Records of Processing Activities
GDPR Article 30 · Last updated: June 2026
This document describes the categories of personal data processing performed by TalentX
as both a data processor (on behalf of your organisation) and as a data controller (for platform operations).
A1
Employee profile management
| Purpose | Store and display employee professional profiles within the organisation's workspace |
|---|---|
| Legal basis | Contract — employment relationship (Art. 6(1)(b)) |
| Data categories | Name, email, job title, department, biography, manager |
| Recipients | Administrators, managers, recruiters within the same tenant |
| Retention | Duration of employment + 30 days |
| Int'l transfers | None outside EU/EEA |
A2
Skills catalog and proficiency tracking
| Purpose | Record employee skills, proficiency levels, and experience for internal talent matching |
|---|---|
| Legal basis | Legitimate interest — internal workforce planning (Art. 6(1)(f)) |
| Data categories | Skill names, proficiency scores (1–5), years of experience |
| Recipients | Managers and administrators within the same tenant |
| Retention | Duration of employment; deleted on anonymization request |
| Int'l transfers | None outside EU/EEA |
A3
Talent marketplace and change signals
| Purpose | Allow employees to signal readiness for internal moves and be matched to open positions |
|---|---|
| Legal basis | Consent (Art. 6(1)(a)) — employee initiates the signal voluntarily |
| Data categories | Change reason, urgency, preferred areas, availability date |
| Recipients | Managers, recruiters, administrators within the same tenant |
| Retention | Until signal is cancelled or employee account is anonymized |
| Int'l transfers | None outside EU/EEA |
A4
Algorithmic fit scoring
| Purpose | Calculate match scores between employee skills and open position requirements to assist hiring managers |
|---|---|
| Legal basis | Legitimate interest (Art. 6(1)(f)) — no fully automated decision; human review required |
| Data categories | Skill proficiency data, position skill requirements |
| Recipients | Hiring managers and administrators within the same tenant |
| Retention | Scores are computed on-demand and not stored separately |
| Int'l transfers | None outside EU/EEA |
A5
Position applications
| Purpose | Track employee applications to internal open positions |
|---|---|
| Legal basis | Contract — internal recruitment process (Art. 6(1)(b)) |
| Data categories | Employee identity, fit score, application status, timestamps |
| Recipients | Hiring managers, administrators within the same tenant |
| Retention | Duration of position lifecycle; deleted on anonymization request |
| Int'l transfers | None outside EU/EEA |
A6
Audit logging
| Purpose | Record system actions for security, compliance, and accountability |
|---|---|
| Legal basis | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
| Data categories | User ID, action type, entity affected, timestamps, details JSON |
| Recipients | Administrators within the same tenant; platform administrators (TalentX) |
| Retention | Configurable per tenant (default 365 days); scrubbed on anonymization |
| Int'l transfers | None outside EU/EEA |
A7
Account authentication
| Purpose | Authenticate users via password or Azure AD SSO |
|---|---|
| Legal basis | Contract (Art. 6(1)(b)) |
| Data categories | Email, password hash (bcrypt), Azure AD OID (SSO tenants only), session tokens |
| Recipients | Not shared |
| Retention | Password hash deleted on anonymization; session expires on logout |
| Int'l transfers | Azure AD OAuth flows subject to Microsoft's EU data boundary |
A8
Billing and subscription management
| Purpose | Process subscription payments and enforce plan limits |
|---|---|
| Legal basis | Contract (Art. 6(1)(b)) |
| Data categories | Organisation owner email, Stripe customer/subscription IDs |
| Recipients | Stripe Inc. (processor) — covered by SCCs |
| Retention | Duration of subscription + 7 years (financial records) |
| Int'l transfers | Stripe EU entity; SCCs in place |
A9
Transactional email notifications
| Purpose | Send system notifications (signal alerts, GDPR confirmations, breach notifications) |
|---|---|
| Legal basis | Legitimate interest (Art. 6(1)(f)) — operational necessity |
| Data categories | Name, email address |
| Recipients | Not shared with third parties; sent via configured SMTP relay |
| Retention | Not stored by TalentX after sending |
| Int'l transfers | Depends on tenant's configured MAIL_SERVER |