Candidate privacy notice

Version 2026-09. Twinlite is the data controller. This notice covers what happens when you apply for a job with us, by web form or email. It sits alongside the general privacy policy.

What we collect

• Your name, contact details and location, and what you send us: your CV, cover note and answers to role questions.
• Your stated right to work in Ireland (the category only, e.g. “EU citizen” or “Stamp 4”). We never collect identity or permit documents at this stage.
• Notes and decisions made by our hiring team, and the technical records described below.

How we use it — including AI assistance

We use software to read CVs and organise applications against the requirements published for each role: it extracts facts (experience, qualifications, languages), checks the knockout requirements in code, and suggests a score against plain-English criteria written by our HR team. No application is rejected automatically. Every decision is made by a person, who sees the evidence the software used and can correct it. You can ask us to explain how your application was assessed.

The software is instructed not to extract or consider age, date of birth, photographs, gender, marital or family status, religion, health or ethnicity, and it never infers nationality from your name or history.

Who processes it

• Cloudflare hosts the application and stores data in the EU.
• Microsoft 365 handles email and Teams notifications to our hiring team.
• OpenRouter routes CV text to an AI model served from EU data centres, with zero data retention. The list of pinned model providers is available on request.

Legal basis

Taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in running a fair recruitment process. Keeping your details for future roles is based on your separate, explicit consent, which you can withdraw at any time.

How long we keep it

• Unsuccessful and unanswered applications: deleted 12 months after the role closes.
• Talent pool (with your consent): 24 months from your last contact with us; we email you 30 days before that to ask whether to keep or remove your details.
• Backups and database history expire within 30 days of deletion.

Your rights

Access, correction, deletion, restriction, portability, objection, and an explanation of any AI-assisted assessment. Email careers@twinlite.com. You can also complain to the Data Protection Commission (dataprotection.ie).