Records of processing activities (Art. 30) - Ganek recruitment

Pre-filled template. {Curly braces} are yours. Not legal advice - see the pack README.

Keep this record even if you have fewer than 250 employees: the Art. 30(5) derogation excludes processing that is more than occasional, and running an open hiring pipeline is exactly that. This is the document a supervisory authority asks for first.

Controller: {legal name}, {address}, {contact email/phone} Representative (Art. 27, non-EU controllers only): {name or n/a} DPO: {name, or "not designated - assessed under Art. 37, see below"} DPO assessment (keep current): {e.g. "Not required: not a public authority; recruitment for our own roles is a support activity, not our core activity; no large-scale monitoring or special-category processing. Assessed {date}."}

Shared technical and organisational measures (Art. 32), referenced by every activity below: TLS everywhere ({confirm}); tenant isolation enforced at query level; role-based admin access; argon2 password hashing; signed, purpose-bound, expiring candidate links (status 30 days); 2FA secrets stored encrypted; per-IP rate limiting; access logs token-scrubbed and rotation-capped; per-candidate read-access trail (who opened a profile, CV, answers or data bundle, and when); application logs carry internal IDs, not emails; encryption at rest on database and CV storage ({your mechanism}); encrypted backups with rotation ≤ retention window and no restore of erased subjects ({confirm}); hardening checklist from .env.example applied ({date}).

Retention below uses W = your configured window (Settings → Privacy, default 6 months), enforced by the nightly purge from the decision date.

Activity 1 - Application intake and review

Purpose: receiving and assessing applications for our own open roles.
Legal basis: Art. 6(1)(b) (steps prior to a contract, at the candidate’s request).
Data subjects: job applicants.
Data: name, email, CV file, links, free-text message, answers to the job’s screening questions, stage history, how the candidate reached the page (a source label such as linkedin, google, direct, a tracked-link name, or the referring site’s domain; never the full referring URL).
Recipients: recruiting staff; {hosting provider} (infrastructure); {email relay} (transactional email); {webhook, automation or ATS targets, if configured}.
Transfers: none (see Activity 6 for the only built-in transfer). {Adjust if your hosting/email providers are outside the EU/EEA.}
Retention: W months after rejection/withdrawal; hired → employee records per {HR policy}.

Activity 2 - Skill screening quiz

Purpose: job-related knowledge screening as part of the application.
Legal basis: Art. 6(1)(b). Candidates who skip the quiz remain reviewable - stated at the start gate.
Data: served questions, per-question answers with correctness, total and per-tag scores, server-measured timing.
Recipients: recruiting staff; {hosting provider}.
Transfers: none.
Retention: with the application (W).

Activity 3 - Quiz integrity telemetry

Purpose: assessment fairness (deterring/flagging assistance during the timed quiz). Balancing documented in the legitimate interests assessment.
Legal basis: Art. 6(1)(f).
Data: events of three types - quiz tab hidden (with duration), paste occurred, window resized - tied to the open question; derived flags. No IP, no user agent, no keystrokes, no clipboard contents.
Recipients: recruiting staff (informational flags only).
Transfers: none.
Retention: with the attempt (W).

Activity 4 - Pipeline management, notes, activity log

Purpose: organising the hiring process; internal accountability.
Legal basis: Art. 6(1)(f) (managing recruitment).
Data: stage changes with decision timestamps, rejection reason and optional note, recruiter notes about candidates and reviewer scorecards (ratings, recommendation, comment; both disclosable to the candidate on request), activity entries.
Recipients: recruiting staff.
Transfers: none.
Retention: with the application (W); erasure receipts and purge receipts are anonymized counts and persist.

Activity 5 - Candidate communications

Purpose: transactional email - application confirmation, quiz invitation and reminder (including re-issued links), decision updates (opt-in per send), one-off messages a recruiter writes to the candidate (reply-to the recruiter), interview invitation, confirmation, reschedule, cancellation, and reminder.
Legal basis: Art. 6(1)(b)/(f). No marketing, no newsletter - no ePrivacy opt-in involved.
Data: name, email, application/interview context; every mail carries controller identity and the privacy-notice link.
Recipients: {email relay}.
Transfers: {per your relay}.
Retention: sent mail per {your mailbox policy}; Ganek keeps a per-email delivery record (recipient, template kind, delivery state) for 30 days so failures are visible to recruiters, then the nightly job removes it - records are deleted immediately with the candidate on erasure; logs reference internal IDs only.

Activity 6 - Interview scheduling (calendar invites by email)

Purpose: offering interview slots from recruiters’ saved availability; calendar invitations (.ics) emailed to the candidate and the interviewer, with the meeting place or video link the recruiter entered.
Legal basis: Art. 6(1)(b) (scheduling a step the candidate requested).
Data: candidate name and email (as the invite’s attendee), interview time, the meeting place or video link the recruiter entered; slots come from the recruiter’s saved availability, no calendar is read.
Recipients: your email provider ({email provider}); the candidate and the interviewer, each receiving the invite.
Transfers: none built in (your email provider’s own terms apply).
Retention: the invite rows follow the application; on erasure or purge of a booked future interview the interviewer receives a cancel notice without candidate data; copies in mailboxes and calendars are outside Ganek’s reach.

Activity 7 - Post-decision retention for claims defense

Purpose: ability to respond to discrimination/selection-process claims within statutory windows.
Legal basis: Art. 6(1)(f).
Data: the closed application record as-is.
Recipients: recruiting staff; {legal advisers on need}.
Transfers: none.
Retention: exactly W months from the decision, then automatic purge. W chosen with member-state context in mind ({note your reasoning - see the guide §2}).

Activity 8 - Abuse prevention on public endpoints

Purpose: rate limiting and platform security on apply/quiz/status endpoints.
Legal basis: Art. 6(1)(f).
Data: client IP addresses in short-lived counters (≈60-second windows); staff login email addresses in failed-login lockout counters (lockout:{email} keys, ~15-minute window); rotation-capped, token-scrubbed access logs.
Recipients: operations staff.
Transfers: none.
Retention: rate-limit counters expire in ~1 minute, lockout counters in ~15 minutes; logs bounded by rotation ({state your proxy/host log retention too}).

Activity 9 - Recruiter user accounts

Purpose: authentication and authorisation of our own staff in the hiring tool.
Legal basis: Art. 6(1)(b) (employment relationship) / 6(1)(f).
Data subjects: our recruiting staff.
Data: email, display name, password hash or Google sign-in linkage, role, last login, encrypted 2FA secret and hashed recovery codes when enrolled, saved interview availability and default meeting place, dismissed dashboard items.
Recipients: {hosting provider}; Google LLC (sign-in only, if used).
Transfers: Google sign-in, if used (Google’s terms; only the account’s email and subject id are exchanged).
Retention: for the employment; on offboarding the account is anonymized in place (email tombstoned, credentials severed, availability and meeting place cleared).

{Add activities your deployment introduces - additional integrations, analytics on the admin side, imports/exports to other HR systems, …}

Record maintained by: {name} · Last reviewed: {date}