Atlast Request a demo

Candidate Privacy Notice

Last updated: September 2026 · Effective date: September 2026

Introduction

This Candidate Privacy Notice explains how your personal data is processed when you apply for a job through, or are approached by, a company using the Atlast recruitment platform. It applies to all candidates whose data is processed through Atlast, regardless of which company you applied to or were contacted by. If the company you are applying to does not have its own candidate privacy notice, this notice serves as the applicable notice for that recruitment process.

Who is responsible for your data?

The company you are applying to (the “Employer”) is the data controller and is responsible for your personal data. Atlast Global Technologies, S.L. provides the recruitment platform as a data processor, processing your data on behalf of the Employer. If you have questions about how your data is being used for a specific application, contact the Employer directly.

About Atlast

  • Data Processor: Atlast Global Technologies, S.L.
  • Address: Avenida Eduard Maristany, 7, floor 5, door B, 08019, Barcelona, Spain
  • Tax ID: B-24.844.326
  • Email: privacyandsecurity [at] this domain

What Personal Data We Process

Application Information

  • Name, email address, phone number
  • CV/resume and cover letter
  • Work history, education, and qualifications
  • LinkedIn profile or portfolio (if provided)
  • Answers to application questions

Assessment Data (if applicable)

  • Skills assessments or test results
  • Interview recordings or notes
  • Reference checks

Technical Data

  • IP address, browser type, device information (collected automatically when you use the platform)

Legal Basis for Processing

  • Legitimate interest (Art. 6(1)(f)): assessing candidates for employment
  • Performance of contract (Art. 6(1)(b)): if you are offered and accept a position
  • Legal obligation (Art. 6(1)(c)): where required by employment law
  • Consent (Art. 6(1)(a)): for specific purposes where requested, e.g. future opportunities

If You Were Approached (Outbound Candidates)

If you were contacted by a company using Atlast as part of a proactive sourcing process, rather than applying directly, your professional profile was obtained from licensed third-party professional data providers. These providers compile professional information (such as job titles, employers, work history, education and skills) from publicly available professional sources and license it for recruitment purposes. Where contact details were needed to reach you, they were obtained from the same category of provider. You can request the specific source of your data at any time by contacting us.

This initial processing, finding your profile and assessing potential fit for a role, is carried out on the basis of legitimate interest (Art. 6(1)(f)): specifically, the Employer’s legitimate interest in identifying suitable candidates for open roles.

When we reach out, you will receive a link to this notice and be asked to confirm your interest and provide consent before any further processing takes place. You can decline at any time. If you decline or do not respond, your data is not retained.

How Long Your Data Is Kept

Rejected applications are automatically and permanently deleted 90 days after rejection, unless the Employer has a legitimate reason to retain them longer (for example, a legal requirement) or you have consented to be considered for future opportunities. Other applications are kept until the Employer deletes them. The Employer can export or delete your data at any time through their Atlast account, and you can request deletion at any time. If you are hired, your data may transfer to the Employer’s HR systems in accordance with employment law.

When an application is deleted, your profile, CV and attached files, and interview recordings and transcripts are deleted immediately. Any remaining copies, such as encrypted backups and data temporarily held by our AI providers, expire automatically within 90 days at most.

Extended retention beyond 90 days is only permitted with your explicit consent, which you can provide via the candidate portal. You can withdraw this consent at any time.

Who Has Access to Your Data

  • The Employer: full access to your application data
  • Atlast: authorised personnel only, for technical support and platform maintenance
  • Subprocessors: AWS (cloud hosting, EU), OpenAI and Anthropic (AI functionality, with privacy protections), and other service providers as listed on our Trust & Data page

International Transfers: Your data may be processed outside the EEA. Where this occurs, safeguards are in place including EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum.

Third-Party Partner Offers

The candidate portal may display optional offers or links from selected third-party partners, such as CV review, career support or similar services.

