Privacy notice — candidate data
How this platform processes personal data under UK/EU GDPR.
What we process and why
When a CV is submitted (uploaded by a recruitment agent or emailed to our intake mailbox), we extract a structured professional profile — name, contact details, location, skills, work history, and education — to match the candidate against open vacancies. The lawful basis is recorded per candidate (legitimate interest in recruitment services, candidate consent, or candidate self-submission).
AI processing
CV content is processed by Anthropic's Claude API (acting as a data processor) to extract the profile and score job fit. Organisations deploying this platform should have Anthropic's Data Processing Addendum in place (available from Anthropic) and configure appropriate data-retention settings on their Anthropic account.
Storage and security
Original CV files are encrypted at rest (AES-256-GCM). Access requires an authenticated agency account, and access to candidate records is written to an audit log. The database should be hosted on an encrypted volume.
Retention
Candidate data is retained for a fixed period (default 180 days, configurable by the agency) and then permanently deleted — including the original CV file, the extracted profile, and all job-match records.
Your rights
Candidates may request access to all data held about them (subject access request), correction, or immediate erasure. Erasure is a hard delete of every record we hold. Contact the agency that received your CV to exercise these rights.