Privacy notice
for candidates
Status: 01/04/2026
Introduction
This Candidate Privacy Notice explains how Hays collects, uses, shares, and protects your personal data when you engage with us or are contacted by us in connection with work related opportunities.
This Privacy Notice is effective from 01. April 2026
Who is this notice for
This Candidate Privacy Notice applies to you if you engage with Hays as a candidate for permanent or temporary employment, or as a freelancer/contractor. It also applies if your profile or application has been introduced to Hays by another recruitment supplier, agency, or similar intermediary.
If you are seeking employment with Hays internally, you should refer to our Internal Recruitment Privacy Notice.
Who we are
What personal data we collect
- Name and contact details
- CV/resumé, work history, qualifications, education
- Skills, certifications, professional memberships
- Current and expected renumeration and benefits, or pay rate
- Cover letters, questionnaires, assessment responses
- Interview notes, meeting and call transcriptions, or recordings (if applicable)
- Bank account information
- Other information you may choose to share with us, such as photograph, date of birth, nationality, next-of-kin
- Health or disability information (used to provide adjustments)
- Diversity information [e.g., ethnicity, gender, sexual orientation, religious affiliation, etc.] (only where permitted by law and subject to your explicit consent)
- Vaccination or health screening data (only for roles requiring it)
- Criminal background checks (only where permitted by law and for roles requiring it)
- References and employment verification
- Background screening (including right to work, education/qualification verification) from providers we contract with (where legal and appropriate)
- Interview or role-specific feedback from our clients
- Your published professional profile (e.g., LinkedIn)
- CV/resumé or employment details provided to us by another recruitment agency, managed service provider, or recruitment outscourcer
- IP address and device identifiers
- Log data (dates/times you access our platform)
- Cookie or tracking data if you browse our website, apps, use our online recruitment systems or interact with our marketing emails
- Behavioural insights (e.g., jobs viewed, interaction history)
Where we obtain personal data from
However, in some circumstances we may also receive personal data about you from other sources, including:
- Recruitment suppliers, agencies or other intermediaries who introduce your profile to us in connection with potential work opportunities
- Your current or former employer, referees, or professional contacts, where you have asked them to share your details with us or where this is appropriate in the recruitment context
- Publicly available sources, such as professional networking platforms, job boards, talent pools, company websites or other online sources, where your personal data is made publicly accessible for professional or recruitment purposes
- Third-party service providers we work with in the recruitment process, for example providers of skills assessments, background checks (where permitted by law), or similar services
How we use your personal data
The legal bases we rely on for our recruitment related activities may differ depending on the country you are located in. While we generally process personal data on the basis of contractual necessity, legal obligation, or our legitimate interests where permitted by applicable law, we may rely on your consent for certain processing activities or in jurisdictions where consent is the primary lawful basis for processing. Where we rely on your consent, you may withdraw it at any time in accordance with applicable law. Further information on country specific requirements is set out in Appendix 1.
- identifying and matching suitably qualified candidates with relevant job opportunities;
- maintaining an up to date candidate database to enable timely and efficient recruitment activities;
- improving the quality, accuracy and efficiency of our recruitment technology, services and processes;
- meeting the expectations of our clients by presenting suitable candidates for roles they are seeking to fill;
- preventing fraud, misuse of our services and ensuring the security of our systems; and
- establishing, exercising or defending legal claims.
