If you run a recruitment agency, get six answers in writing before you upload a candidate CV to a formatting tool: who is controller and who processor, where the data goes and through whom, whether CVs train a model, how long they are kept, how deletion and export work, and how fast you hear of a breach. Check each against the vendor's data processing agreement (DPA), not its sales page. The email at the end puts all six to any vendor, and each section shows TalentVeil's answer.
After auditing providers of AI recruitment tools and making almost 300 recommendations to them, the UK regulator published guidance for recruiters buying such a tool: run a data protection impact assessment at procurement, and record in a contract who is controller and who is processor. A CV tool that uses AI to read candidate data raises the same questions: it reads names, contact details, work history and sometimes a photo.
1. Who is the controller, and is it in a contract?
You are. The candidate data in a CV is yours to decide about; the vendor processes it on your behalf. Under Article 28 of the GDPR that relationship needs a contract that sets out what is processed, for what purpose and for how long, and that obliges the vendor to process only on your documented instructions (Article 28 GDPR). Ask for the DPA before you sign up, not after.
TalentVeil: for the candidate data you upload, TalentVeil is the processor. The DPA limits processing to providing the subscription service (§1.2). You can download it as a PDF and read it before you upload a single CV.
2. Where is the data processed, and by which sub-processors?
"Hosted in Europe" is not an answer. Ask which companies touch the data, in which country, and what happens when that list changes. Article 28 lets a processor bring in another one only with your authorisation, and the contract should tell you in advance about any change.
TalentVeil: all candidate data is processed in the EU. The AI runs on an Azure AI instance in the Sweden region. The DPA's sub-processor list names two hosting providers: Microsoft (Azure, Gävle, Sweden) and OVH (Limburg, Germany). A new sub-processor is announced to you at least 30 days before it receives data (§4.3).
3. Is our candidate data used to train a model?
Ask whether CV content is used to train or improve any model, the vendor's or its AI provider's. Get the answer in writing: your clients' procurement teams will ask you.
TalentVeil: no. Customer data is not used to train models.
4. How long is the data kept, and who decides?
Look for a number, not "as long as necessary". Then ask whether you can change it. A retention period you cannot adjust is a policy you have to accept; one you can set is a policy you can match to your own records schedule.
TalentVeil: the default retention period is 12 months, and it can be adjusted for your organisation. Once it ends, the DPA requires deletion of the personal data from all data carriers, copies included, within 30 days (§9.1), and TalentVeil must ensure its sub-processors delete or anonymise it (§9.2).
5. Can you get data out, or deleted, when a candidate asks?
A candidate who asks you to delete or correct their data is asking you, not the vendor. You need the vendor to be able to act on your request.
TalentVeil: on your request, TalentVeil exports, deletes or restricts the processing of personal data and rectifies it (§5.1b). During the retention period you can also ask for deletion and for the data to be returned (§9.3).
6. What happens if something goes wrong?
Ask for a time limit in hours and for what the notification contains. As controller you must report a breach to the supervisory authority within 72 hours of becoming aware of it (Article 33 GDPR), and what you report you learn from the vendor.
TalentVeil: the DPA sets a limit of 36 hours from discovery (§6.1). The notice describes what happened and its causes, which data and how many people are affected, the likely consequences and the remedial steps taken to limit the harm.
What does my client see when I share a shortlist?
Candidate data leaves your hands again when you present a shortlist. In TalentVeil that happens through a branded shortlist link, and you control it:
- Your client sees only the profiles you put in the shortlist, anonymous or with candidate details, as you decide.
- No account is needed on their side. You can require an access code, set an expiry date and switch the link off at any time.
- PDF download, feedback and the original CV are each switched on or off by you for that link.
- In your own team, give anyone who only reviews profiles the hiring manager role: they see the profiles assigned to them without name and contact details.
To send a client less than the full CV, a Blind CV leaves out the details they do not need.
Send this before you upload anything
Paste it into an email to each vendor on your shortlist and put the answers next to the DPA:
Before we upload candidate CVs, please confirm in writing: (1) that we are the controller and you are the processor, with a DPA we can read before signing up; (2) in which country our data is processed and which sub-processors, including your AI provider, receive CV content; how and when you tell us about a new one; (3) whether our candidate data is used to train or improve any model, yours or a third party's; (4) your default retention period and whether we can change it for our organisation; (5) how a deletion or export request is handled and how quickly, including copies held by sub-processors; (6) how soon you notify us of a personal data breach and what the notice contains.
A vendor that answers all six in a document you can keep is ready for your clients' procurement teams. One that answers some on a call and the rest "on request" leaves you holding the gaps. Put the answers next to the DPA and hand both to your data protection lead. For how TalentVeil handles candidate data end to end, see Security and GDPR. When you are ready to see it on your own CVs, start free with 10 profiles and every feature: upload a few CVs from your next shortlist, edit the profile, and send it to your client in a branded shortlist link.
