Privacy Notice
for Candidates
Status: 01/04/2026
Introduction
This Candidate Privacy Notice explains how Hays collects, uses, shares, and protects your personal data when you engage with us or are contacted by us in connection with work related opportunities.
This Privacy Notice is effective from 01. april 2026.
Who is this notice for
This Candidate Privacy Notice applies to you if you engage with Hays as a candidate for permanent or temporary employment, or as a freelancer/contractor. It also applies if your profile or application has been introduced to Hays by another recruitment supplier, agency, or similar intermediary.
If you are seeking employment with Hays internally, you should refer to our Internal Recruitment Privacy Notice.
Who we are
We are Hays Group (“we”, “us”). We are the data controller, which means we decide how and why your personal data is used during recruitment. Depending on your country and the type of opportunities you are pursuing, different Hays entities may be responsible for the processing of your personal data. We provide a full list of the Hays data controllers which apply to you while reading this Candidate Privacy Notice in Appendix 1 below.
What personal data we collect
We only collect personal data that is necessary to engage with you in connection with work-related opportunies, including the assessment of your profile, and, where applicable, the initaition, administration, and performance of any resulting contracutal relationship. Certain personal data (such as your CV and contact details) is required to assess your suitability and progress your application. If you do not provide this information, we may be unable to consider you for roles or continue the recruitment process.
Personal data you provide directly
- Name and contact details
- CV/resumé, work history, qualifications, education
- Skills, certifications, professional memberships
- Current and expected renumeration and benefits, or pay rate
- Cover letters, questionnaires, assessment responses
- Interview notes, meeting and call transcriptions, or recordings (if applicable)
- Bank account information
- Other information you may choose to share with us, such as photograph, date of birth, nationality, next-of-kin
Sensitive or special category data (collected only when lawful and appropriate)
- Health or disability information (used to provide adjustments)
- Diversity information [e.g., ethnicity, gender, sexual orientation, religious affiliation, etc.] (only where permitted by law and subject to your explicit consent)
- Vaccination or health screening data (only for roles requiring it)
- Criminal background checks (only where permitted by law and for roles requiring it)
Personal data we collect indirectly from other sources
- References and employment verification
- Background screening (including right to work, education/qualification verification) from providers we contract with (where legal and appropriate)
- Interview or role-specific feedback from our clients
- Your published professional profile (e.g., LinkedIn)
- CV/resumé or employment details provided to us by another recruitment agency, managed service provider, or recruitment outscourcer
Personal data we collect automatically
- IP address and device identifiers
- Log data (dates/times you access our platform)
- Cookie or tracking data if you browse our website, apps, use our online recruitment systems or interact with our marketing emails
- Behavioural insights (e.g., jobs viewed, interaction history)
Please note the above list of categories of personal data is not exhaustive and is subject to change depending on legal obligations, our legitimate interest, or through your explicit consent.
Where we obtain personal data from
In many cases, we collect your personal data directly from you, for example when you submit your CV, apply for a role, communicate with us, or otherwise engage with our (recruitment) services.
However, in some circumstances we may also receive personal data about you from other sources, including:
- Recruitment suppliers, agencies or other intermediaries who introduce your profile to us in connection with potential work opportunities
- Your current or former employer, referees, or professional contacts, where you have asked them to share your details with us or where this is appropriate in the recruitment context
- Publicly available sources, such as professional networking platforms, job boards, talent pools, company websites or other online sources, where your personal data is made publicly accessible for professional or recruitment purposes
- Third-party service providers we work with in the recruitment process, for example providers of skills assessments, background checks (where permitted by law), or similar services
Where we obtain your personal data from third parties or publicly available sources, we do so only where this is permitted by applicable data protection laws and where we have a lawful basis to process your data. We will use such personal data in accordance with this Candidate Privacy Notice and for the purposes described in it.
How we use your personal data
The legal bases we rely on for our recruitment related activities may differ depending on the country you are located in. While we generally process personal data on the basis of contractual necessity, legal obligation, or our legitimate interests where permitted by applicable law, we may rely on your consent for certain processing activities or in jurisdictions where consent is the primary lawful basis for processing. Where we rely on your consent, you may withdraw it at any time in accordance with applicable law. Further information on country specific requirements is set out in Appendix 1.
