How PlacementFlow handles data retention, candidate rights, and compliance documentation.
4 min readIn this video you'll answer a candidate's data request: a copy of everything you hold, or erasing it.
Open the candidate's page.
Next to the main buttons is the Data & privacy button. Click it.
To give someone their data, choose Export data (Article 15). A file downloads straight away, with everything PlacementFlow holds about them: their profile, messages, screenings and history. Send it to them your own way.
To erase someone, choose Erase data (Article 17). Only an admin sees this option. PlacementFlow asks first, and says what will happen to this record. Nothing holds this one, so the record is deleted, with every piece of personal data, messages, screenings and the CV file included. If someone has a placement, an introduction to a client, or a campaign marketing them, it says so instead: the record is kept, anonymized, not deleted. Click Permanently erase. This cannot be undone.
PlacementFlow takes you back to your candidates, and the person is gone. No screening link and no automated message can reach that person again.
Candidates can also ask for themselves, from their own portal, with Download my data or Request data deletion.
Next: your trial, and subscribing when you're ready.
PlacementFlow is designed with GDPR compliance in mind. This guide covers how data retention works, how to handle candidate requests, and where to find privacy settings.
Candidate data is retained based on activity:
| Status | Retention |
|---|---|
| Active candidates | Kept while in your pipeline — never auto-deleted |
| Inactive candidates | Automatically scheduled for deletion once their record has gone unchanged for your retention period (3 years if you have not set one) |
| Placed candidates | Placement records are anonymised rather than deleted, preserving your financial records |
If you have not set a retention period, inactive candidates are kept for 3 years. You can set your own period, from 30 to 3,650 days, in Settings → Data & Privacy with Auto-delete inactive candidates. Candidates you have not approved are deleted no later than 3 years after last contact, even if your period is longer. Passive candidates are on their own schedule: deleted after 24 months without changes, whatever your retention period.
PlacementFlow runs a daily retention job (3 AM UTC) that works in two phases:
Active candidates are never auto-deleted — only inactive records past the retention period.
If a candidate requests deletion of their data:
This permanently removes all their data immediately. The action is logged with your user ID and timestamp for compliance records.
Note: If the candidate has placements, their record is anonymised in place rather than deleted — placement and financial records must legally be retained, but all identifying data is scrubbed.
Candidates don't have to email you: every candidate-facing page links to a Request data deletion form, and the candidate portal includes it too. The candidate confirms the request from an email link. Once they confirm, their record is scheduled for deletion 30 days later and your agency admins are notified. You can erase it sooner with Erase data (Article 17). Candidates can also view their AI decision history in the candidate portal and download it as a PDF report.
PlacementFlow can generate a Legitimate Interest Assessment (LIA) document for your outreach activities:
The generated document covers UK GDPR Article 6(1)(f) and PECR requirements. Have your solicitor review it before relying on it — it's a draft, not legal advice.
PlacementFlow operates under Legitimate Interest for:
This is documented in the LIA generator and on your Data & Privacy settings page.
| Setting | Location |
|---|---|
| Data & Privacy info | Settings → Data & Privacy |
| LIA document generator | Settings → Compliance & AI Governance |
| Erase data | Candidate page → Data & Privacy (admins only) |
Under GDPR, candidates can request:
Respond to requests within 30 days to remain compliant.
You're responsible for responding to individual requests and ensuring your outreach practices align with your LIA.
Review your Data & Privacy settings to ensure they reflect your actual practices. Generate an LIA document and have it reviewed. The automatic retention job handles cleanup — you focus on active candidates.
Related articles