GDPR and international candidates

When this page applies to you

It applies if you are in the European Economic Area, the United Kingdom or Switzerland and a company used TalentValue365 to process your application. It does not apply to candidates in the United States, who are covered by the privacy policy and the state rights listed on the AI hiring page.

We say this plainly rather than implying a European footprint we do not have: the platform is operated from the United States, and its default deployment stores data on US infrastructure. Where a customer requires EU data residency, that is an arrangement to agree before onboarding, not a default. Confirm whether EU-region hosting is offered, and on which plans.

Controller and processor

The employer you applied to is the controller. They decide the role, the questions, the rubric and the outcome. TalentValue365 is the processor, acting on their documented instructions under Article 28. A data processing agreement is available to customers and forms part of their contract with us.

Automated decisions and Article 22

Article 22 gives you the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Recruitment decisions are squarely in that territory, so this is the section that matters most.

The answer differs by stage, and conflating them would be the easy mistake to make here.

The interview stage is not solely automated. The AI scores your answers and stops. Its recommendation is shown to a recruiter and is never executed by the system, so a person reviews and decides.

The résumé screen can be. If your fit score falls below the threshold the employer configured, the platform can close the application with no human involved. On any ordinary reading that is a decision based solely on automated processing, producing an effect that is at least similarly significant, and Article 22 engages. Controllers relying on it need a lawful ground under Article 22(2), and should be able to show the safeguards below were available.

The automatic close is withheld where the résumé could not be parsed cleanly or the parser had low confidence, and where a recruiter has already acted on the application. Employers can also set the threshold so that nothing closes automatically, which is the simplest way to keep the whole pipeline outside Article 22.

The safeguards Article 22 contemplates:

• You are told. The AI identifies itself as software at the start of the call and states that the call is recorded.
• You can get an explanation. Each score carries the part of your answer that produced it, so the reasoning can be read rather than inferred.
• You can contest it. Ask for human review of your interview, and ask for a human interview instead of the AI, without giving a reason.

Lawful basis

The controller sets the basis. In practice it is usually legitimate interests in assessing applicants for a role you applied to, or steps taken at your request before entering a contract of employment. Where a customer relies on consent, for example to keep your details on file for future roles, it must be freely given and you can withdraw it.

Special category data is not required to apply and is not used for assessment. Any diversity information you volunteer is stored separately, used only in aggregate, and never shown to the AI or to reviewers.

Your rights

• Access a copy of your data, including the recording, transcript and scores.
• Rectify anything inaccurate.
• Erase your data, subject to the controller's retention obligations.
• Restrict or object to processing, including on legitimate-interests grounds.
• Portability, in a structured machine-readable format.
• Human review of, and an explanation for, an assessment.
• Complain to your supervisory authority. Nothing here limits that.

Requests go to the controller, and we support them. If it is easier, send it to us through the contact page naming the company you applied to, and we will route it. We respond within one month, extendable by two further months for complex requests, and we verify identity first.

Transfers out of the EEA and UK

Using this platform for an EEA or UK candidate involves a transfer to the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with a transfer risk assessment.

Sub-processors and their locations: publish the named sub-processor list, their locations, and the transfer mechanism for each. This list is a GDPR requirement rather than a nicety; leave it unpublished and a customer cannot lawfully complete their own assessment.

Retention

The controller sets retention. We delete or anonymise on their instruction, or on a valid erasure request, subject to any legal hold. Note the tension worth naming: US employers are subject to federal record-keeping rules that require them to retain application records, which can lawfully limit erasure. Where that applies, the controller should tell you.

If you are the employer

If you are a US company recruiting into the EEA or UK, the GDPR obligations are yours as controller. You will need a lawful basis, an applicant privacy notice, a record of processing, a data processing agreement with us, and an Article 35 data protection impact assessment. An AI system assessing candidates at scale will generally require a DPIA, and a supervisory authority will expect to see it.

Ask us for the DPA and the sub-processor list before you launch a role in those regions rather than after.

Contact

Reach us through the contact page.

EU or UK representative under Article 27, where required: appoint and name an Article 27 representative, or state that the platform is not offered to EEA or UK candidates. A US company without an establishment in the EU that targets EU data subjects generally has to appoint one, so this is a decision to make deliberately.