GDPR Compliance
We are dedicated to maintaining the highest global standards of data privacy. Discover how HireNix ATS empowers your recruitment team to remain fully compliant with the General Data Protection Regulation (GDPR).
Processor Role
We act as a Data Processor, giving you (the Controller) complete ownership over candidate data.
Right to Erasure
1-click candidate PII scrubbing to instantly fulfill "Right to be Forgotten" requests.
Zero AI Training
Candidate records are processed ephemerally and never used to train public AI models.
1. Our Role Under GDPR
Under the EU General Data Protection Regulation (GDPR Regulation (EU) 2016/679), data responsibility is partitioned between two legal roles:
- Our Customers (Employers / Agencies): You act as the Data Controller. You determine the lawful basis for processing applicant data, set job requirements, and manage candidate communication.
- HireNix ATS: We act as the Data Processor. We provide the multi-tenant cloud software, security infrastructure, parsing models, and scheduling pipelines to execute your instructions strictly on your behalf.
2. Empowering Candidate Rights (Data Subjects)
GDPR grants European Economic Area (EEA) candidates comprehensive rights over their personal data. HireNix ATS provides automated tools for Data Controllers to fulfill these requests effortlessly:
- Right to Access & Portability (Art. 15 & 20): Data Controllers can export an exhaustive, machine-readable (JSON/CSV) file of a candidate's complete profile—including parsed resumes, interview evaluation notes, scorecard ratings, and communication logs.
- Right to Erasure / Right to be Forgotten (Art. 17): Our built-in "Permanent PII Scrubbing" tool purges a candidate's name, email, phone number, resume files, and notes from all active databases and cloud storage buckets within seconds.
- Automated Data Retention Rules (Art. 5(1)(e)): Configure customized data retention thresholds per job or department (e.g., automatically deleting rejected applicant resumes after 12 months) unless explicit consent renewal is obtained.
3. Candidate Portals & Reschedule Security
When candidates interact with HireNix ATS features—such as viewing interview invitations, requesting reschedule time slots, or completing online assessments:
Candidate-First Privacy Architecture
We never place tracking cookies, advertising pixels, or analytics trackers on candidate reschedule or interview pages. All self-service actions are protected by cryptographic, short-lived tokens that prevent unauthorized access or data tampering.
4. Data Processing Agreement (DPA)
In full accordance with Article 28 of the GDPR, HireNix ATS provides an enterprise-ready Data Processing Agreement (DPA) for all customer organizations.
Our DPA incorporates the latest Standard Contractual Clauses (SCCs) authorized by the European Commission, ensuring lawful international data transfers with robust technical safeguards.
5. Sub-Processors & Zero-Retention AI
HireNix ATS partners exclusively with SOC-2 and ISO-27001 certified cloud infrastructure providers. When processing resume data through our AI models:
All candidate resumes and criteria matching tasks are processed through enterprise API endpoints that are legally bound to zero-retention policies. Candidate data is processed in-memory and permanently purged immediately after score calculation—never used to train public models.
6. Technical & Organizational Security (Art. 32)
HireNix ATS implements rigorous enterprise security protocols:
- Encryption at Rest & in Transit: AES-256 encryption at rest and TLS 1.3 cryptographic protocols in transit.
- Strict Tenant Partitioning: Logical Row-Level Security (RLS) guarantees that tenant workspaces remain strictly siloed.
- Mandatory 2FA: Multi-factor authentication required across all administrative staff accounts.
- 72-Hour Breach Notification: Incident response protocol ensuring prompt notification within statutory deadlines under GDPR Art. 33.
Data Protection Officer (DPO)
If you have questions regarding our DPA, sub-processors, or wish to exercise candidate data subject rights, please contact our DPO team.