This feature adds privacy notices to your candidate emails, your application form and your career pages. Candidates get an option to request that their data be modified or deleted. The request is sent to your data compliance email address, so your team can review it and make the change directly in the ATS.

These settings are per brand. If you have more than one brand, set them up for each one.

Before you start, you need two things

1. A privacy policy page on your own website, for example yourcompany.com/privacy
2. One or more email addresses where candidate requests should be sent

How to turn it on

1. Go to Settings → Brands & Candidate portal and click Configure on your brand

2. In Privacy & compliance, turn on Candidate data privacy & compliance

3. Add your privacy policy link

4. Add your data compliance email. You can add more than one; the first is shown to candidates.

5. Under Candidate experience, turn on what candidates should see:

   • Gather consent at the time of application: candidates tick a box agreeing to your privacy policy before they apply
   • Cookie consent: a cookie banner on your career pages. Analytics only loads after a candidate accepts.
   • Candidate email footer: a privacy notice at the end of every candidate email, with links to request changes or deletion

   Each one comes with default text. Click the pencil icon to change it. A link to your privacy policy is always added at the end.

6. Save

Once enabled, candidate emails will include an option to request data modification or deletion. When a candidate submits a request, it's sent to your data compliance email so your team can review and action it from the ATS.

Only emails sent from the ATS include this footer, so make sure your team contacts candidates through the ATS.

Don't have a privacy policy page yet?

Your privacy policy page should cover:

• What data you collect from candidates, such as name, contact details, CV, work history, education, references, and interview or assessment results
• Why you collect it, typically to evaluate candidates for job openings
• How long you retain it, for example, for the duration of the hiring process and a defined period after
• Who has access to it, your hiring team, and Whitecarrot as your ATS provider
• How candidates can request changes or deletion, along with the email address to write to (this should match the data compliance email you add in step 4 above)
• Which cookies your career pages use, if you turn on cookie consent

To make this easy, we've already put together a ready-to-use policy for you. Review it, fill in your details, and publish it as-is.

Candidate Privacy Notice

Last updated: [Date]

[Company Name] ("we," "us," "our") is responsible for the personal data you share with us during our recruitment process. This notice explains how and why we collect, use, and protect your personal data when you apply for a role with us, and what rights you have over that data.

Information we collect

When you apply for a job or are added to our talent pool, we may collect: your name, contact details, CV, cover letter, work history, education, references, interview notes, assessment results, and any other information you choose to share with us during the recruitment process.

Why we process your data

We process your personal data to:

• Evaluate your application and assess your suitability for a role
• Communicate with you about your application or future opportunities, where you have consented to this
• Meet our legal or regulatory obligations related to hiring and record-keeping

Who we share it with

Your data may be accessed by our internal hiring team and is processed on our behalf by Whitecarrot, our recruitment platform provider, solely to support our hiring operations. We do not sell your personal data or share it with third parties for marketing purposes.

How long we keep your data

The system retain your data after your last application or interaction with us, unless you ask us to remove it.

Cookies

Our career pages use necessary cookies to keep the site working, for example to remember your language. With your permission, we also use analytics cookies to understand how the site is used. You can change your choice at any time using the cookie button in the corner of the page.

Your rights

Depending on the data protection laws that apply to you, you may have the right to:

• Request correction of inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us at [your data compliance email]. We will respond within [X days].

Contact us

If you have any questions about this notice or how your data is handled, please contact us at [your data compliance email].

Fill in the bracketed fields, publish this on your website, and use that URL as your privacy policy link in step 3 above.