Operational draftController address, privacy contact, representative details, and supervisory authority must be completed before production use.

Last updated September 10, 2026

Candidate privacy notice

This notice explains how 4h4 Management uses personal data about candidates in its private talent database and candidate-matching work.

1. Who is responsible

4h4 Management is intended to act as the data controller for the processing described here. Until a dedicated privacy contact is published, contact the 4h4 representative who provided this notice or a 4h4 workspace administrator. The controller’s legal name, postal address, privacy email, EU representative (if required), and data-protection officer details (if appointed) must be inserted here before live collection.

2. Data we may collect

We may record contact details, location, professional history, skills, industries, role preferences, availability, compensation expectations, work-authorization information, interview notes, the source of the record, status, and communications concerning privacy requests. We may obtain this from you, interviews, a person who introduced you, clients, and appropriate professional or public sources.

Do not provide sensitive information unless 4h4 has specifically requested and justified it.This includes health or disability information, racial or ethnic origin, religious or political beliefs, trade-union membership, genetic or biometric data, sex life or sexual orientation, and criminal-offence data.

3. Why we use it and our lawful bases

To assess professional experience, maintain a reusable talent pool, respond to search requests, communicate with you, and administer possible engagements.
Depending on the circumstances, the recorded basis will be your consent, steps requested before a contract, 4h4’s or a client’s legitimate interests balanced against your rights, a legal obligation, or another specifically documented basis.
Consent is not assumed. When consent is the basis, it may be withdrawn without affecting earlier lawful processing.

4. Candidate matching and human review

The workspace may compare words and structured facts in candidate records with role requirements to help staff create a shortlist. It must not make a hiring decision or produce a legally significant decision on its own. Staff must review source information, correct errors, consider context, and make the decision. AI-assisted profiling must remain disabled until 4h4 completes and approves a Data Protection Impact Assessment.

5. Sharing, processors, and international transfers

Access is limited to authorized 4h4 personnel and, when appropriate and legally permitted, relevant clients or professional advisers. Hosting, authentication, security, communications, and database suppliers may process data for 4h4 under written data-processing terms. Before any transfer outside the EEA or another protected location, 4h4 must identify the destination and apply an accepted mechanism such as an adequacy decision or Standard Contractual Clauses, together with a transfer assessment and supplementary safeguards where needed.

6. Retention

The standard candidate-retention maximum is one year from collection, with earlier deletion where required by the purpose, consent or withdrawal. Contact and ordinary edits do not restart the period or extend existing consent. At expiry, records and attachments are due for deletion by the next successful cleanup, without an additional archive period. A specifically documented legal hold keeps only necessary information restricted. Separate employment, contract, rights and security records follow their applicable schedules. Eva coordinates privacy and recruitment operations; Jordan Beck handles technical deletion. Policy and operational review remain required before opening public registration.

7. Your rights

Depending on applicable law, you may ask for access and a portable copy, correction, deletion, restriction, or object to processing. You may withdraw consent where consent is relied on. You may also complain to the supervisory authority where you live or work, or where the alleged infringement occurred. To submit a request, contact your 4h4 representative or a workspace administrator. Identity may need to be verified, and some rights have legal exceptions.

8. Security and changes

4h4 uses role-based access, protected sessions, encrypted transport, audit records, input limits, and retention controls. No system can eliminate all risk. We will update this notice when the processing materially changes.