GDPR Compliance

All six principles must be met for every processing activity. Here is how HireFace satisfies each:

• Lawfulness, fairness, transparency: Candidates see a clear consent screen naming purpose, recipients, and retention before recording begins.
• Purpose limitation: Video is collected for candidate evaluation only — never used for advertising, training AI models, or sold to third parties.
• Data minimisation: Camera is active only while the candidate is answering a question. Resume content (Personalised mode) is processed transiently and never stored.
• Storage limitation: Videos are automatically purged after 30 days (trial accounts) or 90 days (paid accounts). Recruiters can delete earlier on request.
• Integrity and confidentiality: TLS in transit, AES-256 at rest (Cloudflare R2), no download option, access controls per recruiter account.
• Accountability: DPA published, sub-processors named, breach response plan documented. Recruiters can contact HireFace via live chat for any data-related queries.

Candidates: Lawful basis is explicit consent (Article 6(1)(a)). Candidates must actively check a consent box naming the purpose, recipients, and 90-day retention before any recording begins. Consent can be withdrawn by closing the page before Submit.

Recruiters: Lawful basis is contract (Article 6(1)(b)) — processing their name and email is necessary to deliver the service they signed up for.

The candidate consent screen names: the purpose (video screening for a specific role), the recipient (the recruiting agency and their client), the retention period (up to 90 days), and the right to withdraw before submitting. Consent is a separate checkbox — not bundled into terms of service. Candidates can withdraw at any time before clicking Submit by closing the page.

Post-submission withdrawal: Candidates are informed on the thank-you page that they can request early deletion by replying to the invitation email. The recruiter can execute this deletion from their dashboard immediately.

Transparency is delivered at three points:

• Consent screen — before recording begins: purpose, recipients, retention period, right to withdraw.
• Thank-you page — after submission: Video retention notice, no download, early deletion process.
• Policies page — full candidate consent and privacy section at hireface.in/policies.html#candidate.

Recruiters are informed via the Recruiting Agency Agreement and DPA at sign-up.

Candidates exercise their rights by contacting the Data Controller — the recruiting agency that sent them the interview link. HireFace is the Processor; we provide recruiters with the tools to fulfil requests, but the legal obligation to respond within one month sits with the recruiter. Candidates should reply to their invitation email, which contains the recruiter's contact details.

Privacy-by-design decisions embedded in the platform:

• Camera access requested only during the recording window — not on page load.
• Resume content (Personalised mode) processed transiently in-flight; never written to storage.
• Videos stream via a Worker proxy — no direct R2 URL is ever exposed to the browser.
• Share links are time-limited (7 days) by design — hiring managers cannot hold permanent access.
• No download option on the video player — enforced both technically (no download attribute, no direct URL) and by policy.
• Auto-purge runs as a scheduled daily job (30 days for trial accounts, 90 days for paid accounts) — no human action required for deletion.
• Candidate contact details obfuscated as internal identifiers for group link participants who haven't provided an email.

A full Data Processing Agreement is published at policies.html#dpa. At sign-up, recruiters must check a mandatory confirmation box stating they agree to the DPA and acknowledge their role as Data Controller before the Google sign-in button becomes active. This constitutes a written agreement for the purposes of Article 28.

Article 32 does not mandate specific encryption standards (that is HIPAA's approach). It requires measures appropriate to the risk. HireFace exceeds the implicit standard:

Article 33 requires the processor (HireFace) to notify the controller (recruiter) without undue delay after becoming aware of a breach. The recruiter must then notify the ICO within 72 hours if the breach poses a risk to individuals.

Article 34 requires notification to affected data subjects (candidates) if the breach is likely to result in high risk to their rights.

HireFace has a documented breach response plan. The DPA formally commits HireFace to notifying recruiters without undue delay after discovering a breach.

Candidate video recordings and personal data are stored in Cloudflare's EU jurisdiction R2 bucket — they do not leave the EEA. Other processing (authentication, support) uses SCCs as the transfer mechanism.

Video recordings are personal data, but they only become biometric data under Article 9 when processed for the purpose of uniquely identifying a person using technical means — e.g., facial recognition, voiceprint matching, or gait analysis.

HireFace does not perform any biometric analysis on video recordings. Videos are stored and streamed for human review only. No AI processing of the video content takes place. Therefore Article 9 does not apply.

Important: If HireFace were to add any feature that analyses the video content (e.g., emotion detection, speaking pace scoring, facial expression analysis), Article 9 would immediately apply and require an explicit legal basis from Article 9(2) — most likely explicit consent or substantial public interest.

HireFace does not collect, process, or store any data relating to criminal convictions or offences. No DBS check or background screening data passes through the platform. Not applicable.

Article 22 applies only when automated processing produces a decision that significantly affects a person with no human in the loop.

HireFace's AI generates interview questions and (in Personalised mode) assesses whether a resume matches a role. However:

• The AI question generation does not affect the candidate — it only determines what questions they are asked, not whether they proceed.
• The resume no-match outcome (Personalised mode) does terminate the session, but this is clearly disclosed in advance and the candidate can choose not to submit — it is not a hiring decision.
• All actual hiring decisions are made by the recruiter and hiring manager — humans reviewing the video and choosing to shortlist or reject.

Therefore Article 22 does not apply. If a future feature scored candidates automatically and excluded them based on that score without human review, Article 22 would apply.

HireFace is based in India and processes data of UK/EU residents (candidates). Article 27 requires a named representative in the UK or EU unless the processing is occasional and does not include large-scale processing of special category data or data likely to result in risk to individuals' rights.

During beta with a small number of UK recruiters, the occasional processing exception likely applies. Before scaling beyond beta or onboarding enterprise clients, a formal EU/UK representative should be appointed. This can be done via services like GDPR-Rep.eu for approximately €200/year.

Current status: Article 27 compliance is a pre-launch action item to be addressed before scaling beyond beta.