Hireall Technology ("Hireall") uses the third parties listed below to deliver the Hireall platform. Each acts on our documented instructions under a written contract that imposes data-protection and confidentiality obligations no less protective than our Data Processing Agreement, and each is covered by an appropriate transfer mechanism where data leaves the UK or the EEA. This page is Annex III of the DPA.
Stay informed. We give customers at least 30 days' notice before a new sub-processor processes customer data. Change notices are e-mailed automatically to the privacy contact set in your account (Settings → Compliance → "Legal notices from Hireall"); if none is set, we use your compliance contact or the account e-mail address. Questions: legal@hireall.com.
01Infrastructure and hosting
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the application, databases and search index; file and video storage; message queues for e-mail and notifications; encrypted backups | EU — Frankfurt (eu-central-1) | EU processing — no transfer instrument required |
| Cloudflare, Inc. | Bot verification (Turnstile) and network security services for public pages | EU / US | EU SCCs (Module Three) with the UK Addendum, or EU-U.S. Data Privacy Framework certification with UK Extension; transfer risk assessment on file |
02Product features (all customers)
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Google (Gemini API) | Large-language-model processing for AI features: CV parsing, match scoring, bulk matching, talent-pool search, job-post drafting and the consistency check on documents candidates upload, where the document is sent as an image or PDF. Data sent through the API is not used to train Google's models | US / EU | EU SCCs (Module Three) with the UK Addendum, or EU-U.S. Data Privacy Framework certification with UK Extension; transfer risk assessment on file |
| OpenAI (API) | Large-language-model processing for the same AI features when an OpenAI-backed model is selected. Data sent through the API is not used to train OpenAI's models | US / EU | EU SCCs (Module Three) with the UK Addendum, or EU-U.S. Data Privacy Framework certification with UK Extension; transfer risk assessment on file |
| Stripe Payments Europe Ltd | Subscription billing and card payments; Hireall does not store card numbers | EU (Ireland) / US | EU SCCs (Module Three) with the UK Addendum, or EU-U.S. Data Privacy Framework certification with UK Extension; transfer risk assessment on file |
| Tinify B.V. | Compression of images uploaded to the Service (company logos, cover images and job images) | EU (Netherlands) | EU processing — no transfer instrument required |
| Slack Technologies, LLC | Operational alerts for critical application errors, posted to Hireall's own engineering workspace; alerts carry record identifiers and technical error messages, not names or e-mail addresses | US | EU SCCs (Module Three) with the UK Addendum, or EU-U.S. Data Privacy Framework certification with UK Extension; transfer risk assessment on file |
03Affiliate: Youthall
Youthall is the talent-network platform operated by our affiliate STJ İnsan Kaynakları Bilişim ve Danışmanlık A.Ş. Candidates can apply to a Hireall job with a Youthall profile, and customers can publish jobs to the Youthall network and receive the resulting applications. Youthall is an authorised sub-processor under the Data Processing Agreement; customers authorise this sharing when they accept the Terms of Service. Where a candidate also holds a Youthall account, Youthall processes that account as a separate controller under its own privacy policy.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Youthall (STJ İnsan Kaynakları Bilişim ve Danışmanlık A.Ş.) | Receiving applications that candidates choose to make with a Youthall profile; publishing jobs to the Youthall talent network and receiving and exchanging the resulting applications where the customer enables that channel; joint support and fraud prevention. No customer data reaches Youthall unless one of those two things happens | Türkiye (EU SCCs, Module Three, and the UK transfer instrument recorded in the intra-group agreement) | EU SCCs (Module Three) and the UK transfer instrument recorded in the executed Hireall–Youthall intra-group agreement (UK IDTA or UK Addendum, as that agreement records); transfer risk assessment and supplementary measures |
04Website only (hireall.com)
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Usercentrics A/S (Cookiebot) | Cookie consent management | EU (Denmark) | EU processing — no transfer instrument required |
| Google Ireland Ltd (Google Analytics) | Website analytics, consent-based | EU / US | Marketing pages only, consent-based; EU SCCs with UK Addendum under Google's data-processing terms |
These providers process website-visitor data for which Hireall is the controller; they do not receive customer or candidate data from the Service. They are listed for completeness and described in the Cookie Policy.
05Services connected by customers (not sub-processors)
Customers can connect the services below from their own settings, using their own accounts or credentials. Each receives data on the customer's instruction and processes it under its own terms; they are the customer's processors or independent controllers, not Hireall sub-processors.
| Service | Data exchanged |
|---|---|
| Google for Jobs | Structured job-post data for search indexing (on by default; can be turned off per account) |
| LinkedIn, Indeed, Talent.com, Jooble, Adzuna | Job-post feed (title, description, location, apply link); candidates apply on the Hireall career page |
| Google Calendar and Google Meet | Interview events with participant names, e-mail addresses and meeting links |
| Microsoft Outlook Calendar and Microsoft Teams | Interview events with participant names, e-mail addresses and meeting links |
| Zoom | Meeting links created for scheduled interviews |
| Slack | Hiring notifications (candidate name, job, stage) posted to the customer's workspace |
| Spica Assessment | Assessment invitations and results, using the customer's own Spica credentials |
| HackerRank | Credential storage only; no data is exchanged today |
| TestGorilla, Codility | Assessment invitations and results, using the customer's own account with that provider: the candidate's name and e-mail address are sent to create the invitation, and the score or report is read back into the application |
| Personio, BambooHR, HiBob, Kolay İK | Human-resources systems. When a candidate is hired, the customer can have the record created in its own HR system: first name, last name, e-mail address, job title, department and start date are sent. Nothing is read back into candidate records |
| The customer's own webhook endpoint (directly, or through an automation service such as Zapier or Make) | Signed event messages the customer subscribes to, sent to an address the customer enters: application received, stage changed, hired, rejected, SLA warning, offer sent, accepted, declined or countered, scorecard submitted, video interview completed, assessment completed and HR-system record created. The message carries the candidate's first name, last name, e-mail address and telephone number, the job, the stage and the status |
| The customer's own identity provider (OpenID Connect single sign-on, for example Microsoft Entra ID, Google Workspace or Okta) | Sign-in only, and only for the customer's own users, never candidates: the provider returns the user's e-mail address, name and a subject identifier, together with what it states about how the user was authenticated. No candidate data is sent to the provider |
06Changes to this list
We review this list whenever we add, replace or remove a provider, and at least annually. New sub-processors are announced at least 30 days in advance as described in the DPA; customers may object on reasonable data-protection grounds within that period. The "Last updated" date above shows the latest change.
07Questions
Questions about a sub-processor, transfer mechanisms or this list: privacy@hireall.com.