GDPR and privacy

What each part of Settings, GDPR and privacy does, how retention policies work, and which privacy and consent wording candidates see.

Go to Settings, then Compliance, then GDPR & Privacy. The page has three tabs: deletion requests, retention policies and warnings. Only System Admins and HR users can open it or change anything on it. Members, Agency users, hiring managers and interviewers do not see it in the settings menu.

Recording consent, exporting one candidate's data and raising a deletion request from a candidate's profile are covered in the article Candidate data rights: export, deletion and consent.

The summary tiles

Three tiles sit above the tabs. Pending Deletion Requests counts requests that have not yet been actioned. Retention Warnings counts candidates who will reach a retention limit within 30 days. Active Policies counts every retention policy you have created, including ones with Auto-Delete switched off. The same numbers appear as badges on the Deletion Requests and Warnings tabs.

If your organisation is part of a group and you have been given access to other companies in it, a company selector appears at the top of each tab. Choose a company to see and manage its requests, policies and warnings.

Deletion Requests

This tab lists every deletion request with the candidate's name and email, the date Requested, the Status, the Scope and the Scheduled Deletion date. Scope is either All applications or This application, and a single-application request also shows the job it relates to, for example "Target: Payroll Assistant". A request for one application erases only that application when the nightly run carries it out. The candidate's other applications are left alone.

The statuses are Pending, In Progress, Completed, Rejected and Cancelled. Pending requests have a Cancel button. A request that stopped part way through shows In Progress with a Retry button. Select it and confirm to finish the erasure. Other statuses have no button.

There is no approval step. A pending request is carried out automatically by Recruit's nightly run once seven days have passed since it was requested, and the date it will happen is shown under Scheduled Deletion. The seven days are your window to check that the request is genuine.

To stop a request:

Find the request and select Cancel on its row.
In the Cancel Deletion Request window, add a Cancellation Reason (optional). It can be up to 2,000 characters.
Select Cancel again to confirm.

The request moves to Cancelled and the candidate's data is left alone. A request that is no longer pending cannot be cancelled. If deletion is wanted later, a new request has to be raised.

When the seven days pass, the candidate is anonymised and the request shows Completed. This cannot be undone. What anonymisation removes and keeps is described in Candidate data rights: export, deletion and consent.

Agency application drafts

Below the requests table, an Agency application drafts card deletes drafts that an agency started on a candidate's behalf and never submitted. Use it when the person has no candidate record to raise a deletion request against.

Enter the person's Email address.
Select Erase drafts.
In the Erase agency drafts? box, confirm. Every unsubmitted agency draft for that address is deleted with its answers and uploaded files. This cannot be undone.

A message such as "2 agency drafts erased" confirms how many were removed. The card appears for your own company only, not when you have another company selected. Drafts that nobody saves for 90 days are also deleted automatically.

Retention Policies

A retention policy sets how long candidate data is kept. The tab lists your policies, each showing its name, the number of days, what it applies to, and an Auto-Delete badge where that is on.

Creating a policy

Select New Policy.
Enter a Policy Name, up to 255 characters. It is required.
Set the Retention Period (days). It starts at 365 and accepts whole numbers from 1 to 3,650.
Choose what it Applies To: All Candidates, Rejected Candidates, Withdrawn Candidates or Audit Logs.
Switch Auto-Delete on if Recruit should delete candidates automatically. It is off by default.
Select Save.

Rejected Candidates matches only people whose applications are all rejected. Withdrawn Candidates matches only people whose applications are all withdrawn. A candidate with a mix of statuses is matched only by an All Candidates policy.

Use Edit on a policy to change any of these settings. The bin icon deletes a policy after you confirm "Are you sure you want to delete this retention policy?". Deleting a policy stops future deletions under it. It does not restore anyone already anonymised.

What the nightly run does

Every night Recruit checks each policy on its own. A candidate is due when their last activity is older than the retention period. Last activity is the most recent real activity on any of their applications, or the date their record was created if they have never applied. Real activity means the candidate applying or submitting, your team changing a stage, status or sub-status, the candidate editing their application, or the automatic rejection run. Repairs and imports done by the system do not count, so a candidate whose record was only touched that way is dated from their last genuine activity. This means candidates who were brought across from the previous system long ago and have been idle since can now fall due.

Due candidates are anonymised only where the policy has Auto-Delete on, so with several policies a candidate goes as soon as any Auto-Delete policy that matches them falls due. With Auto-Delete off, nothing is deleted, and no warning emails go out either.

An Audit Logs policy works on the audit log rather than on candidates: entries older than its period are removed. If you have no such policy, entries older than 365 days are removed anyway. Leave Auto-Delete off on an Audit Logs policy, because the switch has no bearing on the audit log.

Warnings

This tab lists candidates who will reach the limit of a policy within 30 days, soonest first. Each card shows the candidate's name and email, the date of their last activity, the policy that applies and a badge such as "12 days remaining". It shows candidates under any of your policies, whether or not Auto-Delete is on. When nothing is close to a limit, the tab reads "No retention warnings at this time."

Each card has two buttons. Export downloads that candidate's data straight away as a raw data file named after them, for example jane-smith-dsar-export.json, and shows "Data export started for Jane Smith." If you want the PDF or Excel version, use the export on the candidate's Governance tab. Delete asks you to confirm, then raises a deletion request for all of that candidate's applications. It appears on the Deletion Requests tab as Pending with a scheduled date seven days ahead, and can be cancelled there until then.

Emails candidates receive

For policies with Auto-Delete on, candidates in the 30 day window are emailed once before deletion, using the Retention Warning email template. The email is sent only if your organisation has that template. Without it, candidates are not warned, though deletion still goes ahead.

Candidates whose consent is close to 12 months old are emailed using the Consent Expiry template. That is a reminder only and does not trigger deletion. Both templates are edited with the other email templates.

Privacy policy and consent wording

Candidates are linked to HireRoad's privacy policy unless a System Admin enters your own under Settings, then Company, then Careers Page, in the Legal section. The full steps, the places the link appears and how to hide the footer link are in the article Cookies and consent. Nothing on the GDPR & Privacy page changes which policy candidates see.

The consent wording is fixed and cannot be edited. Candidates see these tick boxes, each with the words "privacy policy" linking to the policy:

On the application form: "I consent to my data being processed for the purposes of this job application, in accordance with the privacy policy." Candidates cannot submit, or continue after saving and returning, without ticking it. Otherwise they see "You must consent to data processing to submit your application."
When registering interest without applying for a job: "I consent to my personal data being stored and processed so that this organisation can contact me about future opportunities, in accordance with the privacy policy." Without it they see "You must consent to data processing to submit your details."
When an agency completes an application for a candidate, the agency ticks "I confirm the candidate has consented to their data being processed for the purposes of this job application, in accordance with the privacy policy." The agency cannot submit without it.

Candidates can also ask for their own data to be deleted from the manage link for their application. That request covers only that application and lands in the same Deletion Requests tab.

What is set here and what is set on a candidate

On this page: how long data is kept for whole groups of candidates, whether it is deleted automatically, whether a deletion request goes ahead or is cancelled, and erasing agency drafts.
On the candidate's Governance tab: their individual consent choices, their data export in PDF or Excel, and raising a deletion request for that one person.
On the careers page settings: which privacy policy candidates are linked to.
On the email templates: the wording of the Retention Warning and Consent Expiry emails.