How this agreement is signed. An authorised person at the client opens Setup → Data processing agreement in the portal, reads the agreement and signs it. Nothing can be submitted until it is signed, and the date of signature is recorded on the account.
1. Parties and roles
This agreement is between the organisation that uses Kandidatos (the “Client”), the data controller, and LUZA TECNOLOGIA PORTUGAL Lda, NIPC 517 143 895, Rua dos Lusíadas, n.º 4 A&B, 1300-370 Lisboa, Portugal, operating Kandidatos (“Kandidatos”), the data processor. It applies to all personal data the Client submits to Kandidatos, and it forms part of the Client’s use of the service. It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
2. Subject matter, nature and purpose
Kandidatos processes CVs and job descriptions that the Client uploads, in order to produce standardised CV documents (ProfileSync) and candidate assessment reports for human review (ProfileScore). Kandidatos processes the data only for these purposes and only on the Client’s documented instructions. Using the service and submitting files are such instructions.
3. Data subjects and categories of data
- Data subjects: job applicants and candidates whose CVs the Client submits, and the Client’s own users.
- Candidate data: name, professional experience, education, training and certifications, skills, languages, and any other content of the submitted CV.
- User data: name and business email address of the Client’s users.
Kandidatos does not extract contact details (telephone, email, postal address) from CVs into its output. The Client does not intentionally submit special categories of data (Article 9 GDPR). Where a CV contains such data, Kandidatos does not use it in any assessment.
4. Duration and deletion
Processing lasts as long as the Client uses the service. Submitted CVs and generated documents are deleted automatically after the retention period the Client selects in Setup. Submission records and scores are kept without the files. When the agreement ends, Kandidatos deletes or returns all remaining personal data at the Client’s choice, unless law requires it to be kept.
5. Obligations of Kandidatos
- Processes personal data only on the Client’s documented instructions, and informs the Client if it believes an instruction breaches data protection law.
- Ensures that everyone authorised to process the data is bound by confidentiality.
- Applies appropriate technical and organisational measures (Article 32 GDPR), including access control limited to the Client’s own users, encryption in transit and at rest, and storage within the European Union.
- Does not use the Client’s data to train artificial intelligence models.
- Assists the Client in responding to requests from data subjects exercising their rights, and with data protection impact assessments where relevant.
- Notifies the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Client’s data.
- Makes available the information needed to demonstrate compliance with this agreement, and allows for reasonable audits.
6. Sub-processors
The Client authorises Kandidatos to use the following sub-processors:
- Microsoft Ireland Operations Limited — Microsoft 365, SharePoint, Power Platform, Dataverse and AI services, hosted in the European Union.
- The provider that hosts the kandidatos.com mailboxes, used to deliver finished documents and reports by email.
Kandidatos imposes the same data protection obligations on each sub-processor, and informs the Client in advance of any intended addition or replacement, giving the Client the opportunity to object.
7. Transfers outside the European Economic Area
Kandidatos does not transfer personal data outside the European Economic Area except with appropriate safeguards under Chapter V of the GDPR.
8. Obligations of the Client
The Client is responsible for having a lawful basis for the processing, for informing candidates that their data is processed, and for every decision taken about a candidate. Kandidatos output supports recruiters; it does not take hiring decisions.
9. Governing law and contact
This agreement is governed by Portuguese law. Questions about data protection can be sent to hello@kandidatos.com.
See also our privacy policy, terms of service and How we use AI.