Last updated August 13, 2026

Candidate privacy notice

This notice explains how 4h4 Management uses personal data about candidates in its private talent database and candidate-matching work.

1. Who is responsible

4h4 Management is intended to act as the data controller for the processing described here. Until a dedicated privacy contact is published, contact the 4h4 representative who provided this notice or a 4h4 workspace administrator. The controller’s legal name, postal address, privacy email, EU representative (if required), and data-protection officer details (if appointed) must be inserted here before live collection.

2. Data we may collect

We may record contact details, location, professional history, skills, industries, role preferences, availability, compensation expectations, work-authorization information, interview notes, the source of the record, status, and communications concerning privacy requests. We may obtain this from you, interviews, a person who introduced you, clients, and appropriate professional or public sources.

3. Why we use it and our lawful bases

• To assess professional experience, maintain a reusable talent pool, respond to search requests, communicate with you, and administer possible engagements.
• Depending on the circumstances, the recorded basis will be your consent, steps requested before a contract, 4h4’s or a client’s legitimate interests balanced against your rights, a legal obligation, or another specifically documented basis.
• Consent is not assumed. When consent is the basis, it may be withdrawn without affecting earlier lawful processing.

4. Candidate matching and human review

The workspace may compare words and structured facts in candidate records with role requirements to help staff create a shortlist. It must not make a hiring decision or produce a legally significant decision on its own. Staff must review source information, correct errors, consider context, and make the decision. AI-assisted profiling must remain disabled until 4h4 completes and approves a Data Protection Impact Assessment.

5. Sharing, processors, and international transfers

Access is limited to authorized 4h4 personnel and, when appropriate and legally permitted, relevant clients or professional advisers. Hosting, authentication, security, communications, and database suppliers may process data for 4h4 under written data-processing terms. Before any transfer outside the EEA or another protected location, 4h4 must identify the destination and apply an accepted mechanism such as an adequacy decision or Standard Contractual Clauses, together with a transfer assessment and supplementary safeguards where needed.

6. Retention

Every candidate record receives a documented review or deletion deadline based on the purpose and lawful basis. At the deadline, the workspace restricts and archives the record, followed by deletion after a short review period unless 4h4 documents a valid legal hold, renewed purpose, or other lawful reason. 4h4’s final retention schedule must be approved and published before production use.

7. Your rights

Depending on applicable law, you may ask for access and a portable copy, correction, deletion, restriction, or object to processing. You may withdraw consent where consent is relied on. You may also complain to the supervisory authority where you live or work, or where the alleged infringement occurred. To submit a request, contact your 4h4 representative or a workspace administrator. Identity may need to be verified, and some rights have legal exceptions.

8. Security and changes

4h4 uses role-based access, protected sessions, encrypted transport, audit records, input limits, and retention controls. No system can eliminate all risk. We will update this notice when the processing materially changes.