GDPR Compliance

Roles

For candidate data processed through the hiring pipeline, our customers (employers) are the data controller and TalentValue365 acts as a data processor under a Data Processing Agreement (DPA). For our own marketing and account data, TalentValue365 is the controller.

Lawful basis

Candidate processing is generally based on the legitimate interests of the employer in conducting recruitment, or on the candidate’s consent where required. AI voice interviews are conducted only after explicit candidate consent is captured.

Data subject rights

• Right of access to the personal data we hold about you.
• Right to rectification of inaccurate data.
• Right to erasure (“right to be forgotten”).
• Right to restrict or object to processing.
• Right to data portability.

Candidates can exercise access and erasure rights directly from the application status page via a verified, time-limited email challenge. Other requests can be raised through the contact form.

International transfers & security

Where data is transferred outside the EU, we rely on appropriate safeguards such as Standard Contractual Clauses. Data is encrypted in transit and at rest, and tenant isolation is enforced at the database layer.