Candidate data and recording consent

Draft: not legal advice, pending review by counsel. This page is a working draft, not a published candidate notice. Placeholders in square brackets must be replaced and the whole document reviewed by qualified counsel before launch.

1. Who this notice is for

This notice explains what happens to data submitted during a boson interview or screening round. It is written for candidates. The recruiter running the process is responsible for its own notice and for the lawful basis it relies on. See also the privacy policy and the AI use and bias statement.

2. What an interview can capture

Depending on the modules a recruiter includes, a round may capture:

• application answers, questionnaire responses and assessment responses;
• resume text or an uploaded resume;
• code submissions and the output of running that code;
• free-text answers and, where a module supports it, transcripts;
• audio, screen or editor replay recordings where recording is enabled and consent is given;
• technical data needed to run and secure the session, such as device, browser, IP address and event logs.

Not every round uses every category. The invitation and the round itself should show which modules and capture types apply.

3. Consent before capture

Candidates are asked to consent to AI evaluation before a screening run starts. Recording consent is asked separately for each capture type; one consent does not cover another.

Where webcam capture is offered in the product contract, it is optional and off by default. The current capture flow may not offer webcam at all. [Confirm the capture types enabled in the production candidate flow.]

Consent is recorded with the application so a recruiter can see what was agreed and when. A candidate can withdraw consent for future processing; withdrawing consent does not automatically remove data that was lawfully captured before withdrawal. [Confirm the withdrawal process and its effect with counsel.]

4. How recordings are handled

Recordings are stored in a private storage bucket. Access is intended to use short-lived signed URLs, and access to recordings is logged. A recording is linked to a consent record and a retention date.

Recordings are not used to train a public model. [Confirm whether any recording is used for model or product improvement, and document it here.]

5. Retention

Recordings and other candidate data are kept only for as long as the retention policy allows. The repository includes a scheduled recording-retention workflow, but the final periods are still to be confirmed. See the retention schedule for the current placeholders.

6. Asking for a copy or deletion

To ask for a copy of your data, correct it, or request deletion, contact [privacy contact email]. Please include enough information for us to identify the application, such as the role and the email address used.

We aim to respond within [response period]. Some data may need to be kept for legal, security or audit reasons; if so, we will explain what is kept and why. [Confirm the request process, identity checks and statutory timelines with counsel.]

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, or ask for a portable copy of your data. You may also have the right to complain to a supervisory authority. [Add jurisdiction-specific rights and timelines.]

8. Contact

Questions or requests: [privacy contact email].

This draft is not legal advice.