GDPR Rights & Compliance

Establish a Lawful Basis

You must have a valid legal basis for processing candidate data — typically legitimate interest for hiring purposes or, for EU candidates, explicit consent. You are responsible for documenting this basis.

Inform Candidates

You must inform candidates that their voice data will be recorded and processed by AI before they begin an assessment. SpeakSights provides an in-assessment consent screen; you should also include this in your job listing or invitation email.

No Special Category Data

Do not instruct candidates to discuss their health, ethnicity, religion, political views, or other special category data (GDPR Art. 9) in their responses. SpeakSights assesses communication skills only.

Handle Data Subject Requests

When candidates contact your organisation exercising GDPR rights (access, erasure, portability), you must act on them. SpeakSights will delete candidate data from our systems within 30 days of your written request.

Review Automated Analysis Responsibly

AI-generated scores must not be the sole basis for employment decisions. A human reviewer (your hiring team) must assess each candidate. SpeakSights scores are advisory, not determinative.

Verify the candidate's identity

Confirm the request is from the actual candidate (name, email, role they applied to).

Email privacy@speaksights.com

Subject: "Data Subject Request — [Org Name]". Include: candidate email, request type (access/deletion/portability), and your org admin email.

Receive confirmation within 48 hours

We will acknowledge receipt and provide an expected completion date (within 30 days per GDPR Art. 12).

Inform the candidate

Once SpeakSights confirms the action, relay the outcome to the candidate. You remain responsible for your own copies of their data (e.g., emails, internal notes).

Right of Access (Art. 15)

Request a copy of all data held about you including your audio recordings, transcripts, and AI scores.

Right to Erasure / "Right to be Forgotten" (Art. 17)

Request deletion of your assessment data. Audio is automatically deleted after 30 days by default; transcripts after 90 days by default. You can request earlier deletion at any time.

Right to Rectification (Art. 16)

Request correction of inaccurate personal data (such as your name or email if incorrectly entered by the organisation).

Right to Data Portability (Art. 20)

Request your data in a machine-readable format. We can provide your transcript and scores as a JSON file.

Right to Object (Art. 21)

Object to processing of your data if you believe the organisation did not have a lawful basis. This should be directed to the hiring organisation first.

Rights Related to Automated Decision-Making (Art. 22)

AI scores are not the sole basis for hiring decisions — a human reviewer (the hiring team) always reviews results. You have the right to request human review of any automated output.

Contact the organisation first

The organisation that invited you (the hiring company) is the Data Controller. Contact their HR or recruitment team. They are responsible for responding to your GDPR request within 1 month.

If the org doesn't respond within 30 days

Email privacy@speaksights.com with: your name, the email address used for the assessment, the organisation name, and your request type (access/deletion/portability). We will assist.

Escalate to your Data Protection Authority

If neither the organisation nor SpeakSights resolves your concern, you have the right to lodge a complaint with your national Data Protection Authority (e.g., ICO in the UK, DPC in Ireland, or EDPB for cross-border matters).