Candidate Privacy Notice

Introduction

This Candidate Privacy Notice explains how your personal data is processed when you apply for a job through, or are approached by, a company using the Atlast recruitment platform. It applies to all candidates whose data is processed through Atlast, regardless of which company you applied to or were contacted by. If the company you are applying to does not have its own candidate privacy notice, this notice serves as the applicable notice for that recruitment process.

Who is responsible for your data?

The company you are applying to (the “Employer”) is the data controller and is responsible for your personal data. The Employer determines what data is collected and how it is used.

Atlast Global Technologies, S.L. (“Atlast,” “we,” or “us”) provides the recruitment platform as a data processor. We process your data on behalf of the Employer, following their instructions.

If you have questions about how your data is being used for a specific job application, please contact the Employer directly.

About Atlast

Data Processor:

• Corporate Name: Atlast Global Technologies, S.L.
• Address: Avenida Eduard Maristany, 7, floor 5, door B, 08019, Barcelona, Spain
• Tax ID (CIF/NIF): B-24.844.326
• Registration Details: Registered in the Mercantile Registry of Barcelona, Volume/IRUS Number 1000461508346, Folio 1, Sheet B-645123, Entry 1
• Email: privacyandsecurity [at] this domain

What Personal Data We Process

When you apply for a job through a company using Atlast, the following types of personal data may be processed:

Application Information:

• Name, email address, phone number
• CV/resume and cover letter
• Work history, education, and qualifications
• LinkedIn profile or portfolio (if provided)
• Answers to application questions

Assessment Data (if applicable):

• Skills assessments or test results
• Interview recordings or notes
• Reference checks

Technical Data:

• IP address, browser type, device information (collected automatically when you use the platform)

The specific data collected depends on what the Employer has configured in their recruitment process.

Your personal data is processed for the following purposes:

By the Employer (Data Controller):

• To assess your suitability for the role
• To communicate with you about your application
• To conduct interviews and reference checks
• To make hiring decisions
• To comply with legal obligations (e.g., right-to-work checks, equal opportunity monitoring)

By Atlast (Data Processor):

• To provide the recruitment platform to the Employer
• To enable communication between you and the Employer
• To support AI-powered features like candidate matching or interview scheduling (only as instructed by the Employer)
• To maintain platform security and functionality

Important: Atlast does not make hiring decisions. All employment decisions are made by the Employer.

Legal Basis for Processing

The Employer processes your data based on:

• Legitimate interest in assessing candidates for employment (GDPR Art. 6(1)(f))
• Performance of a contract if you are offered and accept a position (GDPR Art. 6(1)(b))
• Legal obligation where required by employment law (GDPR Art. 6(1)(c))
• Consent for specific purposes where requested (e.g., future job opportunities)

If You Were Approached (Outbound Candidates)

If you were contacted by a company using Atlast as part of a proactive sourcing process — rather than applying directly — your profile may have been found through publicly available sources such as LinkedIn before you were contacted.

This initial processing, finding your profile and assessing potential fit for a role, is carried out on the basis of legitimate interest (GDPR Article 6(1)(f)): specifically, the Employer’s legitimate interest in identifying suitable candidates for open roles.

When we reach out, you will receive a link to this notice and be asked to confirm your interest and provide consent before any further processing takes place. You can decline at any time. If you decline or do not respond, your data is not retained.

If you have questions about how your profile was found or assessed before contact was made, contact the Employer directly or reach us at privacyandsecurity [at] this domain .

How Long Your Data Is Kept

Automatic Deletion: Candidate data is automatically deleted 90 days after the role is closed unless the Employer has a legitimate reason to retain it longer (e.g., legal requirements or with your consent for future opportunities).

Before Automatic Deletion: The Employer can export or manually delete your data at any time through their Atlast account.

If You Are Hired: Your data may be transferred to the Employer’s HR systems and retained in accordance with employment law and the Employer’s retention policies.

Who Has Access to Your Data

The Employer: The company you applied to has full access to your application data.

Atlast: Our authorized personnel may access your data only to provide technical support, maintain platform security, or as required by law. We do not use your data for our own purposes.

Subprocessors: We use trusted third-party service providers to operate the platform, including:

• AWS (cloud hosting)
• OpenAI (AI functionality, with privacy protections)
• Other service providers as listed on our Trust & Data page

All subprocessors are bound by strict data protection obligations.

