Privacy policy for recruitment using Teamtailor
1. General
The service for handling recruitments and simplifying the hiring process (the "Service") is powered by Teamtailor on behalf of [Eficode entity name, business ID and address] ("Controller", "we", "us", etc.). It is important that the persons using the Service ("Users") feel safe with, and are informed about, how we handle Users' personal data in the recruitment process. We strive to maintain the highest possible standard regarding the protection of personal data. We process, manage, use and protect Users' personal data in accordance with this Privacy Policy ("Privacy Policy").
We are the controller in accordance with applicable privacy legislation, including Regulation (EU) 2016/679 ("GDPR") and applicable national laws. Users' personal data is processed for the purpose of managing and facilitating the recruitment of employees to our business.
2. Collection of personal data
We are responsible for the processing of the personal data that Users contribute to the Service, and of the personal data that we otherwise collect in connection with the Service.
When and how we collect personal data
We collect personal data directly from Users when Users:
make an application through the Service or otherwise, adding personal data about themselves either personally or by using a third-party source such as LinkedIn;
use the Service to connect with our staff, adding personal data about themselves either personally or by using a third-party source such as LinkedIn;
take part in interviews or other recruitment events with us, including calls and video meetings; and
provide identifiable data in the chat (provided through the website that uses the Service), where such data is relevant to the application procedure.
We may also collect data from other sources:
Sourcing. We may collect data about potential candidates from third-party services such as LinkedIn and from other public sources. Sourcing is performed manually by our employees or automatically in the Service.
Recommendations. Existing employees can recommend potential applicants and add personal data about them.
Recruitment partners. For certain roles, recruitment agencies and other partners may submit candidates to us.
Where national law requires the User's consent for collecting data from other sources, we will ask for it before collecting.
The types of personal data collected and processed
The categories of personal data that can be collected through the Service include names, contact details, pictures and videos, information from LinkedIn and other profiles that Users or others have provided, answers to questions asked during the recruitment process, titles, work history, education, notes from interviews, and other information that the User or others have provided through the Service. We collect and process only data that is relevant for the recruitment process.
Please do not include sensitive information (such as health information, religious or political beliefs, or personal identity numbers) or other information that is not needed for your application in your CV, application, chat messages or interviews.
Is providing personal data required?
Providing personal data is voluntary. However, we cannot process an application or consider a User for a position without the data needed to evaluate it, such as contact details, work history and education.
3. Purpose and legal basis of processing
The purpose of collecting and processing personal data is to manage recruitment: to evaluate applicants, to communicate with them, to make hiring decisions and, where a User has chosen this, to consider them for future positions.
The legal basis for this processing is our legitimate interest in simplifying and facilitating recruitment and in finding suitable people to join our business (Article 6(1)(f) GDPR). Where processing is necessary to take steps at a User's request before entering into an employment contract, the legal basis is Article 6(1)(b) GDPR. We have assessed that this interest is not overridden by Users' rights and freedoms, taking into account that Users apply for positions with the reasonable expectation that we will process their data for this purpose. Users have the right to object to processing based on legitimate interest (see Section 7).
We rely on the User's consent only where we specifically ask for it, for example to keep a User's data for future recruitment beyond the period in Section 5, or where national law requires consent for collecting data from other sources. A User can withdraw their consent at any time using the contact details in Section 13. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. Withdrawing consent given for a specific purpose will not affect an ongoing application unless that data is needed to process it.
Personal data that is processed for aggregated analysis or market research is made unidentifiable by anonymisation. Anonymised data cannot be used to identify a User and is therefore not considered personal data.
4. Storage and transfers
The personal data collected through the Service is stored and processed by Eficode or its suppliers inside the EU/EEA. Where data is processed outside the EU/EEA, we ensure that the transfer is lawful: either the country is considered by the European Commission to have an adequate level of protection (including, for US providers, certification under the EU-US Data Privacy Framework), or the supplier has entered into binding safeguards such as the EU Standard Contractual Clauses. To obtain documentation regarding such safeguards, contact us using the contact details in Section 13.
5. How long personal data is processed
We keep the personal data of applicants for a period of 2 years from the end of the recruitment process the data relates to, after which it is deleted or anonymised. A User can ask us to delete their data earlier at any time (see Section 7), and we will do so unless we need to keep it to establish, exercise or defend legal claims.
If a User wishes to be considered for future positions, we will ask for their consent to keep their data for a further 2 years and will ask again before each further extension. A User who does not give or withdraws this consent will not be considered for future positions, and their data will be deleted at the end of the period above.
Data about a User that we collected through sourcing, but who has not applied or replied to us, is deleted after 12 months unless the User has asked us to keep it.
Recordings, transcripts and notes from interviews are stored together with the application and are deleted at the same time (see also Section 6).
We may use a small number of AI-based tools to support our recruiters and interviewers with administrative tasks. These tools do not make hiring decisions.
