Talentist Candidate Privacy & Consent Notice

1. Data Controller

BSEK LLC ("Talentist," "we," "us") is the data controller for all personal data you share during our WhatsApp-based AI interview process, within the meaning of Article 4(7) of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR").

Where Talentist conducts interviews on behalf of an employer client, the employer client is a joint controller or independent controller for decisions made on the basis of your evaluation results. In such cases, Talentist acts as a data processor for the employer's recruitment purposes and as a data controller for its own platform operations.

2. What We Collect

Identity & Contact Data

Name, surname
Phone number (WhatsApp)
Email address
LinkedIn profile URL

Interview Content

Text responses to interview questions
Voice recordings of your answers and their automated transcriptions
Conversation metadata (timestamps, message counts, session duration)

Evaluation Data (Generated by AI)

Competency assessments and performance ratings
Evaluation justifications and reasoning
Identified strengths and development areas
Overall fit score (0–100)
Hiring recommendation

Technical Data

WhatsApp session identifiers
Interview configuration and language preferences

3. Special Categories of Personal Data

Voice recordings may constitute biometric data under Article 9 of the GDPR when processed for the purpose of uniquely identifying a natural person. We process voice data solely for the purpose of transcription and interview evaluation — not for biometric identification. Nevertheless, out of an abundance of caution, we obtain your explicit consent (Article 9(2)(a) GDPR) before processing any voice data.

During the interview, you may voluntarily disclose information that falls within special categories (e.g., health, ethnicity, religious beliefs). We do not solicit such information, but any data you share will be processed solely for the purposes of the interview evaluation, on the basis of your explicit consent.

4. Purposes & Lawful Basis

Purpose	Lawful Basis (GDPR Art. 6)
Conducting the AI-powered interview	Performance of a contract / pre-contractual steps at your request (Art. 6(1)(b))
Processing voice recordings and transcription	Explicit consent (Art. 6(1)(a) and Art. 9(2)(a))
Generating AI-based evaluation and scoring	Explicit consent (Art. 6(1)(a)); see also Section 5 on automated decision-making
Sharing evaluation results with employer client	Legitimate interest of the employer in assessing candidates (Art. 6(1)(f))
Improving AI models (anonymized, aggregated only)	Legitimate interest (Art. 6(1)(f)) — we will never re-identify you
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))

5. Automated Decision-Making & Profiling (GDPR Article 22)

How Our AI Works

Our platform uses artificial intelligence (powered by large language models) to:

Conduct the interview by generating contextually relevant follow-up questions
Transcribe voice recordings into text
Evaluate your responses against role-specific competencies
Generate a competency score (0–100), ratings per competency, and a hiring recommendation

Significance of the Decision

The AI-generated evaluation is provided to the employer client as a recommendation only. It does not constitute an automated decision with legal or similarly significant effects within the meaning of Article 22(1) GDPR, because:

No hiring, rejection, or contractual decision is made solely on the basis of the AI output
A human recruiter or hiring manager at the employer client reviews all AI evaluations before making any employment decision
The AI score is one factor among many (including subsequent interviews, case studies, and reference checks)

Your Rights Regarding AI Evaluation

Regardless of the above, you have the right to:

Request human review of any AI-generated evaluation by contacting us at info@talentist.co
Express your point of view and contest the evaluation outcome
Obtain meaningful information about the logic involved in the evaluation, the significance, and the envisaged consequences
Request an explanation of how your score was determined

6. Data Sharing & International Transfers

Data Storage

All personal data is stored and processed on Amazon Web Services (AWS) infrastructure in Frankfurt, Germany (EU), via our database provider MongoDB Atlas. Your data remains within the European Economic Area.

