Recruiting and the GDPR: how HRAtan helps keep applicant data in order
Applicants trust a company with personal data and rightly expect it to be handled with care. Meanwhile the employer has no time to keep every deletion deadline in mind. HRAtan gives technical support for this; decisions and responsibility stay with the employer.
Where is the data?
The database and CV files are stored in the European Union, in Frankfurt. Access is controlled by Row Level Security, so every organization sees only its own data. Two-factor authentication (2FA) is mandatory for admin and recruiter roles.
With some providers (AI processing, email delivery, application hosting) data may also be transferred to the United States; this is based on the European Commission’s standard contractual clauses (SCC). The full list is in the annex of the data processing agreement.
What does HRAtan offer for everyday data protection?
- Retention period in days: applicant data, including the CV file, is deleted automatically after the period you set.
- Talent pool with separate consent: only people who agreed separately are kept for later jobs; you record a withdrawal with one button.
- Access requests: all data of one applicant can be exported with one click, and the whole organization’s data as a JSON file.
- Activity log: who made which decision and when; the log can be exported as CSV.
- No attachments when forwarding: the decision maker gets a secure link to the candidate, the CV is not sent by email.
AI and data protection
CVs are analyzed by an external AI provider (primarily Anthropic). Before sending, the system removes the email address, the phone number and lines that point to special categories of data; this is data minimization, not anonymization. HRAtan does not train AI models with applicant data. Applicants can object to the AI assessment, in which case a person assesses them; AI can also be switched off for the whole organization.
What HRAtan does not take over
HRAtan is a processor: the employer decides the retention period, the legal basis and the applicant privacy notice. We provide a template and a data processing agreement (DPA) in Hungarian, English and German (the Hungarian version prevails). This is information, not legal advice.
Frequently asked questions
Is HRAtan GDPR compliant?
HRAtan supports GDPR-compliant work with EU storage, a data processing agreement, retention periods, export and consent handling. Compliance also depends on the employer’s own processes, so no software can guarantee full compliance on its own.
How long may I keep applicant data?
The employer decides this based on its purposes and legal basis. In HRAtan the retention period is set in days, and expired data is deleted automatically.
Do I get a data processing agreement?
Yes. The data processing agreement (DPA) with the list of sub-processors is on the legal pages in Hungarian, English and German.