What we use AI for
We use AI-assisted transcription and summarisation to produce notes from interviews and other recruitment calls. The tools we use are the AI note-taking features in Teamtailor and Google Gemini in Google Meet. We may also use AI to help draft job advertisements and interview materials, which does not involve Users' personal data.
What we do not do
We do not use AI to automatically accept, reject, rank or score candidates, or to make any decision that produces legal or similarly significant effects for a User. All recruitment decisions are made by people.
We do not use AI to analyse a User's voice, facial expressions, emotions or personality, or to infer sensitive characteristics about a User.
AI-generated notes and summaries are reviewed by the interviewer and are only one of the inputs to our assessment.
Calls with AI note-taking
If AI note-taking is used in a call, we will tell the User at the start of the call. A User can ask us to switch it off and take notes manually instead, and doing so will not affect their application in any way.
What data is processed and how it is protected
The tools process what is said in the call (audio and transcript) and the resulting summary. Transcripts and summaries are stored together with the application and deleted according to Section 5.
Our AI tool providers act as our processors under written data processing agreements and may process Users' data only on our instructions. They are not permitted to use Users' data to train their AI models. Data is processed within the EU/EEA.
Legal basis and Users' rights
We use these tools based on our legitimate interest in keeping accurate records of interviews and in allowing interviewers to focus on the conversation with the User. In addition to the rights in Section 7, a User can object to the use of AI tools in their interviews, ask for access to notes and transcripts about them, ask for them to be corrected, and ask for a human to review any matter concerning them.
7. Users' rights
Users have the following rights regarding their personal data. They can exercise them by contacting us using the details in Section 13; a request does not need to be in any particular form. We will respond without undue delay and in any case within one month.
Access. Users have the right to request information about the personal data we process about them and to receive one copy free of charge. For further copies we may charge a reasonable fee based on administrative costs.
Rectification. Users have the right to have inaccurate or incomplete personal data about them corrected.
Erasure and restriction. Users have the right to request deletion or restriction of processing in the circumstances set out in the GDPR.
Objection. Users have the right to object to processing based on legitimate interest, on grounds relating to their particular situation. This includes objecting to being considered for future positions and to the use of AI tools described in Section 6.
Withdrawal of consent. Users have the right to withdraw any consent they have given. This may mean that the User can no longer be considered for a specific position or for future positions.
Data portability. Users have, in certain circumstances, the right to receive their personal data and transfer it to another controller, as long as this does not negatively affect the rights and freedoms of others.
Complaint. Users have the right to lodge a complaint with the supervisory authority if they consider that the processing of their personal data infringes data protection law.
8. Security
We prioritise personal integrity and work actively to make sure that Users' personal data is processed with the utmost care. We take appropriate technical and organisational measures to ensure that personal data is processed securely and in accordance with this Privacy Policy, the GDPR and other relevant privacy legislation, including access controls, encryption and written agreements with our processors.
It is also important that Users take responsibility for the protection of their own data, for example by keeping their login information secret.
9. Sharing of personal data with third parties
We do not sell Users' personal data. We share it only with the recipients described below, and only to the extent necessary.
We may share Users' personal data with:
our contractors and sub-contractors, acting as our processors and sub-processors in accordance with our instructions, for the provision of the Service;
authorities, legal advisors or other parties where we are required to do so by law or an authority's injunction, or where this is necessary to establish, exercise or defend legal claims.
We carefully choose partners to ensure that Users' personal data is processed in accordance with applicable privacy legislation, and we have entered into written agreements with all our processors, ensuring their and their sub-processors' compliance with our requirements and with the law. We cooperate with the following processors:
Teamtailor, which supplies the Service, and its server and hosting providers, e-mail and reference providers, video processing providers, information-sourcing providers, analytics providers and other providers needed to supply the Service;
Google, whose Workspace services (Google Meet and Gemini) we use for interviews and AI-assisted note-taking, as described in Section 6;
Talogy, which performs candidate assessments, but only in certain recruitments and as stated in the related job advertisements.
10. Aggregated data (non-identifiable data)
We may share aggregated data with third parties. Aggregated data is compiled from information collected through the Service and can, for example, consist of statistics on internet traffic or the geographical location of Service use. It does not contain any information that can be used to identify individual persons and is therefore not personal data.
11. Cookies
When Users use the Service, information about the usage may be stored as cookies. Cookies are small text files that are stored in the internet browser on the User's device, such as a computer, mobile phone or tablet. We use cookies to improve the User's experience of the Service and to gather statistics about its usage, in order to secure, maintain and improve the Service. Information collected through cookies can in some cases be personal data and is then regulated by our Cookie Policy.
Users can disable cookies at any time by changing the settings on their devices. Disabling cookies can affect the experience of the Service, for example by disabling some of its functions.
12. Changes
We reserve the right to make changes or additions to this Privacy Policy at any time. The latest version is always available through the Service, and the date of the latest update is shown at the top. We will inform Users who are in an ongoing recruitment process of material changes, for example by e-mail to the address they have given us.
For questions, further information about our handling of personal data, or to exercise your rights, please contact us at:
