Who is responsible for what
Kandidatos is used by recruitment agencies and employers to process CVs. That creates two distinct relationships, and it matters which one applies to you.
| If you are… | Then… |
|---|---|
| A client using Kandidatos | You are the controller of the candidate data you submit. You decide whose CVs are processed and why. We are your processor and act only on your documented instruction, under a signed data processing agreement. |
| A candidate whose CV was submitted | The agency or employer who submitted your CV is the controller. They decide what happens to your data. We process it on their behalf. Requests about your data should go to them first — see Rights of candidates. |
| A visitor to this website | We are the controller for the limited data described under Account data. |
Kandidatos is operated by LUZA TECNOLOGIA PORTUGAL Lda.
Candidate data
When a client submits a CV, we process:
- The source file as uploaded — a PDF, Word document or scan.
- Text extracted from it, in order to read it.
- A structured record of the professional content: name, job titles, employers, dates and responsibilities, education, training and certifications, languages with the stated level, skills, and industries.
- For ProfileScore only: scores against the vacancy the client submitted, together with the evidence and reasoning behind each score.
- The generated output — a standardised document, a report, or both.
What we deliberately do not collect
Some data is excluded by design, not by policy alone.
- Contact details. Phone numbers, email addresses and postal addresses are not extracted from a CV into our structured record, and do not appear in generated documents or scores.
- Protected characteristics. We do not derive or store age, gender, ethnicity, religion, health, disability or family situation. Nationality is recorded only where a CV states it explicitly, and is never inferred.
- Photographs are not analysed and no attribute is derived from them.
The original file the client uploaded is stored as supplied and may of course still contain these things. What this section describes is what the system reads out and keeps as data.
Account data
For our own clients we hold: company name, the contact details of the people who use the service, delivery email addresses, account configuration such as templates and retention settings, credit ledger entries, and records of submissions. We are the controller for this data and process it to provide and bill for the service.
Legal basis
For candidate data, the lawful basis is the client's — as controller, they determine it and are responsible for having one. Our processing is carried out on their instruction under Article 28 GDPR.
For account data, our basis is performance of a contract, and our legitimate interest in operating and securing the service.
Where data is held
Kandidatos runs on Microsoft Power Platform. Structured data is held in Microsoft Dataverse; files are held in Microsoft SharePoint. Both sit in infrastructure operated by us as the service provider, not in the client's own Microsoft tenant.
Each client's files, credits, templates and records are separated by account.
Data is stored within the European Union.
Sub-processors
| Sub-processor | Purpose |
|---|---|
| Microsoft | Cloud platform, storage, database, and the AI services used to read and score CVs. |
We will give clients notice of changes to this list as set out in the data processing agreement.
Retention and deletion
Each client sets a retention period of 30, 60, 90 or 180 days. Source CVs and generated documents are deleted on that schedule, and the deletion is recorded against the record so it can be evidenced.
Submission records and scores are retained without the underlying files, so that a client's own history and billing remain intact. Account data is retained for the life of the contract, and afterwards only for as long as our legal and accounting obligations require.
Security
Access to client data is restricted to personnel who need it to operate and support the service. Data is encrypted in transit and at rest by the underlying Microsoft platform.
Rights of candidates
If your CV was processed through Kandidatos, you have rights under the GDPR: access, rectification, erasure, restriction, objection and portability.
Direct these to the agency or employer who submitted your CV. They are the controller and decide the outcome — we cannot lawfully act on your data without their instruction. If you do not know who submitted it, or they do not respond, write to us at hello@kandidatos.com and we will help identify the controller and pass the request on.
You also have the right to complain to your national supervisory authority.
International transfers
Data is stored within the European Union. Where Microsoft, as our sub-processor, processes data outside the European Economic Area, it does so under the EU Standard Contractual Clauses included in its data protection terms.
Changes
We will post changes to this policy on this page and update the date above. Material changes affecting clients will also be notified under the data processing agreement.
Contact
Questions about this policy or about how Kandidatos handles data: hello@kandidatos.com.