Candidate Privacy Notice

The employer is the controller. It decides which jobs to publish, what to ask you, who on its team can see your application, how long to keep it and what decision to make. Hireall is the employer's processor: we host and process your data on the employer's instructions under a Data Processing Agreement, and we do not use your data for our own purposes. We do not sell candidate data, we do not build profiles of candidates across employers and we are not a data broker.

Hireall is the controller only for the limited technical data we need to run the service securely (such as our own server and security logs) and for cookies on our pages, as described in our Privacy Policy and Cookie Policy. The audit trail of actions taken on your application is kept for the employer and is processed under the Data Processing Agreement, not as Hireall's own data.

Youthall. Hireall is affiliated with Youthall, the talent network operated by STJ İnsan Kaynakları Bilişim ve Danışmanlık A.Ş. (Istanbul, Türkiye). If you apply with a Youthall profile, or the employer has published its job on Youthall, your application data is exchanged between the employer's Hireall account and Youthall as described in this notice; otherwise Youthall does not receive it. The employer's private notes, evaluations and offers are not opened to Youthall's independent talent pool or to other employers because of this integration. Youthall processes your application on the employer's instructions as Hireall's sub-processor; it processes your Youthall account, if you have one, under its own privacy policy at youthall.com, which you accepted when you created that account.

Young applicants. Hireall User accounts — the people who run an employer's hiring team — are for adults. That is not a ban on you applying. Employers may receive applications from younger people, for example for internships, and Hireall processes those applications only as the employer's processor. The employer is responsible for the age rules and any parental consent that apply to its recruitment. Youthall's own age requirements for candidate accounts are in its privacy policy.

• Identity and contact details you provide: name, e-mail address, phone number, location and links to professional profiles.
• Application material: CV, cover letter, portfolio, answers to screening questions, and the information the employer's team records about you, such as interview notes and scorecard ratings.
• Interview and assessment data: interview schedules; video-interview recordings where you choose to record answers; results of assessments the employer asks you to complete through a partner.
• Offer and pre-employment data: offer letters, your response, and documents you upload at the employer's request. Where the employer uses document verification, it may ask you to upload the document through your own verification link, or to present it outside Hireall and give only a reference such as a certificate number. A file you upload is kept in private storage, is opened only to the employer's authorised users, and every time one of them opens it is written to the audit log. It is erased on the purge date set for that item - 180 days by default and 365 at the most - and straight away if the employer cancels the request. The employer can also delete an uploaded file at any time. Before you upload, we ask you to cover over anything the employer does not need, such as a blood group or a religion field. What you upload is checked for signs of tampering or inconsistency, by fixed rules and, unless the employer has switched that off, with the help of a model; the result is shown to the employer as a risk flag. That flag is not a decision: it does not move your application, it does not rule you out, and a person at the employer looks at the document and decides. You can contact the employer if you want to object to the automatic check. A criminal-record or fitness-for-work document is stored, and checked in that way, only if you tick the consent box shown with it. That consent is never a condition of applying or of completing the check: you can instead give a reference number or a declaration, and then no file reaches us at all and only the outcome is recorded. What is recorded is the type of check, the outcome (for example satisfied, not satisfied or waived) and, where you supply one, a reference such as a certificate number. If the employer records the outcome of a fitness-for-work or criminal-record check, that outcome is health-related or criminal-record data even where no certificate is kept. The employer may request those checks only where the law allows for the role.
• Communications: e-mails and messages exchanged with the employer through Hireall.
• Technical data needed to run the service: IP address, browser and device information, timestamps, and the audit trail of actions taken on your record.
• Sensitive data. Hireall does not require sensitive data for you to apply. An employer may enable specific optional fields (for example for accessibility needs or diversity monitoring) where the law allows; those fields are marked and optional. That is separate from a document-verification outcome the employer records for a particular role, which is processed only for that check and is not an optional field on the application form.

• From you, when you apply, record a video interview, complete an assessment, respond to an offer or update your details.
• From the employer's team, when they add notes, ratings or documents to your record, or import your details from an earlier application.
• From a referrer, if an employee of the employer referred you.
• From Youthall, if you applied with your Youthall profile or through the Youthall talent network: the profile data you chose to share is sent to the employer's Hireall account.
• From job boards, if you followed a link from a job board to the employer's Hireall career page.
• From public professional sources, if the employer's team added your profile as a sourced candidate (see the section on sourced candidates).
• From connected calendar and meeting tools, when an interview is scheduled with you.

On the employer's instructions, Hireall processes your data to:

• receive and store your application and show it to the people on the employer's hiring team who are authorised to see it;
• organise the hiring process: pipeline stages, screening, interview scheduling, scorecards, approvals and communications;
• run the automations the employer has configured, such as acknowledgement e-mails, stage-based notifications or scheduled reminders;
• help recruiters read and organise applications with optional AI features (see the next section);
• manage offers, pre-employment documents and, where enabled, document verification;
• keep you in the employer's talent pool for future roles, where the employer has asked for and you have given your consent, or where the employer relies on another lawful basis it has told you about;
• produce statistics and reports for the employer about its hiring process;
• keep the service secure and maintain an audit trail.

