Candidate Privacy Notice

1. Who This Notice Is For

This notice is for people whose personal data HeadHonta processes as part of a recruiter's hiring process. That includes you whether you applied directly to a role, were referred by someone, or were identified through professional or job-board sources when a recruiter was looking for suitable candidates.

You may be reading this because you received a message and weren't sure how we got your details, or because you want to know what information we hold and how to control it. This notice explains that in plain language, and — importantly — how to exercise your rights, including asking us to delete your data.

2. Who Is Responsible for Your Data

For candidates that a recruiter uploads or sources, the recruiter (the hiring organisation) is the data controller — they decide why and how your data is used for their hiring. HeadHonta acts as the processor, handling your data on that recruiter's instructions to provide our platform.

HeadHonta is the data controller for its own platform operations — for example, running and securing the service itself. Where a recruiter is the controller, we can help route your request to them.

3. What Data We Process

Depending on the source, we may process:

• Identity and contact details — name, email, phone, and location.
• CV / resume content — the information in your CV or profile.
• Employment and education history.
• Skills and related professional information.
• Application and pipeline status — where you are in a recruiter's hiring process.
• Interview recordings and transcripts, where applicable.
• Reference information — details provided by or about referees.

4. Where Your Data Comes From

• Directly from you — for example, when you submit an application or complete a reference form.
• From the recruiter — when a hiring organisation uploads or adds your details.
• From publicly available professional sources and job boards — when a recruiter sources candidates for a role.

5. Our Lawful Basis

The lawful basis for processing depends on how your data reached us, and HeadHonta records the lawful basis for each source:

• Direct applications — we rely on your consent and on taking steps at your request to enter into a contract (your potential employment).
• Sourced profiles — we rely on the recruiter's legitimate interest in recruitment, balanced against your rights and freedoms. You can object to this at any time (see your rights below).
• Legal obligation — where the law requires us to process certain data.

6. How Your Data Is Used

• Matching to roles — assessing how your experience fits open positions.
• AI-assisted CV analysis and scoring — to help recruiters review candidates more efficiently.
• Recruiter communications — enabling the hiring organisation to reach out about opportunities.

AI outputs are suggestions only. Humans make the hiring decisions. We do not make solely automated decisions that produce legal or similarly significant effects about you.

7. AI Processing

To provide matching and analysis, CV and profile text is processed through OpenRouter, an AI gateway that routes prompts to underlying model providers. AI-generated scores and summaries are aids for recruiters, not final decisions.

You can learn more about the providers involved in our Sub-processors list and about how we use AI in our AI Terms.

8. How Long We Keep Your Data

We keep your data for as long as the recruitment relationship requires it, or until you request erasure. Recruiters may also configure automatic purge windows, after which candidate data is removed.

Where a recruiter enables it, we delete the original copy of your uploaded CV after a set period, while keeping the information we extracted from it (such as your skills and experience) as part of your candidate profile.

9. Your Rights and How to Use Them

You have strong rights over your personal data, and we've made the most common ones self-service:

• Access and data export — you can export your data directly from the HeadHonta candidate portal.
• Erasure ("right to be forgotten") — you can request erasure from the candidate portal; the relevant organisations are notified.
• Rectification — you can correct your details through the portal.
• Object, restrict, or withdraw consent — including objecting to being sourced on the basis of legitimate interest.
• Unsubscribe — every non-essential email includes an unsubscribe link.
• Complaint — you may lodge a complaint with your local supervisory authority.
• Other requests, or no portal access — email privacy@headhonta.com. We respond within 30 days and may need to verify your identity first.

10. More Information

For full details on how HeadHonta handles personal data, see our Privacy Policy and Your Privacy Rights.