complete the entire application manually and no step requires data from your CV.
• Before the analysis, you must give explicit consent, separate from accepting the terms. Without this consent, the analysis will not be initiated.
• The file is stored in a secure repository accessible only to administrators. If you remove the CV before submitting, neither the file nor the extracted data will remain with the application. After submission, the file is kept with the application until the review is complete.

Concierge (on-site assistant)

• Every question you ask the Concierge is saved along with the answer, the recognised topic of the question and, if you provide it, your rating of the answer.
• We do not record your IP address, name or account details. We only record a random browser session tag created by the Concierge itself.
• Records are automatically deleted after 12 months.

If you give consent, your CV is processed by COWONDER AI, which uses the Google Gemini model via our AI mediation service. The analysis reads the entire document and returns structured data:

• Extracted data: facts that are literally stated in the CV, for example, name, contact details, LinkedIn, current role and company, languages, education, certificates, awards and previous roles.
• Suggested data: assessments such as level of experience, industry, areas of expertise, what people know you for, what you are looking for and ways of working. These are suggestions, not direct quotes. We do not enter them without your review and you can always change them.
• Internal review note: a brief summary to help the person reviewing the application. It is never displayed in the form.

For each field filled from the CV, the form shows where the data comes from. You can review and change all data before submitting. You can withdraw your consent at any time before submitting: when you select 'Remove CV', the file and all extracted data are removed, and you can continue the application without the CV.

• Reviewing membership or partnership applications and making decisions about them. Every decision is made by a human, not an automated system.
• For approved members and partners: running the digital platform, meaning your profile, recommendations of relevant contacts based on your profile data, messages only after the other side consents, and the voluntary Get to know yourself questionnaires, whose answers are private and shared only according to your permissions. Student accounts are not included in personal contact recommendations.
• Pre-filling the application from your CV, only when you request it.
• Answering questions in the Concierge and improving its responses. Editorial decisions are always made by a human.
• Application-related communication: confirmations, status notifications and SMS or WhatsApp messages via our partner Twilio.
• Security, fraud prevention and fulfilling legal obligations.

• Taking steps prior to entering into a membership contract (Art. 6(1)(b) of the GDPR): processing application data.
• Explicit consent (Art. 6(1)(a) of the GDPR): AI-powered CV analysis and optional channels, such as WhatsApp notifications.
• Legitimate interest (Art. 6(1)(f) of the GDPR): protecting the community, preventing misuse and improving the Concierge.
• Legal obligations (Art. 6(1)(c) of the GDPR): retaining accounting records when membership becomes a paid service.

• Our platform: database, account login, file storage and server functions, on infrastructure within the European Union.
• Our AI mediation service: mediates all calls to artificial intelligence models. Technical data may be logged for service reliability. Your account data is not sent.
• Google Gemini: the model that analyses CV content, translates answers from applications for our team and helps with reviewing applications and suggesting first messages.
• OpenAI: the model that answers questions in the Concierge and searches the Concierge knowledge base to match a question with the appropriate content.
• Twilio: phone number verification and sending confirmations via SMS or WhatsApp. Twilio only receives the phone number you enter.

We do not sell your data. Other than the systems listed, no other third party receives your data.

• Applications: during the review process and, if you are accepted, for the duration of your membership. Rejected applications are kept for a maximum of 6 months, or 24 months if you explicitly consent to be contacted again.
• Incomplete applications: until you submit the application or until the retention period for incomplete applications expires.
• CVs: with the application until the review is complete. If you remove the CV before submission, the file and extracted data are discarded.
• Questions asked to the Concierge: 12 months from their creation, after which they are automatically deleted.
• Active members: for the duration of the membership.
• Former members: up to 12 months after the end of membership, unless a longer period is required by law.
• Accounting records: 7 years, when it becomes applicable.

COWONDER does not make automated decisions about membership. CV analysis and Concierge responses are auxiliary tools, and the final decision on each application is made by a human.

At any time, you have the right to:

• access and download your data,
• rectify inaccurate or incomplete data,
• erase your data ('right to be forgotten'),
• restrict or object to the processing of your data,
• data portability in a machine-readable format,
• withdraw any consent at any time. You can withdraw your consent for CV analysis before submitting your application and can submit the application without a CV.

To exercise any of these rights, please write to us at hello@cowonder.com. We will process your request within a reasonable timeframe, and no later than 30 days.

If you believe your rights have been violated, you can file a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

We will notify you of significant changes by email or a prominent notice on the platform before they take effect. The date and version at the top of this document always indicate the currently effective version.