GDPR Compliance

For candidate and interviewer data we collect directly, HyreInsight acts as the data controller. We determine the purposes and means of processing this personal data.

When processing candidate data on behalf of our clients (hiring companies), we act as a data processor. Our clients are the data controllers and provide instructions on how to process this data.

We enter into Data Processing Agreements with all clients to ensure GDPR-compliant data processing. Our DPA includes:

• Subject matter and duration of processing
• Nature and purpose of processing
• Types of personal data and categories of data subjects
• Obligations and rights of the data controller
• Security measures and data protection safeguards
• Sub-processor provisions
• Data breach notification procedures

Processing necessary to perform our contract with you, including providing interview services, scheduling, and generating reports.

For interview recordings, marketing communications, and optional features. Consent is freely given, specific, informed, and unambiguous.

For fraud prevention, security measures, and improving our services, provided your rights and freedoms are not overridden.

To comply with legal requirements such as tax laws, data retention laws, and court orders.

You have the right to clear, transparent information about how we collect and use your personal data. Our Privacy Policy and this page provide this information.

You can request confirmation of whether we process your personal data and obtain:

• A copy of your personal data
• Information about processing purposes
• Categories of data being processed
• Recipients of your data
• Retention periods
• Your other GDPR rights

Response time: Within 1 month (extendable by 2 months for complex requests)

You can request correction of inaccurate or incomplete personal data. We will notify relevant third parties of corrections unless impossible or involves disproportionate effort.

Response time: Within 1 month

You can request deletion of your personal data when:

• Data is no longer necessary for its original purpose
• You withdraw consent and there's no other legal basis
• You object to processing and there are no overriding legitimate grounds
• Data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Exceptions apply when we must retain data for legal compliance, legal claims, or public interest purposes.

Response time: Within 1 month

You can request we restrict (but not delete) your data when:

• You contest the accuracy of data (restricted while we verify)
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you need it for legal claims
• You've objected to processing (restricted while we verify overriding grounds)

Response time: Within 1 month

You can receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and transmit it to another controller when:

• Processing is based on consent or contract
• Processing is carried out by automated means

This right applies only to data you provided to us, not derived or inferred data.

Response time: Within 1 month

You can object to processing based on:

• Legitimate interests: We must stop unless we demonstrate compelling legitimate grounds that override your interests
• Direct marketing: We must stop immediately upon objection
• Research purposes: Unless processing is necessary for public interest tasks

Response time: Within 1 month

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects, unless:

• Necessary for contract performance
• Authorized by EU or Member State law
• Based on your explicit consent

Note: Our interview evaluations are conducted by human interviewers, not automated systems. Any AI-assisted features are clearly disclosed and do not make final hiring decisions.

Where processing is based on consent, you can withdraw it at any time. Withdrawal doesn’t affect the lawfulness of processing before withdrawal.

Effect: Immediate upon receipt of withdrawal

You have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State where you reside, work, or where an alleged infringement occurred.

While we hope to resolve concerns directly, you can contact:

• Your local data protection authority
• The Irish Data Protection Commission (our lead supervisory authority in the EU)

Email: [email protected]

• Online Form: Use our Data Subject Request Form
• Account Settings: Some rights can be exercised directly through your account settings
• Mail: HyreInsight Inc., GDPR Requests, 123 Tech Street, San Francisco, CA 94105

To protect your privacy, we verify your identity before processing requests. Please provide:

• Full name and email address associated with your account
• Specific details about your request
• Additional verification information if needed (government ID, account information, etc.)

We will:

• Acknowledge your request within 72 hours
• Respond substantively within 1 month
• Extend by up to 2 additional months for complex requests (with explanation)
• Provide responses free of charge (unless requests are manifestly unfounded or excessive)

Process data lawfully, fairly, and transparently

Collect for specified, explicit, legitimate purposes only

Collect only adequate, relevant, and necessary data

Keep data accurate and up to date

Retain only as long as necessary

Ensure appropriate security and protection

We use EU Commission-approved Standard Contractual Clauses (2021/914) for transfers to countries without adequacy decisions.

We prioritize transfers to countries with EU adequacy decisions (UK, Switzerland, Japan, etc.).

We implement supplementary measures including encryption, pseudonymization, and strict access controls.

We detect and assess the breach within hours using automated monitoring and security protocols.

We notify relevant supervisory authorities within 72 hours of becoming aware of the breach (unless unlikely to result in risk to rights and freedoms).

We notify affected individuals without undue delay if the breach is likely to result in high risk to their rights and freedoms.

We maintain records of all data breaches, including facts, effects, and remedial actions taken.

• Name: Sarah Johnson, CIPP/E, CIPM
• Email: [email protected]

• Monitoring GDPR compliance
• Advising on data protection obligations
• Conducting Data Protection Impact Assessments (DPIAs)
• Serving as contact point for supervisory authorities
• Handling data subject requests

Annual security and privacy audits

Information security management certification

Full compliance with EU data protection laws

Now using Standard Contractual Clauses