Legal
Privacy
Recrutar processes candidate data for the organisation that uses it. That organisation decides what is collected and how long it is kept. We decide what the software can do with it, and it refuses a great deal.
This page is a summary
Who is responsible for the data
For candidate data, the hiring company is the controller and Recrutar is a processor acting on its documented instructions. For the accounts of the recruiters who use the product, we are the controller of the small amount of data that requires — name, work email, and what they did in the product.
What data is processed
Applications and CVs brought across from the hiring company’s own systems, the text extracted from those documents, job descriptions and the requirement scorecards read from them, interview and test responses, and the record of decisions made about each candidate. Where the company turns on outside search, it also includes professional profiles from a licensed database, kept to a name, a location, a profile link, a headline and summary, work history, skills, education and a work email: never a demographic, a personal email or a phone.
What is never guessed
Gender, ethnicity, religion, nationality and age are not inferred anywhere in the product. There is no path from scoring to that data, which is why no special-category data is manufactured by inference. Where a candidate volunteers demographic information to Recrutar, it is stored apart from anything scoring can reach and is read only by the aggregate fairness report. What the hiring company’s own HR system recorded on its application form is shown only on that candidate’s page, to the company’s recruiters and admins. Otherwise only the aggregate fairness report reads it, and it never reaches a filter, a score or a ranking.
Automated decisions
Ranking is automated; rejection is not, unless the hiring company deliberately turns it on. Every score decomposes into the requirements behind it and the exact lines from the CV that evidenced each one, so a candidate asking why can be answered from the record rather than from a reconstruction. See the AI transparency notice.
Candidate requests
Access, correction, erasure and objection are exercised with the hiring company, which is the controller. We support them in answering, and we do not hold candidate data outside the workspace it belongs to.
How long data is kept, and where
Retention follows the hiring company’s instruction. Where data is stored and processed is a deployment decision agreed in writing per customer rather than a claim made on this page.