Sub-processors

Sub-processor	Purpose	Location
MongoDB Atlas (AWS Frankfurt)	Database hosting	Frankfurt, Germany (EU)
OpenAI	AI interview & evaluation engine	USA — safeguarded by DPA and Standard Contractual Clauses
Twilio	WhatsApp messaging delivery	USA — safeguarded by DPA and Standard Contractual Clauses
Heroku (Salesforce)	Application hosting	EU / USA — safeguarded by DPA and Standard Contractual Clauses

International Transfers

Where personal data is transferred outside the EEA (specifically to OpenAI and Twilio in the USA), such transfers are safeguarded by:

Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914)
Data Processing Agreements with each sub-processor
Supplementary technical and organisational measures (encryption in transit and at rest)

Data Sharing Policy

We share your interview data and AI evaluation with the employer client who created the interview. We may share anonymized, aggregated insights for analytics and platform improvement, but never identifiable personal data with third parties beyond those listed above without your explicit consent.

7. Data Retention

Data Category	Retention Period
Incomplete / abandoned interview sessions	7 days — automatically deleted if the interview is not completed
Completed interview data (responses, transcriptions, messages)	5 years from the date of the last interview, after which data is anonymized or deleted
AI evaluation results	5 years from the date of creation, after which data is anonymized or deleted
Candidate identity & contact data	5 years from the date of the last interview, after which data is deleted
Anonymized / aggregated analytics	Indefinitely (no personal data)

You may request early deletion at any time by contacting info@talentist.co.

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

Right of Access (Art. 15) — Request a copy of all personal data we hold about you
Right to Rectification (Art. 16) — Correct any inaccurate or incomplete data
Right to Erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten")
Right to Restriction (Art. 18) — Restrict processing in certain circumstances
Right to Data Portability (Art. 20) — Receive your data in a structured, machine-readable format
Right to Object (Art. 21) — Object to processing based on legitimate interests
Right to Withdraw Consent (Art. 7(3)) — Withdraw consent at any time without affecting prior lawful processing
Right Regarding Automated Decision-Making (Art. 22) — Request human review of AI-generated evaluations, express your point of view, and contest the decision

To exercise any right: Email info@talentist.co

Response time: We will respond to all requests within 30 days of receipt. If the request is complex, we may extend this by a further 60 days with notice to you.

9. Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption in transit — All data transmitted via TLS/SSL
Encryption at rest — Database-level encryption (AES-256)
Access controls — Role-based access, principle of least privilege
Audit logging — Monitoring and logging of data access
Regular security assessments — Ongoing review of infrastructure and application security

11. Data Protection Principles

We process your personal data in accordance with the principles set out in Article 5 of the GDPR:

Lawfulness, fairness and transparency — We process data lawfully and inform you of how we use it
Purpose limitation — We only use data for the specified purposes disclosed in this notice
Data minimisation — We only collect data that is necessary for the interview and evaluation
Accuracy — We keep data accurate and provide mechanisms for correction
Storage limitation — We retain data only for the periods specified in Section 7
Integrity and confidentiality — We implement appropriate security measures
Accountability — We can demonstrate our compliance with these principles

12. Complaints

If you have concerns about how we process your personal data, you can:

Contact us directly: info@talentist.co
Lodge a complaint with your local supervisory authority:

Country	Authority	Website
Germany (lead authority — data hosted in Frankfurt)	BfDI — Federal Commissioner for Data Protection	bfdi.bund.de
Turkey	KVKK — Personal Data Protection Authority	kvkk.gov.tr
Other EU/EEA	Your local Data Protection Authority	EDPB Members List

13. Changes to This Notice

We may update this privacy notice from time to time. We will notify you of any material changes by:

Updating the "Last Updated" date at the top of this notice
Posting an updated version on our website at www.talentist.co/gdpr

We encourage you to review this page periodically for the most current version.

Contact Information

Data Controller: BSEK LLC

Address: 30 N Gould St Ste R, Sheridan, WY 82801, USA

Email: info@talentist.co

Website: www.talentist.co

Privacy Page: https://www.talentist.co/gdpr

This document was last updated on April 6, 2026. Please visit our website for the most current version.