Your candidate data remains yours.
Understandable data flows, limited access and human decisions. Principles for handling recruitment data responsibly.
BRAIN HRFrom source to decision.
- Relevant sources
- CV
- Job criteria
- Interview notes
- Evidence linked to the role
Connect job requirements to information in the candidate’s documents.
- The recruiter decides
Examine the sources and clarify what is missing before presenting a candidate.
A clear purpose for every piece of data.
Requesting a demonstration and analysing a CV serve different purposes. The information collected and the people who can access it should reflect each purpose.
On the public website
Contact details and company information, to answer your assessment or account request. No CV upload is requested.
In the application
Candidate documents, job criteria and recruitment work. A separate purpose, with its own permissions and processing rules.
Hosting, processing providers and any transfers must be assessed across the entire data journey, not just the screen where a document appears.
The right access. For the right person.
Working on a recruitment should not give someone access to every dossier. Company boundaries, roles and a need to know guide permissions.
- Limit each person’s access to their responsibilities.
- Separate workspaces and review permissions when responsibilities change.
- Govern support and processing-provider access too.
AI finds connections. You decide.
A match should be understandable: which requirement, which source, and what is still missing? The recruiter reviews these elements before presenting a candidate.
See how evidence is usedA source, not a verdict“Led the migration of an application to the cloud.”
What was your personal contribution to this project?A point to explore with the candidate
Keep data for a reason. Not by default.
Data that is useful today will not be useful forever. Retention depends on the processing purpose, the data category and applicable obligations.
When the need ends, delete what no longer needs to be kept. Any archive requires a justification, a defined period and restricted access.
Reference: CNIL — data retention principles- Recruitment purposeCompleted
- Documented reason to retainTo checkNoneApplicable obligation
No remaining justification
✓ Data deletedOnly where justified
✓ Access restricted · applicable period- 01Active use
Use the data for the stated recruitment purpose, for a defined period.
- 02Review
At the end of that period, assess whether a documented reason justifies further retention.
- 03End of use
Delete data that is no longer needed, or restrict access to a justified archive for its applicable period.
A candidate is a person. Not a score.
The recruiting organisation must inform candidates and enable them to exercise their rights under the conditions provided by law.
Read the privacy policy- Understand and access
- Know why personal data is processed and request access to it.
- Correct
- Have inaccurate information corrected or incomplete information completed.
- Have a request assessed
- Request erasure, restriction or object to processing where the relevant conditions are met.
The questions that matter.
Does this website ask for candidate CVs?
No. The assessment and account-request forms ask for business contact details and information about your needs. Candidate documents belong in the recruitment application, not in these forms.
Can an AI result replace the recruiter’s decision?
A match helps a recruiter review a profile. It does not establish that a candidate meets every requirement. Sources, missing information and points to clarify need to be considered before a decision.
Is there one retention period for every document?
No. The appropriate period depends on the purpose and data category. Active recruitment, a talent pool and a justified restricted archive are different uses. The applicable periods and deletion rules need to be documented.
Who handles a candidate’s rights request?
The organisation responsible for the recruitment is the first point of contact. It must inform the candidate about the applicable process. A request must be assessed under the conditions provided by law.
Start with your requirements.
Discuss access, processing providers and the data lifecycle with our team before planning your deployment.