The lawful basis for each of these uses is the employer's to determine and to explain in its own privacy notice.

Employers can enable AI features that help recruiters work through applications: parsing a CV into a structured profile, scoring how well an application matches the job description, searching a talent pool in plain language, drafting job posts and drafting the messages the employer sends you. A message drafted that way is written from what someone at the employer types and from the role, not from your application; that person reads it, edits it if they want to and decides whether to send it. These features are advisory. Hireall does not reject applications or make offers automatically; an employer may use automation that moves an application to another stage, including the hired stage, as described below. Where a feature produces a score, it is shown with the explanation the model returned so that a recruiter can read the reasoning; that explanation is the model's own account, not independently verified evidence. An automation that uses an AI score cannot reject your application or make you an offer without a person. If the employer uses such automation, a score may move your application to another stage automatically, including the hired stage, and send you the message the employer attached to that step; a move to the rejected stage and an offer are always decided by a person. The employer is responsible for having a trained person review an output before relying on it.

• Analysis is limited to the data needed for the feature the employer has enabled and that it has instructed Hireall to process lawfully. That may be the material you submitted for a job and the job description, or, for talent-pool search, records the employer already holds about you. We do not send the structured fields for your name, date of birth, gender or nationality to the model. The same information can still appear in free text such as a CV; the model is instructed to disregard it, which reduces but does not eliminate the possibility that it influences an output.
• The models are instructed to assess only job-related criteria (skills, experience, education, languages, screening answers and the stated requirements) and never to consider, infer or mention protected characteristics such as gender, age, ethnicity, nationality, religion, disability or family status, or proxies for them.
• AI requests are processed by large-language-model providers (currently Google and OpenAI) under contracts that prohibit them from using your data to train their models. Hireall does not use candidate data to train models either.
• Video-interview recordings are made available to the employer's authorised team to review; Hireall does not analyse your face, voice, expressions or recordings with AI.
• Employers can enable blind hiring, which hides name, photo and gender from evaluators until identity is deliberately revealed.

You may ask the employer how AI was used in your application and request that a person reviews any assessment. Hireall's features are designed so that a person decides whether you are rejected or made an offer, and employers must not use automation to turn you down without human review; the employer is responsible for that review. Statutory rights relating to automated decisions depend on where you live and on the circumstances. Where EU GDPR Article 22 applies, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Under the UK GDPR as now in force, certain solely automated decisions are permitted with safeguards, and the prominent rights are to be informed, to contest the decision and to obtain human intervention. Under KVKK Article 11 you may object to a result that arises exclusively from automated analysis and is against you. Our AI Transparency Notice has more detail, including rules that apply in particular places.

If an employer invites you to a video interview, you record answers to its questions in your own time using a personal link; no account is needed. Recordings are stored encrypted in the EU and are visible only to the employer's authorised team members. They are deleted automatically 60, 90 or 365 days after recording, depending on the employer's subscription, or earlier at the employer's request. The invitation tells you the deadline. You can re-record an answer yourself from your interview page until the deadline. Questions the employer has marked confidential are shown once: your first recording is submitted as soon as it ends, and if you close the question without recording it locks; ask the employer, which can have Hireall support re-open it.

Your employer may record you in Hireall as internal talent and put you forward for one of its own roles. That is the employer's decision, not ours, and the employer must tell you before it does it; Hireall asks the employer to confirm that it has. Once you are put forward, your record works like any other application in that employer's account: the same team members can see it, the same notes and evaluations are written on it, and every right described below applies to it. Alongside the details you have given the employer before, it may record your job title, department, manager, work location, employee number and start date.

Your employer may also generate a career compass: a development summary written by AI from the competencies recorded for you and what the target role asks for — what you already bring, what the role needs and suggested next steps. Your name, contact details and your manager's name are not sent to the model. The employer may share that summary with you through a personal link that needs no account; the link stops working when it expires or when the employer withdraws it. Separately, Hireall computes a readiness figure for the employer's own use by comparing recorded competencies; no AI produces that figure and it is not shown to you. Neither the figure nor the summary is a decision about the role, and you can ask the employer for a person to review any assessment that used AI.

What the employer records about you as an employee is governed by its own employee privacy notice, not by this one. If the employer removes you from internal talent, the employment record and any career-compass reports about you are deleted; your applications remain as applications.

Employers may add candidates to a talent pool from publicly available professional sources. If this happens to you, Hireall sends you a notice on the employer's behalf with a link to a personal privacy page. On that page you can see which employer added you and object with one click. An objection anonymises your record. The employer has agreed not to re-import that record in order to get around your objection. That does not stop you from applying yourself later, or the employer from processing a new application you choose to make, where that is independently lawful. You do not need an account to use this page.

