AMISCON GLOBAL S.L. NIF B70862099, Valencia, Spain
Reference: HRBLADE-DP-001
This document sets out how personal data is processed in the HRBLADE hiring platform under Regulation (EU) 2016/679 (the GDPR). It covers the platform as a whole, including but not limited to its AI functions, and is a standalone statement: it does not depend on, and is not qualified by, any other document we publish.
The customer using HRBLADE to hire is the controller of candidate personal data. AMISCON GLOBAL S.L. is a processor acting on the customer's documented instructions.
Processing is governed by our Data Processing Agreement, which incorporates the requirements of Article 28. A copy is provided on request and is executed as part of the customer contract.
Data subjects are candidates who apply to, or are contacted for, a customer's vacancies, and the customer's own users of the platform.
Candidate data comprises identification and contact details, CV content, application answers, interview recordings and transcripts where those features are used, assessment results, and the scores and analyses produced by the platform's AI functions.
We do not collect gender, date of birth, age, nationality, ethnicity, religion, disability, marital status or any other special category of data as structured fields, and candidates are not asked for them. Where a CV contains such information in free text, it is processed as part of that text.
For customers served by AMISCON GLOBAL S.L., all customer and candidate data is stored in the European Union. The application servers, the database, the search index, the vector store and the object storage holding CVs, recordings and attachments are located in Amsterdam, the Netherlands.
The speech-to-text engine, the vector database and the search index run on our own infrastructure in the same location.
The current list of sub-processors, with the role and jurisdiction of each, is maintained at hrblade.com/trust/subprocessors and is provided as part of our Data Processing Agreement. We notify customers before adding a sub-processor that processes candidate data, so that the customer may exercise any objection right in the Data Processing Agreement.
Text sent to our AI model vendor for analysis may be processed outside the European Economic Area. Where that is the case, the transfer is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914) together with a transfer impact assessment and, where the vendor is certified, by the EU-US Data Privacy Framework.
Vendor terms exclude API inputs and outputs from model training. Candidate data is not used to train, fine-tune or improve any model.
Default retention periods, all configurable per customer:
Deletion runs automatically on a daily schedule.
Erasure requests are processed on a daily schedule and remove the CV, transcripts, AI analyses, scores, embeddings and vectors, not only the profile row.
The AI decision log stores a cryptographic digest of the assessed material rather than the material itself, so the record of a decision survives erasure of the candidate's personal data without retaining that data.
Requests for access, rectification, erasure, restriction, portability or objection reach the customer as controller. As processor, we make available the data and the underlying decision record the controller needs in order to respond within the statutory period, and we assist with the request as required by Article 28(3)(e).
Where a candidate asks why a decision was taken, the AI decision record provides the score, the threshold that applied, the rule that fired, the outcome, and whether a person reviewed it.
Technical and organisational measures are set out in the Data Processing Agreement and cover encryption in transit and at rest, access control on a least-privilege basis, tenant isolation, audit logging, backup and restore, and personnel confidentiality obligations.
We notify the customer without undue delay after becoming aware of a personal data breach affecting their data, with the information the controller needs for its own notification duties under Articles 33 and 34.
The following are available to customers and prospective customers:
To request any of these, or any further documentation your legal or procurement team requires, write to info@hrblade.com.
For queries relating to this document, and for data protection queries generally: info@hrblade.com
The information on this website is provided for general information only and does not constitute an offer or a binding commitment. The binding agreement is the Terms of Use at workspace.hrblade.com/terms; where anything on this site is inconsistent with them, those Terms prevail. Product features, availability and figures shown here may change without notice.
