DPA Schedule: Recruitment Screener
1. Applicant Data
1.1 "Applicants" are people who apply for a job with the Customer and whose application the Customer uploads to the Recruitment Screener. "Applicant Data" is personal data relating to Applicants processed through the Platform.
1.2 Applicant Data is processed on the same terms as Talent Data. Every provision of the DPA that applies to Talent Data applies equally to Applicant Data, except as set out in this Schedule.
1.3 Where an Applicant is engaged by the Customer, their Applicant Data becomes part of their Talent Data.
2. Details of Processing
| Element | Detail |
|---|---|
| Subject matter | AI-assisted first-stage screening of job applicants: reading applications, inviting Applicants to an AI screening call, conducting and transcribing the call, and preparing a screening report |
| Nature of processing | Storage of uploaded application files; extraction of contact details and a summary of experience, education and availability; generation of screening questions; sending an invitation email; AI-conducted voice calls, recording and transcription; AI-assisted scoring against criteria set by the Customer; generation of reports; deletion |
| Purpose | To help the Customer assess Applicants fairly and consistently and decide who to take forward in its recruitment process; and, on the Customer's instructions, to compare the screening of Applicants who are engaged with their later Talent Data, to help the Customer refine its recruitment criteria |
| Data subjects | Applicants |
| Categories of personal data | The uploaded application file; name; mobile telephone number (including the number an Applicant texts from); email address; the restaurant applied to; a summary of experience, education and availability; whether the Applicant is under 18; voice recordings of screening calls; call transcripts; answers to screening questions; AI-generated summaries, scores, evidence and screening reports |
| Data not extracted | The Processor does not extract, analyse or use the following, even where an application file contains them: date of birth (other than whether the Applicant is under 18), health or disability information, criminal-record declarations, parent or guardian details, a full home address, photographs, marital or family status, National Insurance number, nationality or immigration status, languages spoken, or referees. They remain only in the application file until it is deleted under clause 4. |
| Special category and criminal offence data | An application file may contain health information (Article 9 UK GDPR) or criminal offence information (Article 10 UK GDPR). The Processor stores the file on the Controller's instructions but does not otherwise process that information. The Controller is responsible for any lawful basis and condition that its collection of such information requires. |
3. Decisions about Applicants
3.1 The Recruitment Screener does not make decisions about Applicants. It produces an assessment and a recommendation, calculated by a fixed rule stated on every report from scores that each rest on evidence from the call; it never rejects an Applicant.
3.2 The Controller will ensure that a person reviews the evidence and makes every decision about an Applicant, and that an Applicant who asks can have their assessment reviewed by a person. The Controller will not use the Recruitment Screener to make decisions based solely on automated processing within the meaning of Article 22 UK GDPR.
3.3 The assessment does not take account of protected characteristics under the Equality Act 2010, or of how an Applicant speaks (accent, fluency or grammar). The Processor will not score criteria set by the Controller that would require it, and will say so on the report.
4. Retention and Deletion
| Data type | Default retention period | Customer-configurable? |
|---|---|---|
| Uploaded application files | 180 days from upload | No - automatically and permanently deleted |
| Voice recordings of screening calls | As for voice recordings in the DPA (90 days from the date of the call) | As in the DPA |
| All other Applicant Data | Until the Customer deletes the Applicant | Yes - the Customer may delete an Applicant at any time via the Platform. This erases their Applicant Data (details, recordings including the sub-processor's copy, transcripts, answers, assessment and report), retaining only an anonymised record that a screening took place, for billing |
5. Controller Responsibilities
The Controller is responsible for:
- its lawful basis for screening Applicants, and for uploading their applications to the Platform;
- telling Applicants, in its own privacy information for job applicants, that it uses an AI screening service provided by a processor;
- deciding which Applicants to take forward, and reviewing an assessment when an Applicant asks for a person to do so;
- deleting the Applicant Data of unsuccessful Applicants when it no longer needs it.
The Processor tells each Applicant, in the invitation email and at the start of the call, that they will speak to an AI assistant, that the call is recorded for the Controller's hiring team, that a person at the Controller makes every hiring decision, and that they can ask to speak to a person at any time. It links Applicants to its applicant privacy notice at jaluru.com/applicants.html.