Registro delle attività di trattamento — HRBlade

Article 30(2) GDPR record of AMISCON GLOBAL S.L. as processor, in the form a controller needs for its own Article 30(1) record. Last updated 19 August 2026.

The customer is the controller and keeps its own register. This extract gives the processor-side facts so the customer does not have to guess at them.

1. Processor identity

Field	Value
Processor	AMISCON GLOBAL S.L.
NIF	B70862099
Registered office	Valencia, Spain
Contact for data protection	info@hrblade.com
Representative under Art. 27	Not required. The processor is established in the Union.

2. Categories of processing carried out on behalf of controllers

#	Processing	Purpose	Data subjects	Data categories
1	Applicant tracking	Receive, store and manage applications	Candidates	Name, contact details, CV, work history, education
2	AI assessment of applications	Produce advisory scores, summaries and rankings for the hiring team	Candidates	CV text, interview answers and transcripts, name, skills, seniority, experience, city, country
3	Speech to text	Convert recorded answers and calls to text so they can be assessed	Candidates	Audio recordings, resulting transcripts
4	AI voice interviews	Conduct a structured phone interview	Candidates	Call audio, transcript, phone number
5	Semantic search over the talent pool	Let the hiring team find candidates in natural language	Candidates	Profile text, embedding vectors
6	Automated pipeline progression	Move candidates between stages, or propose a rejection, against thresholds the controller sets	Candidates	Scores, thresholds, application status
7	Employee lifecycle	Onboarding, performance reviews, surveys, where the controller uses those modules	Employees of the controller	Name, contact details, role, department, review content
8	Candidate sourcing	Discover and enrich profiles of people who have not applied, where the controller enables it	Prospective candidates	Public profile data, inferred contact details
9	Platform accounts	Authenticate and authorise the controller's staff	Controller's users	Name, email, role, access logs
10	Billing	Subscription administration	Controller's billing contacts	Company and billing details. No candidate data.

Processing 4, 5, 6 and 8 only occur where the controller has enabled the corresponding feature.

3. Special categories

Not collected as structured fields, and not requested from data subjects. Where an applicant includes such information in free text, it is processed incidentally as part of that document. Prompts instruct the model to disregard name, gender, age, origin and employment gaps, and this is verified by bias testing.

The controller should not configure application forms or vacancy text to elicit special-category data.

4. Transfers to third countries

Recipient	Purpose	Country	Safeguard
AI model provider	Processing 2, and 3 and 4 where server-side	United States, unless an EU-resident endpoint is in force	SCCs (Decision 2021/914) plus transfer impact assessment; EU-US Data Privacy Framework where the recipient is certified
Telephony provider	Processing 4	See sub-processor list	SCCs where outside the EEA

All storage is in the European Union, in Amsterdam. See subprocessors.md.

5. Retention

Data	Period
Call recordings	180 days
Interview media and transcripts	365 days after the application closes
Rejected candidate records	365 days, then anonymised
Inactive candidate records	730 days
AI assistant conversations	90 days
Audit logs	3 years
AI decision logs	12 months
Sourced profiles	Configurable; raw model output pruned on the same schedule
After consent expiry or withdrawal	30 days, then anonymised

Configurable per controller. Deletion runs automatically each day.

6. Technical and organisational measures, Art. 32

Tenant isolation enforced by a global query scope on every tenant-owned model.
Role-based access control with per-permission granularity.
Encryption in transit. Object storage access via signed, expiring URLs.
Audit logging of state changes, plus a dedicated AI decision log.
Automated retention and erasure, covering AI-derived artifacts and vector embeddings, not only profile rows.
Prompt-injection guards on untrusted input reaching a model.
Provider allowlist per deployment, preventing candidate data being routed to a model provider the deployment is not permitted to use.
Rate limiting and captcha on public endpoints.
Backups taken daily.

7. Assistance to the controller

The processor assists with data subject requests (Art. 28(3)(e)), with security (Art. 32), with breach notification (Art. 33), and with data protection impact assessments (Art. 35) via the DPIA support pack. Candidates can exercise access, explanation, human review and erasure through a token-based route that does not require an account, and requests are surfaced to the controller.