Legal
Privacy Notice
Last updated: 22 September 2026
This privacy notice describes the processing for which HirePortal is itself the controller. For candidate data that HirePortal processes solely on behalf of a recruitment customer, that recruitment customer is the primary controller and its privacy notice is leading.
1. Who are we?
HirePortal B.V., registered with the Dutch Chamber of Commerce under number 42056108 and having its registered address at Geurdeland 17g, 6673 DR Andelst, the Netherlands. You can contact us at privacy@hireportal.ai.
2. Which roles do we have?
For account administration, billing, security, website use, support and legal obligations, HirePortal determines the purposes and means itself. For candidate data inside a customer workspace, HirePortal in principle processes on behalf of the recruitment customer. Where a specific HirePortal function independently determines purposes and means, we will be separately transparent about it.
3. Data we process about business users
Name, business contact details, organisation, account data, login and security data, subscription and invoicing data, support communication, usage and technical logs.
4. Candidate data in customer workspaces
Depending on the recruitment customer's instructions, this may include name, telephone number, email, professional profile, work history, education, skills, role preferences, correspondence, call outcomes, appointments and publicly available professional data.
5. Why do we process data?
Delivery and security of the Service; account and contract administration; billing; support; fraud prevention; product reliability; legal compliance. Candidate data is processed on behalf of the customer for its recruitment purposes and according to its instructions.
6. Legal bases
For its own processing, HirePortal may rely on performance of a contract, legal obligation and legitimate interests, depending on purpose and context. Where consent is required, we ask for it separately. The recruitment customer determines the legal basis for candidate data in its own workspace.
7. Public sources
A recruitment customer may instruct HirePortal to process professionally relevant information from public sources. Public availability does not make data free of rights. The recruitment customer is responsible for the legal basis, necessity, source selection and Article 14 information to the Candidate. HirePortal limits processing to the configured recruitment purposes.
8. AI Voice
When a customer uses AI Voice, the person called is informed at the start of the interaction that they are speaking with an AI system. AI voice calls are recorded and transcribed by default. The recruitment customer is responsible for having a lawful basis, informing candidates and obtaining consent where legally required. A candidate can withdraw consent immediately or state that they no longer wish to be called or approached. HirePortal blocks further outbound communication and deletes or anonymises active candidate data on the customer's instruction, insofar as no other legal basis or retention duty exists; a minimal suppression record may be retained to prevent renewed contact.
9. Recordings and transcripts
AI voice calls are recorded and transcribed by default. Recordings and transcripts are used to provide the Service, create call reports, update candidate records, troubleshoot calls and allow customer follow-up. HirePortal processes them as processor on the customer's instructions and does not use customer conversations to train its own AI models.
10. Automated decision-making
HirePortal supports recruitment workflows but does not make autonomous hiring, selection or rejection decisions. The recruitment customer remains responsible for its decisions and for appropriate human oversight.
11. Retention
Personal data is retained while required to provide the Service and according to customer instructions. After account termination or a valid deletion request, active data is normally deleted within 30 days. Residual encrypted backups may remain for up to 90 days unless the law requires longer retention. Account, billing and tax data may be retained for applicable statutory retention periods.
12. Security
We use appropriate technical and organisational measures, including access restrictions, logging and encryption in transit and, where appropriate, at rest.
13. Recipients and subprocessors
We share personal data only with authorised staff, suppliers and subprocessors, and authorities where necessary and lawful. Customer-connected services such as Zoho Recruit, calendars or other ATS systems are activated by the customer and receive only the data required for that integration.
| Subprocessor | Purpose | Processing location |
|---|---|---|
| Vapi AI | Voice-AI orchestration, recordings, transcripts and call logs | United States and/or EEA depending on configuration |
| Telnyx | Telephone connectivity, telephone numbers and call metadata | United States/global infrastructure |
| OpenAI | Language-model processing of conversation context | United States and/or EEA depending on configuration |
| Cartesia AI | Text-to-speech voice generation | United States |
| Supabase | Application database and authentication | Configured cloud region |
| DigitalOcean | Application hosting and infrastructure | Configured cloud region |
14. International transfers
Personal data may be processed inside and outside the EEA. International transfers are protected using an adequacy decision, the EU-US Data Privacy Framework where applicable, Standard Contractual Clauses or equivalent legal safeguards.
15. Rights
Depending on the circumstances, individuals may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent. For candidate data in a customer workspace, HirePortal may forward the request to the relevant recruitment customer.
16. Objection to direct marketing or contact
Insofar as personal data is processed for direct marketing, the right to object applies. For telephone recruitment contact, customers must additionally respect applicable opt-out, suppression and consent rules.
17. Complaints
You can contact us at privacy@hireportal.ai. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
18. Changes
We may amend this notice when the Service or legislation changes. The current version and date are published on our website.