GDPR and Data Rights

The General Data Protection Regulation applies when its territorial rules cover an organization or processing activity. This page summarizes WorkMentor's approach. It does not replace the GDPR, regulator guidance, a customer data processing agreement, or legal advice.

• Use personal data lawfully, fairly, and transparently.
• Collect it for clear purposes and do not reuse it incompatibly.
• Limit collection to what is relevant and necessary.
• Keep records accurate and permit correction.
• Keep identifiable data only as long as needed.
• Protect confidentiality, integrity, and availability.
• Document decisions and remain accountable for compliance.

A customer chooses the lawful basis for its workforce and candidate processing. Depending on the activity, a basis may include contract, legal obligation, legitimate interests, consent, or another basis permitted by law. Consent is not appropriate merely because data is sensitive or difficult to justify, and employee consent may not be freely given where there is a power imbalance.

For WorkMentor's controller activities, common bases are contract performance, steps requested before contract, legal obligations, legitimate interests in security and service operation, and consent for genuinely optional activities where required.

Some WorkMentor fields can contain data that receives additional protection, including religion, biometric face descriptors, health-related leave context, or other sensitive workforce information. Government identity, financial, and criminal-record information can also require added safeguards under local law.

Customers must disable fields they do not need, restrict roles, define a valid Article 6 basis and any Article 9 condition, complete a data protection impact assessment where required, and avoid face recognition or monitoring unless it is necessary and proportionate.

Requests are handled within the period required by applicable law. A request can be limited or refused where law permits, including where identity cannot be verified, the request is manifestly unfounded or excessive, or retention is required. Reasons and available complaint routes will be explained where required.

• For employee, candidate, payroll, attendance, or performance data, contact the organization that collected the data. It can identify the relevant record, purpose, and legal obligations.
• For WorkMentor account ownership, billing administration, website inquiries, or a request directed to WorkMentor, use our contact page and clearly state that the message is a data-rights request.
• Provide enough information to locate the account and describe the request. Do not send passwords, full payment card numbers, or unnecessary identity documents.
• We or the customer may request proportionate information to verify identity, authority, and the safety of disclosure.

WorkMentor can calculate operational indicators and use AI-assisted tools for resume extraction, candidate compatibility support, and selected analyses. These features can influence how authorized users organize work, but WorkMentor does not make final employment decisions for customers.

Customers must determine whether their configuration involves profiling or a decision with legal or similarly significant effects. Where Article 22 applies, they must establish an exception permitted by law, provide required information and safeguards, enable human intervention, and allow the person to express a view and challenge the decision.

WorkMentor uses providers for cloud infrastructure, private object storage, payment processing, Google integrations, email, diagnostics, and optional AI-assisted functions. Processing locations can differ by provider and customer deployment.

Where Chapter V of the GDPR applies, WorkMentor uses an available lawful transfer mechanism, such as an adequacy decision or approved contractual clauses, and assesses supplementary safeguards where needed. Customer agreements can include subprocessor notice and objection procedures.

WorkMentor uses access controls, tenant boundaries, audit trails, authentication protections, private storage, monitoring, and incident procedures. When acting as processor, WorkMentor notifies the affected customer of a confirmed personal-data breach without undue delay as required by the agreement and provides available information needed for the customer's assessment. The controller remains responsible for regulator and data-subject notifications unless the parties agree otherwise.

Customers should configure and document retention rules that match employment, recruitment, payroll, tax, accounting, and limitation requirements. WorkMentor supports record updates, exports, removal workflows, access revocation, and scheduled organization deletion. Deletion may take time to move through active systems, retry-safe deletion jobs, caches, and protected backups.

Data can be retained where law requires it, where needed for legal claims or security investigation, or where deletion would affect another person's rights. Data retained for those reasons is restricted to the relevant purpose.

Raise a concern with the relevant customer organization or WorkMentor first so it can be investigated. If the GDPR applies and the response does not resolve the concern, you may lodge a complaint with the supervisory authority in the country where you live, work, or believe an infringement occurred. You can also seek a judicial remedy where the law provides one.