How does GDPR Assistant work?
The GDPR Assistant is an optional add-on for the Traffit system that helps ensure your talent database complies with GDPR regulations:
managing the retention of consent from candidates whose consent is nearing its expiration date,
automatically anonymizing individuals whose consent has already expired.
What features does the GDPR Assistant add-on enable?
Activating the GDPR Assistant add-on results in new features in the system:
auto-anonymization
automated dispatch of consent renewal requests
listing of candidates whose consents are about to expire soon
option for sending the consent extension request forms manually
All features available within this add-on are described in detail below.
How to activate the GDPR Assistant add-on?
Simply add the GDPR Assistant add-on to your Plan in Settings > Payments:
You can also ask your account manager for help with purchasing and activating the GDPR Assistant, or email us at [email protected]
After launching the GDPR Assistant add-on, you can manage its rules in Settings > GDPR > GDPR Assistant tab.
How much does the GDPR Assistant add-on cost?
The monthly cost of the GDPR Assistant is 49 EUR/USD
What is auto-anonymization in Traffit?
Anonymization is the permanent and irreversible removal of all the connections between personal data and the person it relates to. Its purpose is to make it impossible to identify a specific person. According to the GDPR (General Data Protection Regulation), candidates for jobs should be anonymized when the consents they gave during the recruitment process expire.
Auto-anonymization in TRAFFIT is a mechanism that automatically anonymizes the candidates' data in the ATS when meeting the indicated rules. Those can be set up in the system. It allows you to:
guarantee processing the personal data in the database of only those candidates who have given and still have valid consents for the processing of personal data (given e.g. when applying to specific jobs or applying spontaneously; adding their CV to the employer's database),
save time spent on monitoring and manual anonymization of candidates whose consents expire,
guarantee GDPR compliance and security of your candidates' personal data processed in the ATS.
This additional service is offered in TRAFFIT, payable according to the pricing.
What data remains in the system and what data is deleted during anonymization?
Anonymization in the Traffit recruitment system - both automatic and manual - involves the deletion of all data that could allow the identification of a specific candidate.
What remains in the system after the candidate is anonymized?
candidate ID - a unique string of digits assigned to a candidate in the system,
activity history - information about the activity performed on a given record - left in the system for statistical and reporting purposes (e.g., date of application, assigning a note, etc.)
connection to jobs and application sources (for statistical and reporting purposes)
What is removed from the system when a candidate is anonymized?
personal data of the candidate (visible in the Personal data tab on the profile)
details of submitted applications for specific positions
reminders and tasks associated with the candidate
calendar events associated with that person
information about the talent groups to which the candidate was assigned
information about assigned tags & rate
content of notes added to the candidate by the users
details of the activities (e.g., notes) associated with this person
files attached to the candidate's profile, including resumes and cover letters
information about GDPR consents (active and expired)
details of sharing the profile with Hiring Managers
How to set the rules by which the GDPR Assistant operates?
In the “GDPR Assistant - Rules” section, you decide:
If you want to exclude them from the process, check the option Exclude candidates whose consents have already expired or were never given.
types of consents or specific consents whose expiration is intended to trigger certain processes
You can click on See candidates list at any time to verify the correctness of the selected rules.
To do that, click on Update Rules to see how this change affects both processes to verify whether you want to save the rules or go back to edit them:
If you save new rules, you can activate the process in the next step.
You can use the “Exclude candidates whose consents has expired or were never given” button if you don't want them to be included in the selected process.
You can visit Settings > GDPR > GDPR Assistant tab to check how many candidates will be affected by both processes in the coming days:
IMPORTANT!
Candidates who only have legal obligation active on their profile are treated as individuals without any consents.
How to activate the auto-anonymization process?
To do this, go to Settings > GDPR > GDPR Assistant and scroll to the GDPR Assistant - Automate Anonymization
All you need to do is enable the “Activate the auto-anonymization” switch:
How to prevent a candidate’s auto-anonymization?