International Transfers: Your data may be processed outside the European Economic Area (EEA) or United Kingdom. Where this occurs, appropriate safeguards are in place, such as:

• EU Standard Contractual Clauses (SCCs)
• UK International Data Transfer Addendum (for UK candidates)
• Adequacy decisions

Your Rights Under GDPR

As a candidate, you have the following rights:

Right of Access (Art. 15 GDPR) You can request a copy of the personal data held about you.

Right to Rectification (Art. 16 GDPR) You can request correction of inaccurate or incomplete data.

Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR) You can request deletion of your data in certain circumstances (e.g., if you withdraw your application).

Right to Restriction of Processing (Art. 18 GDPR) You can request that processing be limited in certain situations.

Right to Data Portability (Art. 20 GDPR) You can request your data in a machine-readable format.

Right to Object (Art. 21 GDPR) You can object to processing based on legitimate interests, including profiling carried out on the basis of legitimate interest — for example, if your profile was assessed before you were contacted. You can also object to profiling carried out to evaluate your suitability for a role at any stage of the process.

Right to Human Review and to Contest AI Assessments (Art. 22 GDPR) If an AI-assisted assessment has been carried out on your application or profile, you have the right to request that it be reviewed by a human with authority to override the output, to express your point of view about the assessment, and to contest the outcome. To exercise this right, contact the Employer directly. If you cannot reach the Employer, contact us at privacyandsecurity [at] this domain .

Right to Withdraw Consent If processing is based on your consent, you can withdraw it at any time.

Right to Lodge a Complaint You can complain to a data protection supervisory authority:

• Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
• UK: Information Commissioner’s Office (ICO) — www.ico.org.uk
• EU: Your local data protection authority

How to Exercise Your Rights

Step 1 — Contact the Employer. The company you applied to or were approached by is the data controller and is responsible for responding to your request within 30 days. Where possible, direct your request to them first.

Step 2 — Contact Atlast. If you cannot reach the Employer, or your request has not been actioned within 35 days, contact us at privacyandsecurity [at] this domain with the subject line “Candidate Data Request.” To allow us to locate and verify your data correctly, please include:

• Your full name
• The company you applied to or were contacted by
• The role title you applied for or were approached about
• The email address used during the process

We may ask for additional information if needed to verify your identity before actioning your request. Where a deletion request has been escalated to us and remains unactioned by the Employer after 35 days of verification, Atlast will delete your data directly from the platform.

Supervisory authority. If you are not satisfied with how your request has been handled, you have the right to lodge a complaint with your local data protection authority. In Spain: AEPD (www.aepd.es). In the UK: ICO (www.ico.org.uk). In other EU countries: your national data protection authority.

How We Protect Your Data

Atlast implements industry-standard security measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security assessments and monitoring
• Employee confidentiality agreements and training

For more information, see our Security & Data Protection Overview.

AI and Automated Decision-Making

AI, Scoring and Automated Processing

How CV scoring works: If the Employer has enabled CV scoring, your application or profile may be scored against the role. The scoring criteria — for example, how much weight is given to relevant experience or qualifications — are configured by the Employer. The AI applies those criteria to your profile and produces a score. A member of the hiring team reviews all scored results before any decision about your application is made.

This is profiling under GDPR Article 4(4) — automated processing of personal data to evaluate aspects of your professional profile. You have the right to object to this processing (see Your Rights above).

Other AI-assisted features: AI may also assist with interview scheduling, workflow automation and communication. These features do not produce assessments of your suitability for a role.

No automated final decisions: Atlast AI does not make hiring decisions. All final decisions are made by humans at the Employer. The platform is not intended to carry out fully automated decision-making with legal or similarly significant effects within the meaning of GDPR Article 22.

EU AI Act: Atlast operates as a provider of high-risk AI under Regulation (EU) 2024/1689 (the EU AI Act). Recruitment AI systems are classified as high-risk under this regulation. Atlast maintains technical documentation for its AI systems and will be registered in the EU public AI database in accordance with applicable deadlines.

Changes to This Notice

We may update this Candidate Privacy Notice from time to time. The “Last Updated” date at the top will reflect any changes.

Material changes will be communicated to candidates through the platform or via the Employer.

Questions or Concerns?

For questions about your specific application: Contact the Employer you applied to directly.

For questions about how Atlast processes candidate data:
Email: privacyandsecurity [at] this domain
Address: Avenida Eduard Maristany, 7, floor 5, door B, 08019, Barcelona, Spain