UK GDPR Privacy Notice
Effective Date: October 2026 • Compliant with UK Data Protection Act 2018 & UK GDPR
Key Transparency Summary
HireMatch AI processes recruiter and candidate information solely to automate applicant screening, semantic CV matching, and recruitment workflows. We do not sell personal data, we do not train external public AI models on your resumes, and you have enforceable rights to request data access, rectification, or complete erasure under UK law.
1. Data Controller & Contact Details
HireMatch operates as a Data Processor when acting on behalf of hiring organizations (employers and recruitment agencies) who upload candidate data, and as an independent Data Controller for account registration, platform security, and billing data.
For any questions regarding this Privacy Notice or to exercise your statutory rights under the UK GDPR, please reach our Data Protection team at: privacy@hirematch.ai.
2. Personal Data We Collect & Lawful Bases
| Category | Data Elements | Lawful Basis (Art. 6) |
|---|---|---|
| Recruiter / User Data | Name, work email, hashed passwords, organization name, role | Contract Performance (Art. 6(1)(b)) |
| Candidate Resume Data | Candidate name, email, phone, employment history, education, skills, parsed text | Legitimate Interests (Art. 6(1)(f)) & Explicit Consent (Art. 6(1)(a)) |
| AI Match Scores & Embeddings | Vector semantic representations, ATS fit percentages, recruiter review annotations | Explicit Consent (Art. 9 / Art. 22 safeguards) |
| System & Audit Logs | Masked IP addresses, browser user agent, login timestamps | Legal Obligation & Security (Art. 6(1)(c) / Art. 32) |
3. Automated Decision-Making & AI Profiling (Article 22)
HireMatch incorporates algorithmic ranking algorithms to compare candidate skill sets with job specifications. We implement strict safeguards under Article 22 UK GDPR:
- No Fully Autonomous Rejections: All automated fit scores and rankings serve as decision support tools. A qualified human recruiter or hiring manager makes all final shortlisting and interview decisions.
- Human Override: Recruiters have built-in decision gates (
recruiter_decision) to override algorithmic recommendations with custom notes. - Right to Explanation: Candidates can request meaningful information concerning the logic behind their automated match scoring.
4. Third-Party Sub-Processors & International Data Transfers
We host cloud infrastructure in the United Kingdom (AWS London eu-west-2). When external AI inference services (e.g. OpenAI or Google) process data across international borders, transfers are protected under UK International Data Transfer Agreements (IDTA) or European Commission Standard Contractual Clauses (SCCs).
Review our live list of third-party vendors and transfer safeguards at our dedicated Sub-processors & Data Transfer Register →
5. Data Retention & Deletion Policy
We retain candidate information only as long as necessary for active recruitment processes:
- Candidate resumes and derived vector embeddings are retained for a maximum of 180 days from upload unless active candidate consent is renewed.
- Recruiter accounts and logs are retained for the duration of the organization’s active subscription.
- Upon receiving a verified Right to Erasure request, all related files, extracted texts, and database records are permanently purged via cascading hard deletion.
6. Your Statutory Rights (UK GDPR Articles 15-22)
Under UK data protection law, you hold the following rights without charge:
To exercise any of these rights, contact us at dpo@hirematch.ai. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.