GDPR & Data Retention

PlacementFlow is designed with GDPR compliance in mind. This guide covers how data retention works, how to handle candidate requests, and where to find privacy settings.

Default Retention Period

Candidate data is retained based on activity:

Status	Retention
Active candidates	Kept while in your pipeline — never auto-deleted
Inactive candidates	Automatically scheduled for deletion after your configured retention period (default: 3 years — the platform maximum)
Placed candidates	Placement records are anonymised rather than deleted, preserving your financial records

The default retention period is 3 years — the platform maximum, chosen so your talent pool keeps its value for as long as reasonably defensible under GDPR's storage-limitation principle. You can configure a shorter period in Settings → Compliance. Passive talent-pool candidates have their own extended 24-month inactivity window that applies even when your configured period is shorter.

Automatic Data Cleanup

PlacementFlow runs a daily retention job (3 AM UTC) that works in two phases:

1. Candidates past your retention period are marked for deletion, with a 30-day grace window
2. After the grace window, their records are deleted — including screenings, email history, and interview data
3. Every deletion is logged for your audit trail

Active candidates are never auto-deleted — only inactive records past the retention period.

Deleting Candidate Data (Right to Erasure)

If a candidate requests deletion of their data:

1. Go to Candidates and find their record
2. Click the actions menu (three dots)
3. Select GDPR Delete
4. Confirm the deletion

This permanently removes all their data immediately. The action is logged with your user ID and timestamp for compliance records.

Note: If the candidate has placements, their record is anonymised in place rather than deleted — placement and financial records must legally be retained, but all identifying data is scrubbed.

Candidates Can Request Erasure Themselves

Candidates don't have to email you: every candidate-facing page links to a Request data deletion form, and the candidate portal includes it too. A submitted request notifies your agency admins — you then have 30 days to process it (using GDPR Delete above). Candidates can also view their AI decision history in the candidate portal and download it as a PDF report.

Generating Compliance Documentation

PlacementFlow can generate a Legitimate Interest Assessment (LIA) document for your outreach activities:

1. Go to Settings → Compliance
2. Enter your details:
   • Sectors you recruit in
   • Types of candidates you contact
   • Primary outreach method
3. Click Generate LIA
4. Review and save the document

The generated document covers UK GDPR Article 6(1)(f) and PECR requirements. Have your solicitor review it before relying on it — it's a draft, not legal advice.

Legal Basis for Sourcing

PlacementFlow operates under Legitimate Interest for:

• LinkedIn profile data (publicly available business information)
• Email enrichment (corporate email addresses for B2B communication)
• Candidate outreach (recruitment is a recognized legitimate interest)

This is documented in the LIA generator and on your Data & Privacy settings page.

Where to Find Privacy Settings

Setting	Location
Data & Privacy info	Settings → Data & Privacy
LIA document generator	Settings → Compliance
GDPR delete button	Candidate record → Actions menu

Candidate Rights

Under GDPR, candidates can request:

• Access — see what data you hold (export it from their candidate record; they can also self-serve their AI decision report in the candidate portal)
• Rectification — correct inaccurate data (edit their record)
• Erasure — delete their data (use GDPR Delete; candidates can also submit a deletion request themselves)
• Portability — export their data (the same data export)
• Human review of automated decisions (Article 22) — candidates can object to automated processing at any time; AI scoring is then skipped and a human reviews instead. See AI Transparency: What Candidates Are Told

Respond to requests within 30 days to remain compliant.

What PlacementFlow Handles for You

• Automatic retention enforcement — old data deleted on schedule
• Audit logging — every deletion is recorded
• Compliance documentation — LIA generator provides starting templates
• Unsubscribe tracking — opted-out contacts blocked from future emails

You're responsible for responding to individual requests and ensuring your outreach practices align with your LIA.

What Happens Next

Review your Data & Privacy settings to ensure they reflect your actual practices. Generate an LIA document and have it reviewed. The automatic retention job handles cleanup — you focus on active candidates.

Related articles

• AI Transparency: What Candidates Are Told
• Auditable AI: Bias Monitoring and the Audit Export
• The Candidate Portal