GDPR, retention and deletion

You are the data controller for your candidates. LynBro ApS (jah.dk, jajob.dk) processes the data on your behalf as data processor under the data processing agreement.

Retention: 6 months by default

Applications, with files, notes, ratings, interviews and offers, are deleted 6 months after the hiring ends. "Ends" means the candidate is hired, rejected or withdrew, or the job is closed.

Datatilsynet has accepted retention periods of 6 to 24 months for rejected candidates when there is a reason; 6 months is a safe default. A candidate can agree to a longer period, and then that period applies.

Talent pool

Keeping someone for future jobs beyond the retention period needs the candidate's separate, specific consent. A checkbox bundled with the application is not enough. Say what you keep, how long and how to withdraw.

Lawful basis

• An application to a job: steps at the candidate's request before a contract (Art. 6(1)(b)).
• CVs you receive by email or upload yourself: usually legitimate interest in handling the application (Art. 6(1)(f)). Only upload CVs the person sent to you for a job.
• Sensitive data (health, union membership and the like): don't ask for it, and delete it if it arrives.

Candidates' rights

A candidate can ask what you hold about them, ask for corrections or ask you to delete it. Delete the candidate in jah.dk and their files and notes go with them. Answer within one month.

Where the data is

Servers and database in Germany (EU). The list of sub-processors (hosting, email, backup, AI and payments) is in Annex B of the data processing agreement and on the Security & GDPR page.

AI and the EU AI Act

AI systems that evaluate candidates are high-risk under the EU AI Act; obligations apply from 2 December 2027. In jah.dk, AI scoring is off until you switch it on, every score is explained with verified quotes, the AI never rejects anyone, and each decision is recorded as made by a person. When you switch scoring on, tell candidates in your job ads or privacy notice. See The AI candidate card.

Closing your account

When a company account is closed, its data is deleted after 30 days.