Privacy Policy

Last updated: 20/09/2025

This Privacy Policy explains how Talent Dog Limited (trading as Recruitdaq, "we", "us", "our") collects, uses, shares and safeguards personal data when you use our websites, web application and mobile applications (together, the Service). It also sets out your privacy rights and how to exercise them under the EU GDPR and the UK GDPR.

We use your personal data to provide and improve the Service. By using the Service, you acknowledge this Privacy Policy. If we make material changes, we will notify you as described in Changes to this Privacy Policy below.

1. Who we are and our role

Controller. Talent Dog Limited (Unit A6 Bymac Centre, Northwest Business Park, Dublin 15, D15 YC61, Ireland) is the data controller for processing carried out via Recruitdaq.com, app.Recruitdaq.com and our mobile apps (collectively, Recruitdaq).

Processor for clients. In some engagements, we provide our platform to employer clients and act as their data processor for recruitment activities they control. Where we act as processor, the client’s privacy notice applies and our processing is governed by a data processing agreement with that client. This Privacy Policy predominantly describes our role as controller.

Contact / DPO. 
Email: contact@talentdog.com
Phone: +353 1 8260692
Postal: Talent Dog Limited (Attn: Data Protection), Unit A6 Bymac Centre, Northwest Business Park, Dublin 15, D15 YC61, Ireland

2. Scope of this notice

This notice covers:

Website: https://Recruitdaq.com
Web app: https://app.Recruitdaq.com (candidate and employer portals)
Mobile apps: Recruitdaq (iOS/Android)
Social pages: links to Facebook, Instagram, X (Twitter) and LinkedIn (see Social media below)

It applies to:

Candidates (individuals creating profiles, applying for roles, or interacting with our talent network), and
Client users (B2B employer staff who access the platform for recruitment purposes).

Children: Our Service is not intended for under18s, and we do not knowingly collect data from children. On account creation, we ask users to confirm they are 18 or older. If we become aware that a minor’s data was submitted, we will delete it promptly and close the account.

3. What data we collect

3.1 Data you provide

Account & profile data: name, contact details (email, phone), password, role, organisation, preferences.
Candidate content: CV/résumé, work history, qualifications, righttowork documentation, references, availability, and other materials you upload.
Special category data (candidates – optional): You may voluntarily upload health data (e.g., fitnesstowork or medical reports) for specific roles or employer requirements. Uploading such data is optional unless a role explicitly requires it; you may withdraw your consent at any time (see Legal basis and Your rights). Where a role requires fitnesstowork evidence, the employer is the controller for that requirement; when we act as their processor, the employer’s lawful basis applies. You are not obliged to upload health information to create an account. If you decline to provide health information, your application will not be disadvantaged, unless a specific role explicitly requires it under the employer’s policy; in those cases the employer will explain the requirement and their lawful basis, and we act as their processor.
Communications: enquiries, support tickets, feedback, and call/meeting notes.
Marketing preferences: newsletter/updates optin choices.

3.2 Data we collect automatically

Usage/technical data: IP address, device identifiers, browser type/version, pages visited, time and date of visits, referral source, session diagnostics, and similar information collected via cookies and similar technologies (see Cookies & similar technologies).

3.3 Data we collect from others

From your organisation or referees (client user onboarding, references for candidates), subject to applicable law.
From service providers that help us prevent fraud, secure accounts, measure usage and performance, or provide support.
From public or professional sources where appropriate (e.g., professional/licensing registers relevant to a role, public business directories, or public social profiles you choose to link to us).

3.4 Mobile app permissions

Camera: used only for QR code scanning within the app. You can control this in your device settings.
We do not request continuous location, microphone, contacts or background tracking.

The QR scanning feature operates solely to read QR codes; the app does not collect analytics or other personal data beyond what is necessary to perform the scan. Our App Store/Play “Data Not Collected” declarations reflect this. If this changes, we will update both the apps and these disclosures.

4. How and why we use personal data (purposes & lawful bases)

We process personal data for the purposes and lawful bases set out below. Where multiple bases apply, the primary basis is listed first.

Purpose	Examples	Lawful basis
Provide and operate the Service	account setup, authentication, core features, troubleshooting, service notifications	Contract (Art. 6(1)(b)); Legitimate interests (service operation)
Candidate recruitment workflow	profile creation, applications, shortlisting, interview scheduling, onboarding support	Contract (candidate), Legitimate interests (facilitating recruitment); where a client controls the activity, we may be processor
Processing special category data (optional)	candidate uploads of fitnesstowork/medical reports	Explicit consent (Art. 9(2)(a)); you can withdraw at any time. We maintain records of explicit consent and provide withdrawal and deletion options.
Security & abuse prevention	login protection, anomaly detection, auditing, incident response	Legitimate interests; Legal obligation
Analytics & product improvement	understanding usage, UX research, A/B testing, crash/diagnostic data	Consent (EEA/UK) for all nonessential analytics/heatmaps/session recordings; essential diagnostics only under legitimate interests(security and service reliability).
Communications	service messages, responses to enquiries, platform updates	Contract; Legitimate interests
Marketing (B2B)	platform news, event invites, content	Consent where required by ePrivacy/PECR for electronic messages to individual subscribers; otherwise legitimate interests with optout (including for corporate subscribers).
Compliance & legal	regulatory compliance, recordkeeping, defending claims	Legal obligation; Legitimate interests

For electronic marketing, we obtain consent from individual subscribers; for corporate subscribers, we rely on legitimate interests with a simple optout in every message.

No automated decisionmaking: We do not carry out automated decisions producing legal or similarly significant effects.