Where we rely on our legitimate interests to process your personal data, these interests are primarily connected to operating an effective, high quality and responsible recruitment business. In particular, our legitimate interests include:
- identifying and matching suitably qualified candidates with relevant job opportunities;
- maintaining an up to date candidate database to enable timely and efficient recruitment activities;
- improving the quality, accuracy and efficiency of our recruitment technology, services and processes;
- meeting the expectations of our clients by presenting suitable candidates for roles they are seeking to fill;
- preventing fraud, misuse of our services and ensuring the security of our systems; and
- establishing, exercising or defending legal claims.
We carefully consider the impact of such processing on your rights and freedoms and apply appropriate safeguards.
Purposes & Legal Bases
| Purpose | What We Do | Legal Basis |
|---|---|---|
Pre recruitment activities |
Determine whether you might be interested in or benefit from our recruitment services. Our legitimate interest is to proactively identify and approach potential candidates in order to offer relevant career opportunities and recruitment support. |
Legitimate Interests |
Process your application |
Review your CV, assess suitability, conduct interviews & tests. Our legitimate interest is to assess your suitability for roles and to efficiently match qualified candidates with relevant job opportunities. |
Legitimate Interests; Contract |
Communicate with you |
Schedule interviews, request info, send updates, manage our relationship with you. Our legitimate interest is to manage the recruitment process effectively, keep you informed, and maintain an appropriate and ongoing candidate relationship. |
Legitimate Interests; Contract |
Post recruitment relationship |
Maintain an ongoing relationship with you or support you in your next role. Our legitimate interest is to maintain an ongoing professional relationship with you and support you in identifying future career opportunities. |
Legitimate Interests |
ID/Background/reference checks/compliance checks/sanction list checks |
Verify your ID, qualifications, work history, right to work, criminal checks (only where legally permitted), compliance and sanction lists checks. |
Legal Obligation; Legitimate Interests; Consent where required |
Skills or psychometric assessments |
Run role specific tests with human review (only where legally permitted). Our legitimate interest is to assess role relevant skills, competencies and suitability in order to improve the accuracy and fairness of candidate matching and to support informed recruitment decisions, always with human review. |
Legitimate Interests |
Provide reasonable adjustments |
Use health/disability info to adapt our recruitment process. |
Consent; Employment law obligations |
Diversity & equal opportunities monitoring |
Use diversity data in aggregated, anonymous form only. |
Consent; Legal Obligation |
Including you in our Candidate/Talent Pool |
Retain your CV to match you with future roles we may believe are suitable. Our legitimate interest is to maintain an organised and searchable database of candidates in order to efficiently match individuals with current and future job opportunities, reduce repeated data collection, and provide ongoing recruitment support. |
Legitimate Interests |
Administration |
Make records, including transcriptions of meetings with you, to allow our consultants to focus on their relationship with you, to ensure our information is accurate and up to date, and improve the quality of our systems and processes. Our legitimate interest is to accurately document recruitment related conversations, improve the quality and consistency of our recruitment processes, and allow our consultants to focus on meaningful engagement with candidates rather than manual note taking. |
Legitimate Interests; Consent |
Other recruitment related services |
Offering you a related service, such as CV writing guidance, trainings, carreer coaching. Our legitimate interest is to provide additional recruitment related support that may enhance your employability and career prospects. |
Legitimate Interests |
Service improvement |
Improve your experience and develop or optimise our recruitment technology, to analyse how our recruitment services are used and to build new, or to improve the quality, effectiveness and reliability of our processes, tools and candidate experience. Our legitimate interest is to ensure that our recruitment services remain accurate, efficient and relevant, and that candidates are presented with suitable opportunities in a timely manner. |
Legitimate Interests |
Marketing |
To contact you about future opportunities, networking events, industry insights, or about vacancies we believe we can help you to fill. Where we rely on our legitimate interests for recruitment related communications, this is limited to communications about similar roles or services that are relevant to your professional profile and expectations. |
Consent; Legitimate Interests |
Advertising |
To present you with adverts and other content that we think are relevant to you, on other digital channels. Or to use your data to create profiles we may use to promote our services. |
Consent |
Analysis |
Use insights to better understand employment trends and insights across industries. Our legitimate interest is to analyse recruitment trends and outcomes in order to improve our services and better understand labour market developments. |
Legitimate Interests |
Anonymisation of data |
Process personal data in order to anonymise it, thereby enabling its further use for lawful purposes such as testing, statistical analysis, and the improvement or development of our products and services, without identifying individuals. Our legitimate interest is to anonymise personal data in order to enable its further use for statistical analysis, testing, and the improvement or development of our recruitment services, while no longer identifying individuals. |
Legitimate Interests |
Legal, regulatory & compliance |
Keep necessary records, respond to authorities, prevent fraud, establish, exercise or defend ourselves from legal claims. Respond to and participate in client audits and fulfil our client compliance obligations. Our legitimate interest is to fulfil client audit and compliance requirements, ensure transparency and accountability in the provision of our recruitment services, and maintain trusted business relationships with our clients. |
Legal Obligation; Legitimate Interests |
Customer satisfaction |
Assess and improve customer (client and candidate) satisfaction, including through surveys and feedback analysis. Our legitimate interest is to assess and improve the quality, effectiveness and reliability of our recruitment services for candidates and clients. |
Legitimate Interests |
Investigation/Whistleblowing |
Investigate or respond to any incidents, complaints or grievances involving you and prepare reports in relation to the same. Our legitimate interest is to investigate and respond to reported incidents, complaints or suspected misconduct, and to protect the integrity of our business, our candidates, and other stakeholders, including by establishing, exercising or defending legal claims. |
Legitimate Interests Legal Obligation |
Business relationship |
For freelancers/contractors, process: personal data necessary for the provision of services including, performance monitoring and billing. |
Contract, Legitimate interests, Legal Obligation |
Profiling / automated tools |
Use automated tools to help screen or match applications (never fully automated final decisions), building profiles to enable us to provide the best possible service and maximise the relevance of opportunities and content we provide to you. Our legitimate interest is to support our consultants by improving the relevance of job matching, reducing administrative workload, and ensuring that candidates are considered for roles aligned with their skills and experience. Automated tools are used only to support human decision making and never to make fully automated final hiring decisions. |
Legitimate Interests; Consent where required |
You have the right to object at any time to personal data processing where we have explained that we rely on Legitimate Interest. Please see the “How to exercise your rights and contact us” section.
We do NOT sell your personal data to third parties.
This includes for California Consumer Privacy Act/California Privacy Rights Act purposes.
What is the candidate pool and how do we use it
If your details are held in our database, they form part of our “Candidate Pool”. This allows us to store and update your information, track your progress through recruitment processes, and consider you for current and future job opportunities. Our consultants regularly search the Candidate Pool to identify potential matches. If we find a role that may be suitable, we will contact you to check whether you are interested. If you are, we will continue the recruitment process with you; if not, your details will remain in the Candidate Pool so that we can consider you for other opportunities and continue offering you recruitment‑related support (such as training opportunities, salary guides, or guidance on CVs and interviews).
If you object we will record and respect your objection and, where needed, work with you to understand which processing you no longer want us to carry out.
How long we retain your personal data for
We follow Hays’ Group Data Retention Policy. Your personal data will be retained only for as long as required to meet legal obligations, where we have an ongoing relationship with you, or where we have a legitimate business interest.
Examples of legitimate interests include:
- Keeping records of recruitment decisions
- Considering you for future roles
- Fulfilling audit or compliance requirements
When personal data is no longer needed, it is securely deleted or anonymised. We provide more information on the retention duration which applies to you in Appendix 1 below.
Who we share your personal data with
We may share your personal data with:
| Recipient | Why We Share |
|---|---|
|
Clients |
When you apply for a role with them or a role they sponsor |
|
Recruitment technology providers |
To manage applications, assessments, and storage |
|
Background check providers |
When role appropriate and legally permitted |
|
Group companies |
When another group entity participates in the hiring process or supports our operations |
|
Legal or regulatory authorities |
When required by law |
|
(IT/cloud) service providers |
Secure storage, hosting and support our operations |
|
Managed Service Providers |
To support Hays or Hays’ clients in our resourcing and/or recruitement services |
|
Auditors |
As strictly necessary to conduct or participate in Internal or External Audits |
|
Other Organisations |
As strictly necessary during a Merger or Acquisition involving Hays Group or its legal entities |
We require all third parties to protect your data, use it only as instructed, and ensure that appropriate safeguards are in place.
Where we transfer your personal data
Whenever we transfer personal data internationally, we use one or more of the following:
- Adequacy decisions (countries officially recognised as having strong data protection laws)
- Standard Contractual Clauses (SCCs) or similar safeguards
- Other legally approved mechanisms
You may request more information about these safeguards.
What are your rights
- Access your personal data
- Request correction of inaccurate personal data
- Request deletion (with lawful exceptions)
- Restrict certain processing
- Object to processing based on legitimate interests
- Data portability
- Withdraw consent at any time (where processing is based on consent)
- Right to not be subject to an Automated Decision
- Right to complain to our Data Protection Team regarding our processing of your personal data
- Right to complain to your local data protection regulator
How to exercise your rights and contact us
If you wish to exercise any of your rights, or if you have questions or concerns about how your personal data is used, you can contact the relevant Hays entity responsible for processing your personal data. As responsibility may vary depending on your country and the nature of your engagement with us, the appropriate contact details may differ.
We provide a full list of the relevant Hays entities and their contact details, including data protection contact points, in Appendix 1 below.
You may also contact your local data protection regulator/authority if you are not satisfied with our response.
How we use automated decision-making and AI
We are constantly exploring ways in which we can improve our service, and enable our colleagues to help you find the best match for your skills and experience. We use automated tools to support screening or matching, but hiring decisions are never made solely by automated means. Human review is always included. Our use of AI is focussed on connecting the best individuals to the best opportunities, and taking some of the administrative burden off our colleagues so they can spend more time connecting and understanding you and your needs. We will never use AI to fully automate the hiring process, and we will be transparent in our use of AI throughout our hiring processes
How we protect your personal data
We are constantly improving our organisational and technical security measures to keep your data secure, including regular training for our colleagues, role based access controls, cyber threat detection, data encryption, secure data storage, and regular auditing.
Updates to this policy
We may update this policy to reflect changes in our practices or legal requirements. The latest version will always be available on our website and includes an “Effective Date”. Significant changes will be communicated when required.
Anhang 1
- Hays Specialist Recruitment (Denmark) A/S
We adhere to the requirements imposed by the GDPR in relation to the establishment of joint controller relationships between Hays entities.
If you wish to exercise your rights under the GDPR in relation to the processing of your personal data by Hays entities operating on a joint controller basis, please contact us using the channels set out above.
You can reach the Data Protection Team and the responsible Data Protection Officer via email privacy@hays.dk
You can also contact us via mail:
Hays Specialist Recruitment (Denmark) A/S
Data Protection Officer
Kongen Nytorv 8
1050 Copenhagen Municipality
Denmark
We will keep your personal data on our system for a period of up to three years from the point that we collect such personal data or subsequently have meaningful contact with you (or, where appropriate, the company you are working for or with). After this period, it is likely your data will no longer be relevant for the purposes for which it was collected. We may keep your personal data on our systems for a longer period than this if we believe in good faith that we need to do so, for example, because of our obligations to tax authorities or in connection with any anticipated litigation.
We will consider there to be meaningful contact with you in this context if you, for example, submit a CV to us via our website, take part in any of our online training, communicate with us about potential roles (either by verbal or written communication) or click through from any of our marketing communications. Your receipt, opening or reading of an electronic message from us will not count as meaningful contact for these purposes, only where you click-through or reply directly – we will only deem that we have had meaningful contact with you if there is positive action on your part.
For those Candidates whose services are provided via a third party company or other entity, meaningful contact with you means meaningful contact with the company or entity which supplies your services. Where we are notified by such company or entity that it no longer has that relationship with you, we will retain your data for no longer than three years from that point or, if later, for the period of three years from the point we subsequently have meaningful contact directly with you.
For Candidates who only wish for us to process their personal data in relation to a specific application for a role and have objected to be part of the candidate pool, we will only retain your personal data for as long as we need to in connection with our legal and regulatory requirements.
Special categories of personal data
As a primary legal basis, we process special categories of personal data where this is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment, social security and social protection law, in accordance with Article 9(2)(b) GDPR, insofar as such processing is authorised by applicable law and subject to appropriate safeguards.
This may include, in particular, situations where the processing of special categories of personal data is required:
- to assess your eligibility for certain roles or assignments,
- to comply with statutory employment, health and safety, social security or equal opportunity obligations, or
- to meet legal or regulatory requirements applicable to us or our clients in the context of recruitment and placement.
In limited cases, we may rely on your explicit consent pursuant to Article 9(2)(a) GDPR to process special categories of personal data.
Processing Based on Consent
In certain circumstances, we rely on your consent as a legal basis for processing your personal data, including in particular:
- where required under applicable law for specific processing activities;
- for certain marketing or advertising activities;
- for the processing of special categories of personal data within the meaning of Article 9 GDPR, where no other legal basis applies.
Where we rely on your consent, such consent is given freely, is specific, informed, and unambiguous, and may be withdrawn at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
Soft Opt In Consent for Recruitment Related Communications
Where permitted by applicable law, Hays may contact you with recruitment related communications without obtaining separate consent where:
- we obtained your contact details in the context of providing recruitment or placement services to you; and
- the communications relate to similar work related opportunities or services; and
- you were given the opportunity to object to such communications at the time your data was collected and in each subsequent communication.
Retargeting
When you consented to the transfer of data to our advertising partners we send your data (e.g. your email address, your name, your phone number) in an encrypted and pseudonymised way (so called “hashed”) to our advertising partners (for a list of our advertising partners, see below). They compare this data with the data they already process about you and if they match, the partners enable us to run targeted advertising on those matches or on similar groups of people like you, which means the partners display on their platforms Hays advertising which are specially designed for you or for people like you. After the creation of the matches, your encrypted data is automatically deleted again at our partners. The partners do not gain new addresses as a result of this. We think this is a great benefit for you as you get only those advertising which suits your needs.
Hays group companies & Hays advertising partners
When we mention Hays group companies in Germany, Austria, Denmark and Switzerland in the context of our advertising consent wording, we mean the following legal entities:
- Hays AG, based in Germany
- Hays Professional Solutions GmbH, based in Germany
- Hays Talent Solutions GmbH, based in Germany
- Emposo GmbH, based in Germany
- Hays Holding GmbH, based in Germany
- Hays Beteiligungs GmbH & Co.KG, based in Germany
- Hays Vorrat 01 GmbH, based in Germany
- Hays (Schweiz) AG, based in Switzerland
- Hays Talent Solutions (Schweiz) GmbH, based in Switzerland
- Hays Österreich GmbH, based in Austria
- Hays Professional Solutions Österreich GmbH, based in Austria
- Hays Specialist Recruitment Denmark A/S, based in Denmark
When we talk about advertising partners in the context of our advertising consent wording, we mean the following partners:
Transfer outside of the EWR
Where we have asked you for your marketing consent regarding our advertising partners and where those parties are located outside of the European Economic Area, you consent (Art. 49 I a GDPR) to a transfer outside of the European Economic Area, and you are aware that there might be a lower level of data protection with these providers/countries than it is the case in the European Economic Area.
There might be in particular a risk that your data may be accessed through authorities for surveillance purposes, even without legal redress procedures. Exercising data protection rights, you know, and you are familiar with under the GDPR may be more difficult or even impossible.
Market Research Purposes
When you consented to the use of your personal data for market research purposes, this means that we will run surveys regarding satisfaction, NetPromoterScore, personnel topics, wishes, offers, socio-demographic characteristics, new platform testing, test groups, UX testing and brand panels.
