Trakstar Hire and GDPR + Data Privacy - FAQ

Is Trakstar Hire GDPR Compliant?

Yes.

Trakstar Hire has been designed to align with the principles of the General Data Protection Regulation (GDPR). For additional information about Trakstar's GDPR practices, refer to the official GDPR documentation provided by Trakstar. You can read more about our full setup in this document here.

Important: While Trakstar Hire provides features to help support GDPR compliance, each organization is responsible for determining how GDPR applies to its own recruiting processes and data handling practices.

What Is Your Organization's Responsibility?

Under GDPR, your organization acts as the data controller for candidate information collected through Trakstar Hire.

Your team should:

  • Review your organization's GDPR obligations.
  • Establish internal policies for collecting, storing, and deleting candidate data.
  • Determine whether candidate consent should be collected.
  • Consult with your legal counsel to ensure your processes comply with applicable regulations.

Where Is Trakstar Hire Data Stored?

Candidate data stored in Trakstar Hire is hosted on Amazon Web Services (AWS) infrastructure located in the United States.

Collect Candidate Consent During Applications

If your organization chooses to collect consent from applicants as part of the application process, you can add a required consent question to an opening's application form.

To configure a consent question:

  1. Open the desired job opening.
  2. Go to the Job Settings tab.

  3. Edit the application form.

  4. Add a question using the Applicants can choose multiple options question type.
  5. Include a single option, such as Yes.

  6. Mark the question as Required.

Applicants must select Yes before submitting their application.

If you want applicants to agree to an external privacy policy, terms of service, or similar document, include the URL directly in the question text.

URLs beginning with www. or http://www. appear as clickable links on the application form.

Your organization can customize the wording of the consent request to meet its legal requirements.

Managing Candidate Data Under GDPR

Does Trakstar Hire Automatically Delete Candidate Data?

No.

Trakstar Hire does not automatically delete candidate records on your behalf.

Candidate data remains in your account until you delete it manually or request deletion when your account is terminated. Your organization is responsible for defining and following its own data retention policy.

Delete Candidate Data

You can permanently delete candidate data in several ways.

Delete Candidates in Bulk

From the Candidates dashboard, select multiple candidates and use the bulk delete option to permanently remove their records.

Delete an Individual Candidate

Open the candidate's profile and use the available delete option to permanently remove that candidate's information.

Find Older Candidates for Deletion

If your organization deletes candidate records after a specific retention period:

  1. Use Advanced Search.

  2. Filter candidates by Created Between Date.

  3. Delete candidates that meet your retention policy.

Important Information About Deleting Candidate Data

Deleting candidate data is permanent and cannot be undone.

When you delete a candidate from Trakstar Hire:

  • Information stored within Trakstar Hire is permanently removed.
  • Information stored outside Trakstar Hire is not deleted automatically.

Examples of information that must be removed separately include:

  • Emails stored in users' inboxes
  • Calendar invitations
  • Interview evaluation summaries
  • Any other copies stored in external applications or systems

Each user who interacted with the candidate may need to manually remove these records.


GDPR Considerations for EEOC Data Collection

Collecting EEOC Data Under GDPR

Trakstar Hire includes an optional feature for collecting Equal Employment Opportunity Commission (EEOC) information from candidates.

EEOC collection is:

  • Optional.
  • Configured separately for each opening.
  • Completed voluntarily by candidates.

GDPR Considerations for EEOC Information

EEOC information may include data such as race or ethnic origin, which GDPR classifies as special category (sensitive) personal data.

GDPR allows organizations to process this type of information in certain circumstances, including employment-related purposes where processing is necessary to meet legal obligations or exercise employment-related rights.

Because requirements vary by organization and jurisdiction, Trakstar recommends that you:

  • Review your organization's legal obligations.
  • Determine whether EEOC data collection is appropriate.
  • Consult with legal counsel before enabling or using EEOC data collection.

Still need help? Contact Us Contact Us