Candidate Privacy Notice

Two points still need your confirmation, marked {{confirm}}: anonymizing assessments after 2 years (section 9) and encryption (section 10). Once you approve it, I'll produce the Greek version.

Candidate Privacy Notice
Last updated: 6/11/2026

This notice explains how HiRi handles the personal data of job candidates, of professionals we approach about opportunities, and of clients of our career services.

1. Who we are

The controller of your data is Alexandros Theodoridis, an independent HR consultant trading as HiRi, Irinis 28, 153 41 Agia Paraskevi, Greece. Email: alexandros.theodoridis@hiri.gr. Phone: +30 694 907 6882. We have not appointed a Data Protection Officer because the law does not require one for our activities. Please contact us directly with any question.

2. Whose data this notice covers

Candidates who send us their CV or apply for a role we are handling.
Professionals we identify and contact about a role ("approached candidates").
Clients of our career services, such as CV writing, mock interviews and mentoring.

When a company hires us to assess or develop its own employees (for example, 360-degree feedback), that company decides how your data is used. Its own privacy notice applies, and we act on its instructions.

3. What data we process

Identity and contact details: name, email, phone, city, LinkedIn profile.
Professional information: CV, education, career history, skills, languages, references you provide.
Recruitment information: interview notes, assessment and questionnaire results, salary expectations, availability, notice period.
For career-service clients: the documents and session notes needed to deliver the service, and billing details.

We do not ask for sensitive data such as health, religion, political opinions or ethnic origin. Please leave it out of your CV. If you share it anyway, we do not use it.

4. Where your data comes from

Mostly from you. For approached candidates, we use publicly available professional sources such as LinkedIn, company websites and professional publications. We contact referees only with your agreement.

5. Why we use your data, and on what legal basis

Purpose:Keeping your CV in our talent pool and considering you for roles
Legal basis (GDPR Art. 6):Your consent

Purpose: Identifying and contacting approached candidates about a specific role.
Legal basis (GDPR Art. 6): Our legitimate interest in finding suitable candidates for our clients. You can object at any time.

Purpose: Interviews and assessments during a search
Legal basis (GDPR Art. 6): Your consent, given before each assessment

Purpose: Presenting your profile to a client company
Legal basis (GDPR Art. 6): Your consent, given separately for each client before we share anything

Purpose: Delivering career services you buy from us
Legal basis (GDPR Art. 6): Performance of our contract with you

Purpose: Invoicing and tax records
Legal basis (GDPR Art. 6): Legal obligation

Purpose: Establishing or defending legal claims
Legal basis (GDPR Art. 6): Our legitimate interest

6. AI tools and automated decisions
We use AI tools to help us analyze CVs, organize interview notes and draft reports. Some run locally on our own computers. Others are cloud services from OpenAI, Anthropic and Google, used under business terms that do not allow them to train their models on your data. Alexandros personally reviews all AI output and makes every decision about candidates. No decision about you is made solely by automated means.

7. Who receives your data
Client companies, only after you have agreed to be presented to that specific client.

Service providers acting on our behalf under data-processing agreements: Microsoft (email, Teams), Google (video calls, encrypted backup storage, AI), OpenAI and Anthropic (AI), and Hostinger (website hosting).
Public authorities, only where the law requires it.

We never sell your data.

8. Transfers outside the European Economic Area
Some of these providers may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for details.

9. How long we keep your data
Talent pool: 2 years from our last contact. Before that period ends, we ask whether you want to stay in our pool. If you don't reply within 30 days, we delete your data.

Approached candidates who are not interested: we delete your details. We keep only your name and a "do not contact" note, so that we respect your choice.
Career-service clients: we keep your CV and session materials for 2 years after the service ends. Before that period ends, we ask whether you want us to keep them longer. If you don't reply within 30 days, we delete them. Invoices are kept for as long as Greek tax law requires.
Assessment results: kept in identifiable form for the same 2-year period. After that, we anonymize them by removing your name and every detail that could identify you, and keep only the anonymized results to improve our assessment methods. Anonymized results can no longer be linked to you. {{confirm}}
Backups: deleted data is removed from our backups within 90 days.

10. How we protect your data
Your data is stored in our own encrypted systems, with encrypted backups. Only Alexandros has access {{confirm encryption}}.

11. Your rights
You can ask to access, correct or delete your data, to restrict its use, or to receive it in a portable format. You can object to processing based on our legitimate interest, and withdraw your consent at any time. Withdrawal does not affect processing that already took place. We reply within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr.

12. If we contacted you first
If we found your profile ourselves, we tell you so and point you to this notice the first time we contact you, and in any case within one month of collecting your data.

13. Changes to this notice
We may update this notice. The date at the top shows the latest version.