Auto-anonymization is designed to ensure that only those candidates are present in the database who have assigned valid consent to process personal data.
However, if the list for anonymization includes candidates whose data you still want to process in the system - you have 2 options:
1) Check if you have the process of automatic dispatch of the consent renewal form running. If not, you can send it manually. Candidates who extend consents will disappear from the list.
2) Find their profiles in the system and add consents to their profiles manually - if, for example, they have updated them during email correspondence, in a private message on LinkedIn, on paper, etc
How to activate the automated consent requests process?
To do this, go to Settings > GDPR > GDPR Assistant and scroll to the GDPR Assistant - Automated consent requests section.
All you need to do is enable the “Activate the automated consent requests” switch:
Before activating this process, you can edit and preview the content of the email requesting the renewal of consent (details are described in the next paragraphs)
If there are more than 3,000 eligible candidates for shipment in one day, the dispatch will be carried out in daily batches.
IMPORTANT!
To prevent your candidates from receiving too many requests to renew their consents at once, after the form is manually or automatically sent, the next email will be sent no sooner than 30 days from that day.
How do I determine the content of an automatic email requesting renewal of consents?
To do this, go to Settings > GDPR > GDPR Assistant and scroll to the GDPR Assistant - Automated consent requests section.
Check the Consent request email messages list.
The checked one is the default email content to be sent by the automated consent request dispatch mechanism:
Every message has a button allowing you to preview the message or edit it.
You can add the Consent update form link to the content of the email by clicking on the “+” icon in the right menu:
In addition to the title and content of the email, you can also provide a reply-to email address to which:
- we will forward any responses from candidates who have received an email request to renew their consent,
- we will inform you if there are any problems with the mailing.
How to recognize candidates that will be automatically anonymized soon?
Go to Candidates > GDPR Assistant tab to see a list of people who have been queued for auto-anonymization.
Candidates appear on the list 30 days before automatic anonymization:
If multiple consent types have been selected, candidates will appear on this list when the last one is about to expire.
The list is enriched with information on when an automatic email was sent to these individuals asking them to renew their consents.
In addition to the data of the people to be anonymized, you will also see:
when their profiles will be anonymized,
if and when an email requesting consent renewal was sent,
whether the person is assigned to a job and when they were assigned to the current stage,
a list of most recent activities on a given candidate.
You can filter the list of queued candidates by the time they have left to be anonymized.
From the list you can:
send a manual email requesting new consents,
anonymize candidates:
2. In addition, the profiles of candidates queued for auto-anonymization, will have this information:
3. Information about the upcoming anonymization will also be visible in the candidate's quick preview in a job:
What if I have a lot of candidates for anonymization?
In case the list of people to be anonymized is long and you want to try to extend the candidates' consents - we recommend to run the automatic RODO communication first.
Consider whether:
do you want to try to extend these consents?
do you still have the right to contact these candidates? (What active consents do they have and when do they expire)
If you do not know the answer to the second question - we recommend consulting with your DPO.
If you want to try to renew these consents and you have the right to contact these candidates - activate automated GDPR communications.
Your personal GDPR assistant will then send an email with a consent renewal form to candidates whose consents are ending (or have already ended). A few days after you start this process, you can trigger auto-anonymization so that the system only anonymizes those who have not renewed their consents.
Note that in case there are more than 3,000 eligible candidates in one day, the shipment will be carried out in daily batches.
If you do not have the right to contact these candidates because their consents have expired - activate the auto-anonymization process right away to remove their profiles from the system.
Is the Assistant compliant with GDPR?
Yes, the GDPR Assistant in Traffit anonymizes candidate data upon Administrator's request and in accordance with the rules specified by the Data Administrator.
All personal data that allows for the identification of a specific candidate is anonymized (i.e., irreversibly deleted), including attached CV files and notes.