Purposes & Legas Bases
| Purpose | What we do | Legal basis |
|---|---|---|
|
Pre recruitment activities |
Determine whether you might be interested in or benefit from our recruitment services. Our legitimate interest is to proactively identify and approach potential candidates in order to offer relevant career opportunities and recruitment support. |
Legitimate Interests |
|
Process your application |
Review your CV, assess suitability, conduct interviews & tests. Our legitimate interest is to assess your suitability for roles and to efficiently match qualified candidates with relevant job opportunities. |
Legitimate Interests; Contract |
|
Communicate with you |
Maintain an ongoing relationship with you or support you in your next role. Our legitimate interest is to maintain an ongoing professional relationship with you and support you in identifying future career opportunities. |
Legitimate Interests |
|
Post recruitment relationship |
Maintain an ongoing relationship with you or support you in your next role. Our legitimate interest is to maintain an ongoing professional relationship with you and support you in identifying future career opportunities. |
Legitimate Interests |
|
ID / Background / Reference / Compliance / Sanction list checks |
Verify your ID, qualifications, work history, right to work, criminal checks (only where legally permitted), compliance and sanction list checks. |
Legal Obligation; Legitimate Interests; Consent where required |
|
Skills or psychometric assessments |
Run role specific tests with human review (only where legally permitted). Our legitimate interest is to assess role relevant skills, competencies and suitability in order to improve the accuracy and fairness of candidate matching and to support informed recruitment decisions, always with human review. |
Legitimate Interests |
|
Diversity & equal opportunities monitoring |
Use diversity data in aggregated, anonymous form only. |
Consent; Legal Obligation |
|
Including you in our Candidate / Talent Pool |
Retain your CV to match you with future roles we may believe are suitable. Our legitimate interest is to maintain an organised and searchable database of candidates in order to efficiently match individuals with current and future job opportunities, reduce repeated data collection, and provide ongoing recruitment support. |
Legitimate Interests |
|
Administration |
Make records, including transcriptions of meetings with you, to allow our consultants to focus on their relationship with you, ensure our information is accurate and up to date, and improve the quality of our systems and processes. Our legitimate interest is to accurately document recruitment related conversations, improve the quality and consistency of our recruitment processes, and allow our consultants to focus on meaningful engagement with candidates rather than manual note taking. |
Legitimate Interests; Consent |
|
Other recruitment related services |
Offering you a related service, such as CV writing guidance, trainings, career coaching. Our legitimate interest is to provide additional recruitment related support that may enhance your employability and career prospects. |
Legitimate Interests |
|
Service improvement |
Improve your experience and develop or optimise our recruitment technology, analyse how our recruitment services are used and improve the quality, effectiveness and reliability of our processes, tools and candidate experience. Our legitimate interest is to ensure that our recruitment services remain accurate, efficient and relevant, and that candidates are presented with suitable opportunities in a timely manner. |
Legitimate Interests |
|
Advertising |
Present you with adverts and other content we believe are relevant to you on other digital channels, or use your data to create profiles to promote our services. |
Consent |
|
Analyse |
Use insights to better understand employment trends and insights across industries. Our legitimate interest is to analyse recruitment trends and outcomes in order to improve our services and better understand labour market developments. |
Legitimate Interests |
|
Anonymisation of data |
Process personal data in order to anonymise it, enabling further lawful use such as testing, statistical analysis, and the improvement or development of our products and services without identifying individuals. Our legitimate interest is to anonymise personal data to enable further use for statistical analysis, testing and service improvement without identifying individuals. |
Legitimate Interests |
|
Legal, regulatory & compliance |
Keep necessary records, respond to authorities, prevent fraud, establish, exercise or defend legal claims, participate in client audits and fulfil compliance obligations. Our legitimate interest is to fulfil audit and compliance requirements, ensure transparency and accountability, and maintain trusted client relationships. |
Legal Obligation; Legitimate Interests |
|
Customer satisfaction |
Assess and improve customer (client and candidate) satisfaction through surveys and feedback analysis. Our legitimate interest is to assess and improve the quality, effectiveness and reliability of our recruitment services. |
Legitimate Interests |
|
Business relationship |
Investigate or respond to incidents, complaints or grievances involving you and prepare related reports. Our legitimate interest is to investigate incidents, protect our business and stakeholders, and establish, exercise or defend legal claims. |
Legitimate Interests; Legal Obligation |
|
Profiling / automated tools |
Use automated tools to help screen or match applications (never fully automated final decisions) and build profiles to maximise relevance of opportunities and content. Our legitimate interest is to support consultants by improving matching relevance, reducing administrative workload and ensuring candidates are considered for suitable roles. Automated tools only support human decision making. |
Legitimate Interests; Consent where required |
You have the right to object at any time to personal data processing where we have explained that we rely on Legitimate Interest. Please see the “How to exercise your rights and contact us” section.
We do NOT sell your personal data to third parties.
This includes for California Consumer Privacy Act/California Privacy Rights Act purposes.
What is the candidate pool and how do we use it
If your details are held in our database, they form part of our “Candidate Pool”. This allows us to store and update your information, track your progress through recruitment processes, and consider you for current and future job opportunities. Our consultants regularly search the Candidate Pool to identify potential matches. If we find a role that may be suitable, we will contact you to check whether you are interested. If you are, we will continue the recruitment process with you; if not, your details will remain in the Candidate Pool so that we can consider you for other opportunities and continue offering you recruitment‑related support (such as training opportunities, salary guides, or guidance on CVs and interviews).
If you object we will record and respect your objection and, where needed, work with you to understand which processing you no longer want us to carry out.
