Sign inContact us
Sign inContact us

Careers

Candidate privacy notice

Version draft-6815bf9852e2

Last updated: TBD

---

1. Who we are

When you apply for a role through talent.dealflow.eu, your personal data is controlled by:

TBD: Dealflow legal entity name NIPC (tax number): TBD Registered address: TBD, Lisbon, Portugal Contact for anything in this notice: talent@dealflow.eu

TBD: say whether a Data Protection Officer has been appointed. If one has, add their contact details. If not, delete this line.

2. What this notice covers

This notice explains how we handle your personal data when you apply for a job or internship with us, take our online test and go through our selection process. If you join Dealflow, a separate employee privacy notice will apply from then on.

3. What data we collect

Data you give us

  • Identity and contact details: name, email address, phone number (optional), LinkedIn profile (optional).
  • Your CV and anything else you upload.
  • Education: degree, institution and graduation date.
  • Your answers to our application questions, including whether you have the right to work in Portugal, whether you're willing to relocate, your availability and your motivation.
  • Anything you tell us in emails, calls and interviews, and the case study you submit.

Data we create during the process

  • Your online test results: answers, score and time taken.
  • Notes and evaluations by the people who interview and assess you.
  • A summary and recommendation produced with the help of AI tools (see section 5).
  • Your status in the process and a log of the emails we send you.

Technical data

  • Basic technical logs when you use talent.dealflow.eu (such as IP address, browser type, and time of access), kept for security purposes. TBD: confirm what the app logs, and whether it uses any cookies beyond strictly necessary ones. If it does, a cookie banner is needed.

What we don't ask for. We don't need information about your health, ethnic origin, religion, political views, sexual orientation or other special categories of data, and we ask you not to include them in your CV or answers. We don't ask for a photo, your date of birth, your nationality or your marital status. On work eligibility we only ask whether you have the right to work in Portugal.

4. Why we use your data, and our legal basis

PurposeLegal basis (GDPR)
Receiving and assessing your application, running the test, interviews and case study, and communicating with you about itTaking steps at your request before possibly entering into a contract with you (Art. 6(1)(b)), and our legitimate interest in recruiting suitable people (Art. 6(1)(f))
Using AI tools to help our team organise, summarise and compare applicationsOur legitimate interest in handling applications efficiently and consistently (Art. 6(1)(f)), with a person always making the decision (see section 5)
Checking your right to work in Portugal, if we make you an offerLegal obligation (Art. 6(1)(c))
Keeping records of our recruitment processes as required by Portuguese labour law, and defending legal claimsLegal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))
Keeping your application after this process to consider you for future rolesYour consent (Art. 6(1)(a)), which you can withdraw at any time
Keeping talent.dealflow.eu secureLegitimate interest (Art. 6(1)(f))

Where we rely on legitimate interest, we've weighed our interests against your rights. You can object at any time (see section 8).

5. AI-assisted screening and human decisions

We use AI tools to help our recruitment team. In practice:

  • The AI reads your CV, your answers and your test result, and gives our team a short summary and a suggested recommendation (for example, to move forward or to look more closely).
  • The AI does not make decisions. A member of our team reviews every application and decides whether it moves forward. No one is rejected by an automated system alone, including after the online test.
  • Our online test is marked automatically, like any multiple-choice test. The score is one input that a person considers alongside your whole application.
  • The AI is instructed to consider only job-relevant information and to ignore characteristics such as age, nationality, gender or appearance.

Because a person makes every decision, our process doesn't involve decisions based solely on automated processing within the meaning of Article 22 GDPR. You can still ask a person to explain or re-check any assessment of your application, give us your point of view, or contest the outcome (see section 8).

AI provider: TBD (the current recruitment tooling uses Anthropic's Claude models; confirm for talent.dealflow.eu). The provider processes data on our behalf and isn't allowed to use your data to train its models. TBD: confirm the contract terms.

6. Who we share your data with

  • Our team: only the people involved in the hiring decision for the role you applied for.
  • Service providers who process data on our behalf under contract, such as:
  • hosting and database for talent.dealflow.eu: TBD (e.g. Supabase, region TBD)
  • email delivery: TBD
  • AI assistance: TBD (see section 5)
  • video calls and calendar for interviews: TBD (e.g. Microsoft 365)
  • Authorities, where the law requires it.

We don't sell your data and we don't share it with other employers.

Transfers outside the EU/EEA. Some of these providers may process data outside the European Economic Area (for example, in the United States). Where they do, we rely on safeguards recognised by the GDPR, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards. TBD: list the actual transfers once providers are confirmed.

7. How long we keep your data

  • If you aren't hired: we keep your application data for 12 months after your recruitment process ends, and then delete or anonymise it. This lets us respond to questions or complaints about the process.
  • If you agree to stay in our talent pool: we keep it for a further TBD months so we can contact you about future roles. You can withdraw this consent at any time.
  • If you're hired: the relevant parts of your application move into your employee file, under our employee privacy notice.
  • If you withdraw or ask us to delete your data: we delete it promptly. We keep only a minimal record of your request, and anything the law requires us to keep.
  • Security logs are kept for TBD days.

8. Your rights

You have the right to:

  • Access the personal data we hold about you, including your test results and our notes, and get a copy.
  • Correct inaccurate or incomplete data.
  • Delete your data ("right to be forgotten").
  • Restrict how we use your data in certain circumstances.
  • Object to our use of your data based on legitimate interest, including AI-assisted screening.
  • Data portability: receive the data you gave us in a commonly used, machine-readable format.
  • Withdraw consent at any time, where we rely on it (for example, the talent pool). This doesn't affect anything we did before you withdrew.
  • Human review: ask for a person to explain or re-examine any assessment of your application, give your point of view, and contest the outcome.

How to exercise your rights

  • Self-service: at your personal link (it is in every email we send you) on talent.dealflow.eu you can see your application status, withdraw your application, download your data and delete your data at any time.
  • By email: write to talent@dealflow.eu. We may need to confirm your identity before acting on a request.

We'll respond within one month. If a request is complex, we may extend this by up to two more months, and we'll tell you if we do. Exercising your rights is free.

9. Your right to complain

If you're unhappy with how we handle your data, please contact us first at talent@dealflow.eu so we can try to fix it. You also have the right to lodge a complaint with the Portuguese data protection authority:

Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt

You can also complain to the data protection authority in the EU country where you live or work.

10. Do you have to give us your data?

You don't have to apply, but we need the information marked as required in the application form to assess your application. Without it, we can't consider you for the role.

11. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes while your application is open, we'll let you know by email.

---