Applies to individuals in the European Economic Area, the United Kingdom and Switzerland, in addition to the Privacy Policy. Where the two conflict, this supplement controls for those individuals.
1. Controller identity (GDPR Art. 13(1)(a))
Axion Connect, Registered office address — to be confirmed, is the controller of personal data about workspace users and about anyone who contacts us. When an organisation uses HR Assist to recruit, that organisation is the controller of candidate data and we are its processor under the Data Processing Agreement.
2. Representative (GDPR Art. 27; UK GDPR Art. 27)
Axion Connect is established in India. Where it offers the Service to organisations or monitors candidates in the EEA or the UK without an establishment there, Article 27 requires a representative. Our representative is EU / UK representative — to be appointed. You may contact the representative or privacy@axionconnect.com on any data-protection matter.
3. Data Protection Officer
Data-protection enquiries go to privacy@axionconnect.com. Where Article 37 requires a designated officer, the officer is reachable at the same address.
4. Lawful bases (GDPR Art. 6 and Art. 9)
| Processing | Lawful basis |
|---|---|
| Operate and secure a workspace user's account | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest (security) |
| Send service email (sign-in codes, invitations, notifications) | Art. 6(1)(b) contract |
| Record acceptance of the Terms and re-acceptance when they change | Art. 6(1)(c) legal obligation; Art. 6(1)(f) |
| Connect a calendar or mailbox through OAuth | Art. 6(1)(a) consent, given through the provider's consent screen and withdrawable in Settings |
| Billing and tax records | Art. 6(1)(b); Art. 6(1)(c) |
| Candidate data processed on a customer's instruction | The customer's lawful basis, typically Art. 6(1)(b) pre-contractual steps or Art. 6(1)(f); we act as processor |
| Webcam, microphone and screen proctoring | Art. 9(2)(a) explicit consent of the candidate, recorded in the test room; the customer must confirm it can rely on consent in the employment context under its national law |
| AI-assisted parsing, transcription and scoring | Part of the customer's processing above; never a solely automated decision with legal effect (Art. 22) |
We send no marketing and run no identifying analytics, so no consent under Art. 6(1)(a) is sought for either.
5. Retention
See section 6 of the Privacy Policy. In summary: user accounts until deleted plus 30 days; candidate data under the customer's control; security logs 12 months; consent records for the life of the underlying data plus the limitation period; backups expire within 35 days of deletion.
6. Your rights (GDPR Art. 15–22; UK GDPR; Swiss FADP)
- Access (Art. 15) — a copy of your data and the information in Art. 15(1).
- Rectification (Art. 16).
- Erasure (Art. 17), subject to the retention the law requires.
- Restriction (Art. 18) while a dispute about accuracy or lawfulness is resolved.
- Portability (Art. 20) in a structured, machine-readable format.
- Objection (Art. 21) to processing based on legitimate interest.
- Not to be subject to a solely automated decision with legal or similarly significant effect (Art. 22) — the Service is designed so that a person makes every hiring decision; a candidate may ask the customer for human review.
- Withdrawal of consent at any time, without affecting earlier processing.
- Complaint to a supervisory authority (section 8).
Workspace users write to privacy@axionconnect.com. Candidates write to the organisation recruiting them; a request sent to us is forwarded within five business days. We answer within one month, extendable by two months for complex or numerous requests with notice of the extension.
7. International transfers (GDPR Chapter V)
Data is hosted in the United States and processed by the sub-processors on the Sub-processors page, some outside the EEA, the UK and Switzerland. Transfers rely on the Standard Contractual Clauses (Commission Decision 2021/914, Module 2 or Module 3 as applicable) with the UK International Data Transfer Addendum and the Swiss amendments, or on the EU-US Data Privacy Framework, its UK Extension and the Swiss-US DPF where the recipient is certified. We assess each transfer and apply supplementary measures (encryption in transit and at rest, access control, minimisation such as removing identifiers before scoring where the workspace enables it) consistent with EDPB Recommendations 01/2020. A copy of the clauses is available on request.
8. Supervisory authorities
- EEA: the authority of your Member State, listed at https://edpb.europa.eu/about-edpb/about-edpb/members_en (opens in a new tab).
- United Kingdom: Information Commissioner's Office, https://ico.org.uk (opens in a new tab).
- Switzerland: Federal Data Protection and Information Commissioner, https://www.edoeb.admin.ch (opens in a new tab).
9. Automated decisions and the EU AI Act
AI features (résumé parsing, fitment scoring, transcript summaries, interview scores, proctoring signals) are decision support. They do not produce a legal or similarly significant effect without a person's review, and every AI output is labelled. Recruitment systems are high-risk under Annex III of Regulation (EU) 2024/1689; the customer is the deployer and we provide the information Article 13 requires on request. The Service performs no emotion recognition (Art. 5(1)(f)) and no biometric categorisation. Candidates are told in the test room that monitoring is taking place (Art. 50).
10. Contact
Axion Connect · Registered office address — to be confirmed · privacy@axionconnect.com · Representative: EU / UK representative — to be appointed
Questions about this document?
Write to privacy@axionconnect.com for anything about data and privacy, or support@axionconnect.com for the agreement itself. We reply within one working day.