How long we retain your personal data for
We follow Hays’ Group Data Retention Policy. Your personal data will be retained only for as long as required to meet legal obligations, where we have an ongoing relationship with you, or where we have a legitimate business interest
- Keeping records of recruitment decisions
- Considering you for future roles
- Fulfilling audit or compliance requirements
When personal data is no longer needed, it is securely deleted or anonymised. We provide more information on the retention duration which applies to you in Appendix 1 below.
Who we share your personal data with
We may share your personal data with:
| Recipient | Why We Share | Legal Basis |
|---|---|---|
|
Clients |
When you apply for a role with them or a role they sponsor. |
Legitimate interests; performance of a contract where applicable |
|
Recruitment technology providers |
To manage applications, assessments, and storage. |
Legitimate interests |
|
Background check providers |
When role appropriate and legally permitted. |
Legal obligation; legitimate interests; consent where required |
|
Group companies |
When another group entity participates in the hiring process or supports our operations. |
Legitimate interests |
|
Legal or regulatory authorities |
When required by law. |
Legal obligation |
|
(IT/cloud) service providers |
Secure storage, hosting and supporting our operations. |
Legitimate interests |
|
Managed Service Providers |
To support Hays or Hays’ clients in our resourcing and/or recruitment services. |
Legitimate interests; performance of a contract where applicable |
|
Auditors |
As strictly necessary to conduct or participate in internal or external audits. |
Legal obligation; legitimate interests |
|
Other Organisations |
As strictly necessary during a merger or acquisition involving Hays Group or its legal entities. |
Legitimate interests |
We require all third parties to protect your data, use it only as instructed, and ensure that appropriate safeguards are in place.
Where we transfer your personal data
As we are a multi-national organisation, your data may be accessed or stored in countries outside your home country.
- Adequacy decisions (countries officially recognised as having strong data protection laws)
- Standard Contractual Clauses (SCCs) or similar safeguards
- Other legally approved mechanisms
Where necessary, we complete Data Transfer Impact Assessments to assess the risk of transferring your personal data, and to ensure that we have acceptable safeguards in place.
You may request more information about these safeguards.
What are your rights
Depending on your location, you may have the following rights:
- Access your personal data
- Request correction of inaccurate personal data
- Request deletion (with lawful exceptions)
- Restrict certain processing
- Object to processing based on legitimate interests
- Data portability
- Withdraw consent at any time (where processing is based on consent)
- Right to not be subject to an Automated Decision
- Right to complain to our Data Protection Team regarding our processing of your personal data
- Right to complain to your local data protection regulator
How to exercise your rights and contact us
If you wish to exercise any of your rights, or if you have questions or concerns about how your personal data is used, you can contact the relevant Hays entity responsible for processing your personal data. As responsibility may vary depending on your country and the nature of your engagement with us, the appropriate contact details may differ.
We provide a full list of the relevant Hays entities and their contact details, including data protection contact points, in Appendix 1 below.
You may also contact your local data protection regulator/authority if you are not satisfied with our response.
How we use automated decision-making and AI
We are constantly exploring ways in which we can improve our service, and enable our colleagues to help you find the best match for your skills and experience. We use automated tools to support screening or matching, but hiring decisions are never made solely by automated means. Human review is always included. Our use of AI is focussed on connecting the best individuals to the best opportunities, and taking some of the administrative burden off our colleagues so they can spend more time connecting and understanding you and your needs. We will never use AI to fully automate the hiring process, and we will be transparent in our use of AI throughout our hiring processes.
How we protect your personal data
We are constantly improving our organisational and technical security measures to keep your data secure, including regular training for our colleagues, role based access controls, cyber threat detection, data encryption, secure data storage, and regular auditing.
Updates to this policy
We may update this policy to reflect changes in our practices or legal requirements. The latest version will always be available on our website and includes an “Effective Date”. Significant changes will be communicated when required.
Appendix 1
- Hays AG
- Hays Professional Solutions GmbH
- Hays Talent Solutions GmbH
- Emposo GmbH
- Hays Holding GmbH
- Hays Beteiligungs GmbH & Co. KG
If you wish to exercise your rights under the GDPR in relation to the processing of your personal data by Hays entities operating on a joint controller basis, please contact us using the channels set out above.
