Welle Digital Kft. (Candalign) operates an interview integrity decision-support platform for B2B customers. This Privacy Policy explains what we collect, why we process it, where it is stored, and your rights under the GDPR.
1. Roles under GDPR
- Customer organisations are typically the Data Controller for candidate screening data they upload.
- Welle Digital Kft. acts as a Data Processor when handling candidate CVs, transcripts, and analysis on behalf of customers.
- For account, billing, and marketing data relating to recruiters who register, we act as Data Controller.
2. Data sovereignty & sub-processors
All candidate content storage and AI inference remain within the European Union. Primary infrastructure is hosted on Hetzner Online GmbH (Germany / Finland). AI inference uses Mistral AI (France).
3. Retention periods
Candidate CVs, interview transcripts, and other personally identifiable content are erased from our systems after screening completes. Only integrity scores, flags, and non-identifying metadata required for the service remain on the candidate record.
Screening audit metadata (event timestamps, content hashes, model identifiers, and attribution) is retained for at least six months to support deployer obligations under the EU AI Act. Customers may export audit records during this period.
4. Processing categories
- Account and billing data for registered recruiters and team members
- Candidate screening data (CVs, transcripts, job descriptions, integrity scores) processed on behalf of customer organisations
- Product analytics (consent-based only; no candidate identifiers)
- Support communications and transactional email delivery
5. EU AI Act roles
Under the EU AI Act, Welle Digital Kft. is the Provider of the Candalign high-risk AI system. Customer organisations using the platform are Deployers and remain responsible for human oversight, candidate transparency, and lawful use of screening outputs.
6. Supplementary analyses
Where enabled, optional personality and behaviour supplementary analyses may constitute profiling under GDPR. Deployers must establish a lawful basis and inform candidates before use. These analyses are decision-support indicators only and must not be used as the sole basis for employment decisions.
7. Your rights
Contact business@welle-digital.at. You may lodge a complaint with your local supervisory authority.
8. Related documents
See also our Terms of Service, Data Processing Agreement, and Cookie Policy.