1. Introduction & Scope
ShopVista ("we", "our", or "us") is committed to protecting the privacy and security of all individuals who engage with our recruitment process. This Candidate Data Privacy Notice explains how we handle personal data when you apply for a position, attend an interview, participate in an assessment, or otherwise interact with our talent acquisition team.
This notice supplements our general Privacy Policy and specifically addresses data processing activities related to employment candidates and job seekers.
By submitting your application or providing personal information during the recruitment lifecycle, you acknowledge that you have read and understood how we will process your data in accordance with applicable data protection laws, including GDPR, CCPA, and other regional regulations.
2. Information We Collect
We only collect information necessary to evaluate your candidacy and manage the recruitment process. This may include:
- Identity & Contact Details: Full name, email address, phone number, mailing address, and professional social profiles (e.g., LinkedIn).
- Application Materials: Resumes/CVs, cover letters, portfolios, work samples, and certification documents.
- Recruitment Data: Interview notes, assessment results, candidate rankings, scheduling preferences, and communication records.
- Technical & Usage Data: IP address, device information, browser type, and interaction logs when you access our careers portal or assessment platforms.
- Demographic & Diversity Data: Voluntary self-identification information collected for equal opportunity reporting and workforce analytics.
- Special Category Data: Processed only where explicitly consented or legally required (e.g., health accommodations, right-to-work verification).
3. How We Use Your Information
Your personal data is processed exclusively for recruitment-related purposes, including but not limited to:
- Evaluating your qualifications and suitability for open or future positions
- Scheduling and conducting interviews, assessments, and background checks
- Communicating with you regarding application status, offers, and onboarding
- Complying with legal and regulatory employment obligations
- Anonymizing data for diversity reporting, hiring analytics, and process improvement
- Preventing fraud, abuse, or security threats during the application process
We do not use candidate data for marketing, advertising, or third-party profiling without explicit consent.
4. Legal Basis for Processing
Our processing activities are grounded in the following legal bases under applicable data protection frameworks:
- Contractual Necessity: Pre-contractual steps to assess employment eligibility
- Legitimate Interest: Managing recruitment operations, improving hiring processes, and protecting business security
- Legal Obligation: Complying with employment laws, tax requirements, and anti-discrimination regulations
- Consent: Where specifically requested for optional data collection (e.g., diversity surveys, marketing communications)
6. Data Retention & Storage
Candidate records are retained only as long as necessary to fulfill recruitment purposes and comply with legal obligations:
- Unsuccessful Candidates: Retained for up to 24 months for future role matching and analytics, unless deletion is requested
- Successful Candidates: Transferred to employee records upon offer acceptance
- Withdrawn Applications: Processed for deletion within 30 days, subject to legal hold requirements
Data is securely stored in encrypted systems with restricted access. Upon expiration, records are permanently deleted or anonymized in compliance with our retention policy.
7. Your Rights & Choices
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access: Request a copy of the data we hold about you
- Rectification: Update or correct inaccurate information
- Erasure: Request deletion of your candidate profile and records
- Restriction: Limit processing activities under certain conditions
- Portability: Receive your data in a structured, machine-readable format
- Withdraw Consent: Opt out of optional data processing at any time
- Appeal: Lodge a complaint with a supervisory authority
To exercise these rights, please contact our Data Protection team using the information provided in Section 9. We will respond within 30 days and verify your identity before fulfilling requests.
8. Data Security Measures
ShopVista implements industry-standard technical and organizational safeguards to protect candidate data:
- AES-256 encryption for data at rest and TLS 1.3 for data in transit
- Role-based access controls and multi-factor authentication for HR systems
- Regular security audits, penetration testing, and vulnerability assessments
- Strict employee training on data handling and confidentiality obligations
- Incident response protocols aligned with ISO 27001 and NIST frameworks
While we strive to protect your information, no digital system is completely immune to breaches. In the event of a data incident, we will notify affected individuals and regulators in accordance with legal requirements.
9. Contact & Data Protection Officer
For questions, requests, or concerns regarding this Candidate Data Notice or our data practices, please reach out to:
ShopVista Talent Acquisition & Privacy Team
Email: privacy@shopvista.com
Data Protection Officer: dpo@shopvista.com
Mail: ShopVista HQ, Talent & Compliance Division, 100 Commerce Way, Suite 400, Tech District
You may also submit requests through our secure candidate portal or contact your assigned recruitment coordinator directly.
10. Updates to This Notice
We may revise this Candidate Data Privacy Notice to reflect changes in our recruitment practices, legal obligations, or organizational structure. All updates will be posted on this page with a revised "Last Updated" date. Material changes will be communicated to active candidates via email where applicable.
Your continued engagement with our recruitment process following such updates constitutes acknowledgment of the revised terms.