ATLAST CANDIDATE PRIVACY NOTICE
Last Updated: April 2026
Effective Date: April 2026
Introduction
This Candidate Privacy Notice explains how your personal data is processed when you apply for a job through a company using the Atlast recruitment platform.
Who is responsible for your data?
The company you are applying to (the “Employer”) is the data controller and is responsible for your personal data. The Employer determines what data is collected and how it is used.
Atlast Global Technologies, S.L. (“Atlast,” “we,” or “us”) provides the recruitment platform as a data processor. We process your data on behalf of the Employer, following their instructions.
If you have questions about how your data is being used for a specific job application, please contact the Employer directly.
About Atlast
Data Processor:
Corporate Name: Atlast Global Technologies, S.L. Address: Avenida Eduard Maristany, 7, floor 5, door B, 08019, Barcelona, Spain Tax ID (CIF/NIF): B-24.844.326 Registration Details: Registered in the Mercantile Registry of Barcelona, Volume/IRUS Number 1000461508346, Folio 1, Sheet B-645123, Entry 1 Email: privacyandsecurity@atlasthq.com
What Personal Data We Process
When you apply for a job through a company using Atlast, the following types of personal data may be processed:
Application Information:
• Name, email address, phone number
• CV/resume and cover letter
• Work history, education, and qualifications
• LinkedIn profile or portfolio (if provided)
• Answers to application questions
Assessment Data (if applicable):
• Skills assessments or test results
• Interview recordings or notes
• Reference checks
Technical Data:
• IP address, browser type, device information (collected automatically when you use the platform)
The specific data collected depends on what the Employer has configured in their recruitment process.
Your personal data is processed for the following purposes:
By the Employer (Data Controller):
• To assess your suitability for the role
• To communicate with you about your application
• To conduct interviews and reference checks
• To make hiring decisions
• To comply with legal obligations (e.g., right-to-work checks, equal opportunity monitoring)
By Atlast (Data Processor):
• To provide the recruitment platform to the Employer
• To enable communication between you and the Employer
• To support AI-powered features like candidate matching or interview scheduling (only as instructed by the Employer)
• To maintain platform security and functionality
Important: Atlast does not make hiring decisions. All employment decisions are made by the Employer.
Legal Basis for Processing
The Employer processes your data based on:
• Legitimate interest in assessing candidates for employment (GDPR Art. 6(1)(f))
• Performance of a contract if you are offered and accept a position (GDPR Art. 6(1)(b))
• Legal obligation where required by employment law (GDPR Art. 6(1)(c))
• Consent for specific purposes where requested (e.g., future job opportunities)
How Long Your Data Is Kept
Automatic Deletion: Candidate data is automatically deleted 90 days after the role is closed unless the Employer has a legitimate reason to retain it longer (e.g., legal requirements or with your consent for future opportunities).
Before Automatic Deletion: The Employer can export or manually delete your data at any time through their Atlast account.
If You Are Hired: Your data may be transferred to the Employer’s HR systems and retained in accordance with employment law and the Employer’s retention policies.
Who Has Access to Your Data
The Employer: The company you applied to has full access to your application data.
Atlast: Our authorized personnel may access your data only to provide technical support, maintain platform security, or as required by law. We do not use your data for our own purposes.
Subprocessors: We use trusted third-party service providers to operate the platform, including:
• AWS (cloud hosting)
• OpenAI (AI functionality, with privacy protections)
• Other service providers as listed on our Trust & Data page
All subprocessors are bound by strict data protection obligations.
International Transfers: Your data may be processed outside the European Economic Area (EEA) or United Kingdom. Where this occurs, appropriate safeguards are in place, such as:
• EU Standard Contractual Clauses (SCCs)
• UK International Data Transfer Addendum (for UK candidates)
• Adequacy decisions
Your Rights Under GDPR
As a candidate, you have the following rights:
Right of Access (Art. 15 GDPR) You can request a copy of the personal data held about you.
Right to Rectification (Art. 16 GDPR) You can request correction of inaccurate or incomplete data.
Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR) You can request deletion of your data in certain circumstances (e.g., if you withdraw your application).
Right to Restriction of Processing (Art. 18 GDPR) You can request that processing be limited in certain situations.
Right to Data Portability (Art. 20 GDPR) You can request your data in a machine-readable format.
Right to Object (Art. 21 GDPR) You can object to processing based on legitimate interests.
Right to Withdraw Consent If processing is based on your consent, you can withdraw it at any time.
Right to Lodge a Complaint You can complain to a data protection supervisory authority:
Spain: Agencia Española de Protección de Datos (AEPD) – www.aepd.es
UK: Information Commissioner’s Office (ICO) – www.ico.org.uk
EU: Your local data protection authority
How to Exercise Your Rights
To exercise your rights, contact the Employer directly. They are the data controller and are responsible for responding to your request.
If you cannot reach the Employer or have concerns about how Atlast processes your data, you can contact us at:
Email: privacyandsecurity@atlasthq.com Subject Line: “Candidate Data Request”
We will assist where possible, but in most cases, you will need to direct your request to the Employer.
How We Protect Your Data
Atlast implements industry-standard security measures to protect your personal data, including:
• Encryption of data in transit (TLS/SSL) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security assessments and monitoring
• Employee confidentiality agreements and training
For more information, see our Security & Data Protection Overview.
AI and Automated Decision-Making
The Atlast platform uses AI to assist with tasks like:
• Matching your profile to job requirements
• Scheduling interviews
• Providing insights to the Employer
Important: AI is used to support the Employer’s decision-making, not to make automated hiring decisions. All final hiring decisions are made by humans at the Employer.
If the Employer uses automated decision-making that significantly affects you, they are required to inform you separately and provide you with additional rights under GDPR Article 22.
Changes to This Notice
We may update this Candidate Privacy Notice from time to time. The “Last Updated” date at the top will reflect any changes.
Material changes will be communicated to candidates through the platform or via the Employer.
Questions or Concerns?
For questions about your specific application: Contact the Employer you applied to directly.
For questions about how Atlast processes candidate data: Email: privacyandsecurity@atlasthq.com
Address: Avenida Eduard Maristany, 7, floor 5, door B, 08019, Barcelona, Spain