You can reach the Data Protection Team and the responsible Data Protection Officer via email
datenschutz@hays.de
You can also contact us via mail:
Hays AG
z. Hd. Datenschutzbeauftragter / DPO
Glücksteinallee 67
68163 Mannheim
Deutschland
We will keep your personal data on our system for a period of up to three years from the point that we collect such personal data or subsequently have meaningful contact with you (or, where appropriate, the company you are working for or with). After this period, it is likely your data will no longer be relevant for the purposes for which it was collected. We may keep your personal data on our systems for a longer period than this if we believe in good faith that we need to do so, for example, because of our obligations to tax authorities or in connection with any anticipated litigation.
We will consider there to be meaningful contact with you in this context if you, for example, submit a CV to us via our website, take part in any of our online training, communicate with us about potential roles (either by verbal or written communication) or click through from any of our marketing communications. Your receipt, opening or reading of an electronic message from us will not count as meaningful contact for these purposes, only where you click-through or reply directly – we will only deem that we have had meaningful contact with you if there is positive action on your part.
For those Candidates whose services are provided via a third party company or other entity, meaningful contact with you means meaningful contact with the company or entity which supplies your services. Where we are notified by such company or entity that it no longer has that relationship with you, we will retain your data for no longer than three years from that point or, if later, for the period of three years from the point we subsequently have meaningful contact directly with you.
For Candidates who only wish for us to process their personal data in relation to a specific application for a role and have objected to be part of the candidate pool, we will only retain your personal data for as long as we need to in connection with our legal and regulatory requirements.
As a primary legal basis, we process special categories of personal data where this is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment, social security and social protection law, in accordance with Article 9(2)(b) GDPR, insofar as such processing is authorised by applicable law and subject to appropriate safeguards.
This may include, in particular, situations where the processing of special categories of personal data is required:
- to assess your eligibility for certain roles or assignments,
- to comply with statutory employment, health and safety, social security or equal opportunity obligations, or
- to meet legal or regulatory requirements applicable to us or our clients in the context of recruitment and placement.
In limited cases, we may rely on your explicit consent pursuant to Article 9(2)(a) GDPR to process special categories of personal data.
Processing Based on Consent
In certain circumstances, we rely on your consent as a legal basis for processing your personal data, including in particular:
where required under applicable law for specific processing activities;
- for certain marketing or advertising activities;
- for the processing of special categories of personal data within the meaning of Article 9 GDPR, where no other legal basis applies.
Soft Opt In Consent for Recruitment Related Communications
Where permitted by applicable law, Hays may contact you with recruitment related communications without obtaining separate consent where:
When you consented to the transfer of data to our advertising partners we send your data (e.g. your email address, your name, your phone number) in an encrypted and pseudonymised way (so called “hashed”) to our advertising partners (for a list of our advertising partners, see below). They compare this data with the data they already process about you and if they match, the partners enable us to run targeted advertising on those matches or on similar groups of people like you, which means the partners display on their platforms Hays advertising which are specially designed for you or for people like you. After the creation of the matches, your encrypted data is automatically deleted again at our partners. The partners do not gain new addresses as a result of this. We think this is a great benefit for you as you get only those advertising which suits your needs.
Hays group companies & Hays advertising partners
When we mention Hays group companies in Germany, Austria, Denmark and Switzerland in the context of our advertising consent wording, we mean the following legal entities:
- Hays AG, based in Germany
- Hays Professional Solutions GmbH, based in Germany
- Hays Talent Solutions GmbH, based in Germany
- Emposo GmbH, based in Germany
- Hays Holding GmbH, based in Germany
- Hays Beteiligungs GmbH & Co.KG, based in Germany
- Hays Vorrat 01 GmbH, based in Germany
- Hays (Schweiz) AG, based in Switzerland
- Hays Talent Solutions (Schweiz) GmbH, based in Switzerland
- Hays Österreich GmbH, based in Austria
- Hays Professional Solutions Österreich GmbH, based in Austria
- Hays Specialist Recruitment Denmark A/S, based in Denmark
Where we have asked you for your marketing consent regarding our advertising partners and where those parties are located outside of the European Economic Area, you consent (Art. 49 I a GDPR) to a transfer outside of the European Economic Area, and you are aware that there might be a lower level of data protection with these providers/countries than it is the case in the European Economic Area.
There might be in particular a risk that your data may be accessed through authorities for surveillance purposes, even without legal redress procedures. Exercising data protection rights, you know, and you are familiar with under the GDPR may be more difficult or even impossible.
Market Research Purposes
When you consented to the use of your personal data for market research purposes, this means that we will run surveys regarding satisfaction, NetPromoterScore, personnel topics, wishes, offers, socio-demographic characteristics, new platform testing, test groups, UX testing and brand panels.