  • Atlast does not share, transfer or sell any of your personal data to these partners.
  • Atlast does not track or record whether you click on a partner link.
  • Clicking a partner link is entirely voluntary and takes you to the partner’s own website.
  • Any information you give a partner is governed by that partner’s own privacy policy and terms. Atlast is not responsible for how the partner processes it.
  • Atlast may receive a commission or referral fee if you use a partner’s service. The partner tracks referrals through the link itself, which identifies Atlast as the referrer. The link contains no information about you.
  • Using or not using a partner offer has no effect on your application or any hiring decision.

Your Rights Under GDPR

  • Right of Access (Art. 15): Request a copy of your personal data
  • Right to Rectification (Art. 16): Request correction of inaccurate data
  • Right to Erasure / Right to be Forgotten (Art. 17): Request deletion in certain circumstances
  • Right to Restriction of Processing (Art. 18): Request limited processing in certain situations
  • Right to Data Portability (Art. 20): Request your data in a machine-readable format
  • Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling carried out on the basis of legitimate interest or to evaluate your suitability for a role
  • Right to Withdraw Consent: Withdraw at any time without affecting prior processing
  • Right to Human Review and to Contest AI Assessments (Art. 22): Request human review of any AI-assisted assessment, express your point of view, and contest the outcome
  • Right to Lodge a Complaint: Spain: AEPD (www.aepd.es) | UK: ICO (www.ico.org.uk) | EU: your national authority

How to Exercise Your Rights

Step 1: Contact the Employer. The company you applied to or were approached by is the data controller and is responsible for responding to your request within 30 days.

Step 2: Contact Atlast. If you cannot reach the Employer, or your request has not been actioned within 35 days, contact us at privacyandsecurity [at] this domain with the subject line “Candidate Data Request.” Please include:

  • Your full name
  • The company you applied to or were contacted by
  • The role title you applied for or were approached about
  • The email address used during the process

We may ask for additional information to verify your identity. Where a deletion request has been escalated to us and remains unactioned by the Employer after 35 days of verification, Atlast will delete your data directly from the platform.

How We Protect Your Data

  • Encryption of data in transit (TLS/SSL) and at rest (AES-256)
  • Access controls and authentication mechanisms
  • Regular security assessments and monitoring
  • Employee confidentiality agreements and training

AI, Scoring and Automated Processing

How CV Scoring Works

If the Employer has enabled CV scoring, your application or profile may be scored against the role. The scoring criteria, for example how much weight is given to relevant experience or qualifications, are configured by the Employer. The AI applies those criteria to your profile and produces a score. A member of the hiring team reviews all scored results before any decision about your application is made. This is profiling under GDPR Article 4(4). You have the right to object to this processing (see Your Rights above).

How AI-Conducted Interviews Work

If the Employer uses Atlast’s AI interviewer for a stage of the process, you will be told before the interview starts that it is conducted by AI. The interview is recorded and transcribed. The AI then produces a summary for the hiring team, including key strengths, gaps, points to follow up and notes for the hiring manager.

A member of the hiring team reviews the transcript and summary before any decision about your application is made. The AI does not use emotion recognition and does not analyse your facial expressions or tone of voice to assess you. This is profiling under GDPR Article 4(4). You have the right to object, request human review and contest the outcome (see Your Rights above).

Other AI-Assisted Features

AI also assists with interview scheduling and candidate communications. These features do not assess your suitability for a role.

No Automated Final Decisions

Atlast AI does not make hiring decisions. All final decisions are made by humans at the Employer. The platform is not intended to carry out fully automated decision-making with legal or similarly significant effects within the meaning of GDPR Article 22.

EU AI Act

Atlast operates as a provider of high-risk AI under Regulation (EU) 2024/1689 (the EU AI Act). Recruitment AI systems are classified as high-risk under this regulation. Atlast maintains technical documentation for its AI systems and will be registered in the EU public AI database in accordance with applicable deadlines.

Changes to This Notice

We may update this notice from time to time. The “Last Updated” date at the top will reflect any changes. Material changes will be communicated through the platform or via the Employer.

Questions or Concerns?

For questions about your specific application: contact the Employer directly.

For questions about how Atlast processes candidate data: