Candidate Privacy Notice

1. Who is responsible for your data?

The controller of your data is the company recruiting you. It is that company that:

• decides to run a pre-selection process;
• chooses the questions asked;
• makes the decision to shortlist your application or not;
• sets the retention period for your data.

This company's contact details are in the invitation email you received. If in doubt, you can write to privacy@pre-hire.com and PreHire will put you in touch.

PreHire (Reach Technologies SAS) acts as a technical processor: we provide the tool, but we do not decide on the handling of your application.

2. What data is collected?

The following data may be collected:

• your identity (first name, last name) and your contact details (email, phone);
• the information contained in your CV or application (background, education, skills, experience);
• your video answers to the questions asked by the Recruiter;
• the automatic text transcript of your answers;
• technical connection data (IP address, device type, browser) for security and proper-functioning reasons.

None of the following data is collected, requested, or analysed:

• health data;
• political, religious, or philosophical opinions;
• trade union membership;
• ethnic or racial origin;
• biometric data (voiceprint, facial recognition);
• facial-expression or emotional data;
• sex life or sexual orientation.

Should you spontaneously mention one of these topics in your CV or your answers, the company recruiting you has committed not to make it a selection criterion.

3. How is artificial intelligence used?

3.1 What the AI does

PreHire uses artificial intelligence to help the Recruiter save time when reviewing applications. In practice, the AI:

• reads your CV and extracts the main information from it to present it to the Recruiter in a structured way;
• provides an indicative match score between your profile and the job offer;
• transcribes your video answers into text;
• provides an indicative score of the answers against the criteria defined by the Recruiter.

3.2 What the AI does not do

This is important: the AI never decides on behalf of the Recruiter. All decisions concerning your application are made by a human within the recruiting company.

The AI also does not analyse:

• your facial expressions;
• your voice, your tone, your speaking pace;
• your background or your attire;
• your emotional state;
• any biometric element.

The analysis covers only textual content: what your CV says, and what you say in your answers (transcribed into text).

3.3 Where is the AI hosted?

The artificial intelligence models used by PreHire are hosted exclusively within the European Union. Your data is never sent to an AI hosted in the United States or anywhere else outside the EU.

3.4 Why this transparency?

AI-assisted recruitment is an area governed by European Regulation 2024/1689 on artificial intelligence (the AI Act), classified as « high risk ». This means you have the right to know how AI is used, and to request that it not be used for your application.

3.5 Your right to request a review without AI

4. Why is your data processed?

Your data is processed in order to:

• identify you as a candidate;
• allow the Recruiter to review your application;
• inform you of the outcome of your application;
• where applicable, contact you for the next steps of the recruitment process.

The legal basis for the processing is:

• pre-contractual steps taken at the request of the data subject (Article 6.1.b of the GDPR); or
• the company's legitimate interest in recruiting (Article 6.1.f), subject to a balance with your rights and freedoms.

Your data is not used for:

• commercial prospecting;
• advertising profiling;
• the training of artificial intelligence models;
• resale to third parties.

5. How long is your data kept?

Your video interview is made available to the recruiting company through the PreHire platform. To give you every chance for your presentation to be reviewed, your video remains accessible to the company for 30 days. If the company does not follow up, your video interview is then automatically deleted, and all associated data within a maximum of 12 months.

Beyond the PreHire platform, the retention period in the own systems of the company recruiting you is determined by that company, in line with the CNIL's recommendations:

• if your application is shortlisted: for as long as necessary for the contractual relationship;
• if your application is not shortlisted: a maximum of two (2) years after the last contact, unless you request early deletion, or unless a different period is justified by the company.

You can request early deletion of your data: see section 7.

6. Who has access to your data?

• authorised people within the company recruiting you (recruiters, HR, and possibly operational managers concerned by the role), bound by a confidentiality obligation;
• PreHire's technical teams (Reach Technologies SAS), strictly for the needs of operating the service, and bound by a confidentiality obligation;
• PreHire's technical subprocessors (hosting, transcription, emails), governed by data-protection contracts. The full list is public.

Your data is never sold or made available to third parties for advertising purposes.

7. Your rights

The GDPR guarantees you several rights:

• Right of access: to know whether data concerning you is processed, and to obtain a copy of it.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure (right to be forgotten): to have your data deleted.
• Right to restriction: to request that the processing be restricted.
• Right to portability: to retrieve your data in a structured format and transmit it to another party.
• Right to object: to object to the processing of your data on grounds relating to your particular situation.
• Right to withdraw consent (where the processing is based on consent).
• Right to request a non-automated / non-AI-assisted review.
• Right to lodge a complaint with the CNIL: www.cnil.fr.

How to exercise these rights?

1. First contact the company recruiting you, using the details in your invitation. It is that company that is responsible for your data.
2. If you run into difficulty, or if you are not sure who to turn to, write to privacy@pre-hire.com. We forward your request to the right contact and make sure it is handled.

8. Where your data is located

Your data (CV, videos, transcripts) is stored within the European Union.

The artificial intelligence models that transcribe your answers and extract the information from your CV are also hosted within the European Union.

A few peripheral technical services (sending emails, payment, hosting infrastructure) involve providers whose parent company is established outside the EU. These relationships are governed by the Standard Contractual Clauses adopted by the European Commission, together with additional technical measures (encryption, access control). For more details: List of subprocessors.

9. Security of your data

Your data is protected by appropriate technical and organisational measures:

• encryption of communications via TLS;
• encryption at rest of videos and transcripts;
• role-based access control;
• logging and monitoring of access;
• regular backups;
• a confidentiality obligation imposed on everyone involved.

In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed directly, in accordance with Article 34 of the GDPR.

10. Data Protection Officer (DPO)

PreHire's Data Protection Officer can be reached at: dpo@pre-hire.com.

11. Complaints

If you believe that the processing of your personal data does not comply with the regulations, you can:

• contact us to attempt an amicable resolution;
• lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés).

12. 5-point summary

1. It is the company recruiting you that is responsible for your data, not PreHire.
2. The AI helps the Recruiter save time, but it is the Recruiter who makes all the decisions concerning your application.
3. The AI does not analyse any biometric data, nor your voice, nor your expressions, nor your emotions. It analyses textual content only. The AI models are hosted in the European Union.
4. Your videos and data are never used to train AI models, nor sold, nor used for advertising purposes.
5. You have the right of access, rectification, deletion, and to request a review without algorithmic assistance. To exercise a right, contact the company recruiting you, or write to privacy@pre-hire.com.

13. Contact

• Privacy: privacy@pre-hire.com
• DPO: dpo@pre-hire.com
• Support: support@pre-hire.com
• Phone: +33 9 80 40 06 22