• The employer's team — recruiters, hiring managers and interviewers with the roles the employer's administrator assigned. The employer may also share your details with its own advisers or affiliates under its notice.
• Hireall's sub-processors — the providers that host, secure and run the service on our behalf, for example Amazon Web Services in Frankfurt and the AI model providers. The full list is at hireall.com/legal/sub-processors.
• Services the employer connected — for example its calendar, video-meeting, Slack or assessment tools, which receive the data needed for that feature and process it under their own terms.
• Youthall, Hireall's affiliate — if you applied with your Youthall profile, or the employer published its job on Youthall, your application is shared between Youthall and the employer's Hireall account so that the employer can review it. This sharing takes place on the employer's instructions under Hireall's data-processing agreement with Youthall. The employer's privacy notice on the application form describes it; where the law requires a separate consent (for example to keep you in a talent pool), that is asked for on its own. Applying does not mean a separate consent is taken for every exchange between the two platforms. The employer's private notes, evaluations and offers are not opened to Youthall's independent talent pool or to other employers because of this integration. Youthall uses your Youthall account for its own services only under its own privacy policy.
• Authorities — where the law requires disclosure.

Hireall staff access candidate data only when needed to provide support requested by the employer or to investigate a security issue, and such access is recorded.

Your data is hosted in the European Union, in the Amazon Web Services Frankfurt region, encrypted in transit and at rest. Each employer's data is logically isolated from every other employer's. Access is role-based and every significant action on your record is written to an audit log. Hosting location is not the whole picture: authorised Hireall personnel access production systems remotely from the United Kingdom and from Türkiye for support, security and engineering, and some providers process data in other countries, including the United States, as stated on the Sub-processors page. Where a sub-processor processes data outside the UK or the EEA, including our affiliate Youthall in Türkiye, we use approved transfer mechanisms: the EU Standard Contractual Clauses and, for Youthall, the UK transfer instrument recorded in the executed Hireall–Youthall intra-group agreement (the UK IDTA or the UK Addendum, as that agreement records). A copy identifying which UK instrument is in force is available on request from privacy@hireall.com. Hireall does not currently hold ISO 27001 or SOC 2 certification.

The employer decides how long to keep your application, within the limits of the laws that apply to it, and can have your record deleted or anonymised at any time by instructing Hireall; we carry out such instructions promptly (normally within five business days, at the latest within 30 days, and always within the time the law gives the employer to answer you). If a shorter period applies, that shorter period comes first. To withdraw an application, tell the employer; it decides under its own rules whether the record is deleted or kept for the period its notice describes. Video-interview recordings are deleted after 60, 90 or 365 days depending on the employer's subscription. When an employer's Hireall subscription ends, the employer has 30 days to export its data; we then delete or anonymise the data from active systems, normally within a further 30 days and at the latest within 60 days, and backup copies are overwritten within a further 90 days without being used for ordinary processing. Only a specific record that a legal obligation or a live legal matter requires is kept longer, and only for that purpose, with restricted access; a retention duty for one type of record does not keep the rest of your application. Deleting your application with an employer does not delete a Youthall account you hold independently; that account is governed by Youthall's own privacy policy.

Depending on where you live, you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw consent you have given (including under the GDPR, the UK GDPR, KVKK Article 11 and, where it applies, the CCPA). Rights about automated decisions are not the same everywhere; they are described in the AI section above, and you can always ask the employer for a human review of an assessment that used AI. You also have the right to complain to a supervisory authority: in the UK the Information Commissioner's Office, in the EEA the authority where you live or work, in Türkiye the Personal Data Protection Authority.

To exercise these rights, contact the employer using the details in its privacy notice or on its career page. If you write to privacy@hireall.com instead, we will forward your request to the employer within two business days and let you know; we cannot act on the employer's data ourselves without its instruction, except where the law requires us to.

If you believe Hireall itself has mishandled your data, you can complain to us at privacy@hireall.com or through the form at hireall.com/resources/ticket. We acknowledge complaints within 30 days and tell you the outcome without undue delay; this does not affect your right to go to a supervisory authority.

Career pages, application forms, the personal privacy page and video-interview pages use only strictly necessary cookies to keep your session secure. We do not load analytics or advertising tags on these pages, so no information about your application is sent to an analytics or advertising provider. Icons, and a font the employer may have chosen for its page, are loaded from content-delivery networks that receive your IP address only to deliver the file and set no cookies. Where a job offers "Apply with Youthall" and you click that button, a Youthall window opens so you can sign in; Youthall's own cookie and privacy policies then apply on that window. See our Cookie Policy.

We update this notice when the service or the law changes; the date at the top shows the latest revision. The employer's own notice may change independently.