5. Cookies & similar technologies

We use cookies, SDKs and similar technologies to operate the Service, measure performance and improve user experience. On the website and web app we use a cookie consent platform (Cookiebot) to capture and honour your choices.

Our cookie banner and preferences apply to Recruitdaq.com and app.Recruitdaq.com. Where available, we honour browser-level signals such as Global Privacy Control (GPC).

Services in use (web):

Google Analytics 4 (audience/usage measurement)
HubSpot (CRM, analytics and advertising audiences)
Microsoft Clarity (session analytics)
Hotjar (UX research/feedback)
LinkedIn Insight Tag (audience measurement/ads)
Google Tag Manager (tag orchestration)
Google Conversion Linker (ad attribution)
reCAPTCHA (bot protection; may assess device/interaction signals)
Cookiebot (consent management)

Managing your choices.** In the EEA/UK, nonessential analytics, advertising and social media cookies are off by default and only load after you consent in the banner. You can set or change cookie preferences via the cookie banner at any time. Essential cookies are required for the Service to function and cannot be switched off.

For more detail (cookie categories, providers and durations), please see our Cookie Policy and/or the cookie banner’s details view.

6. Who we share data with

We share personal data only as necessary for the purposes above:

Clients (employers): Candidate information is shared with the relevant employer(s) when you apply or otherwise engage in a recruitment process.
Service providers / subprocessors: e.g., cloud hosting, security, support, analytics, communications, and document processing tools. We maintain an internal list of subprocessors and will provide details on request where appropriate.
Advertising/analytics partners: (e.g., LinkedIn Insight Tag, Google Analytics) may receive pseudonymised or aggregated usage information for measurement and audience insights where you have consented to such cookies.
Professional advisers and insurers: for legal, compliance and governance purposes.
Corporate transactions: in connection with a merger, acquisition or sale of assets, subject to appropriate safeguards.
Public authorities: where required by law or to protect rights, safety and security.
With your consent: where you ask or authorise us to share data.

We do not sell personal data.

7. International transfers

Our primary hosting is in the EEA/UK (Microsoft Azure – West Europe). Where we transfer personal data outside the EEA/UK, we use appropriate safeguards, including:

Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK Addendum/IDTA, as applicable), and/or
Adequacy decisions (e.g., EU–US Data Privacy Framework participants), and
Additional technical and organisational measures where needed.

8. Data retention

We retain personal data only as long as necessary for the purposes described or to meet legal requirements. Where a fixed period is not feasible, we apply clear criteria (data type and sensitivity, purpose, statutory/contractual retention and limitation periods, and security/forensic needs) to determine the shortest appropriate period. Typical retention periods are:

Data category	Retention period
Account data (candidate & client user)	Active account + 3 years
Candidate applications & recruitment records	Recruitment lifecycle + 2 years (or as required by law/defence of claims)
Uploaded documents (incl. health/medical, if provided)	Recruitment lifecycle + 2 years, or earlier if you delete the document or withdraw consent
Client user/admin data	Contract term + 3 years
Support correspondence & tickets	2 years
System & security logs	12 months (typical)
Analytics data (web)	Up to 26 months (per tool settings)
Marketing preferences & contact history	While subscribed + 5 years from last interaction (or until you optout)

Where retention periods end, we will delete or irreversibly anonymise data, unless a longer period is required by law or is necessary for the establishment, exercise or defence of legal claims.

9. Security

We implement technical and organisational measures designed to protect personal data, including:

Encryption in transit (TLS) and at rest (platform encryption)
Access controls with rolebased access and multifactor authentication for internal accounts
Logging and monitoring, including audit trails
Backups and resilience appropriate to the Service
Leastprivilege and needtoknow principles
Staff confidentiality and training on data protection and security

While no system is completely secure, we regularly review and improve our controls. If we become aware of a personal data breach, we will assess and notify the competent supervisory authority and, where required, affected individuals without undue delay. Where GDPR applies, we will notify the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible, and notify affected individuals without undue delay when required under Article 34.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing, and to data portability. Where processing is based on consent, you may withdraw your consent at any time (this will not affect prior lawful processing). You also have the right not to be subject to a decision based solely on automated processing with legal or similar significant effects.

How to exercise your rights:

Use inproduct tools where available (e.g., account/profile settings for access, update or deletion), or
Email contact@talentdog.com with your request, or
Write to the postal address under Who we are and our role.

We will respond within the timelines set by GDPR/UK GDPR. We may need to verify your identity before completing a request.

Supervisory authorities. If you are in the EEA, you may complain to the Data Protection Commission (DPC) in Ireland. If you are in the UK, you may complain to the Information Commissioner’s Office (ICO). You may also contact your local supervisory authority in the EEA.

11. Social media

Our Site may include links to our pages on platforms such as Facebook, Instagram, X (Twitter) and LinkedIn. Your interactions with those platforms are governed by the privacy policies of the respective providers. Where we receive aggregated insights for our pages (e.g., page analytics), we use them to understand and improve engagement.

We do not offer social login for authentication to the Service.

12. Thirdparty links

The Service may contain links to thirdparty websites. We are not responsible for their privacy practices. We recommend you review their privacy notices.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date shows when it was most recently revised. For material changes, we will provide additional notice (e.g., inapp message or email).

14. Contact

If you have questions about this Privacy Policy or our handling of personal data, please contact:

Email: contact@talentdog.com

Telephone: +353 1 8260692

Post: Talent Dog Limited (Attn: Data Protection), Unit A6 Bymac Centre, Northwest Business Park, Dublin 15, D15 YC61, Ireland.