On May 25, 2018, the European Union’s next generation of data protection law, the General Data Protection Regulation (the “GDPR”), is set to go into effect. The GDPR aims to strengthen the security and protection of personal data and will replace the 1995 European Union Data Protection Directive.
The GDPR imposes requirements both on “controllers” (those who determine the purposes and means of processing personal data, such as TextRecruit customers) and “processors” (those who process personal data on behalf of a controller, such as TextRecruit) regarding the processing of the personal data of “data subjects” (the candidates or employees who are the subject of personal data).
The purpose of this document is to explain how the TextRecruit Talent Platform will support TextRecruit customers in complying with GDPR requirements regarding:
1. Lawful processing, consent, and notification of data subjects
2. Data subject rights, including:
A. Right to erasure of personal data
B. Data access rights
C. Rectification and correction of data
D. Restriction of processing
E. Portability of data
As the data controller, you (the customer) must determine whether you have a lawful basis to process the candidate’s data, and whether you will obtain consent from the candidate. If you determine that you need consent, then it is your responsibility to obtain that consent. If you are utilizing our TextApply and/or JobChat products, we can enable the ability to confirm residence and gather consent from new candidates you may receive via those products. It is also your responsibility as the data controller to provide any required notification to the candidates. Your existing candidate sources (ATS, etc.) are likely able to assist you in managing consent and notification, but you should confirm that with your ATS provider.
It is your responsibility to provide a mechanism through which candidates and employees may exercise their data subject rights. There is the potential that data subject right requests may be made via a message within the TextRecruit platform (i.e. the candidate sends a text message to your TextRecruit phone number). It will be up to you to determine whether to comply with those requests, and to make sure they are executed. If TextRecruit receives a Data Access Request it will reroute the request to the customer and await directions from the controller. The summary below explains how the TextRecruit platform can assist you in executing data subject right requests.
You as the Customer have a direct relationship with your candidates/employees and TextRecruit does not. Therefore you will be receiving any requests to be forgotten or profile deletion request. There is the potential these requests will come in via a message within the TextRecruit platform (i.e. the candidate sends a text message to your TextRecruit phone number requesting you delete their profile).
Upon receipt of a request to be forgotten or a profile deletion request, you may open a ticket with the TextRecruit Support Team (email@example.com). You will receive a ticket number that will track the process on TextRecruit’s side to delete the candidate and related information from our platform. Please be sure to provide the candidate’s ID in your request. You can simply copy the URL from your browser when you are viewing the candidate. Here is an example URL:).
TextRecruit will purge the information for this candidate/employee, in accordance with TextRecruit’s record deletion processes, including:
Upon completion of the purge, TextRecruit will update the ticket and mark it as closed, and you will receive a notification that this ticket has been completed.
Upon receipt of one of these requests, you can download the candidate/employee’s information via the TextRecruit Web Application. Browse to the candidate profile within the product and under the ‘Actions’ menu select ‘Download Data’. This will export the candidate/employee’s data to a PDF. The PDF will contain the following information:
Upon receipt of one of these requests, you can update almost all information about the candidate via the TextRecruit Web Application.
Note: If there is some piece of data that the candidate/employee is requesting to be updated that you cannot change in the product, please open a ticket with TextRecruit Support (firstname.lastname@example.org). Please be sure to provide the specific data that needs to be updated and the candidate’s ID in your request. You can simply copy the URL from your browser when you are viewing the candidate, here is an example URL:).
The candidate/employee can text the word STOP to your TextRecruit phone number. This action will stop any further communication of processing of the candidate/employee’s data. You may also mark the candidate as ‘Do Not Text’ from within the TextRecruit Web Application — to do so, browse to the candidate profile and from the ‘Actions’ button select ‘Mark “Do Not Text”‘ from the drop down.
The objection should be provided by the candidate via an appropriate channel of communication determined by the customer (You). There is no specific capability within the TextRecruit Platform to receive or manage objections. Based on the information above, the customer should ensure an appropriate process is in place to comply with objection requests.