Article 22 of GDPR (and UK GDPR) gives candidates the right not to be subject to a decision based solely on automated processing that produces legal effects or significant effects. We comply by enforcing human-in-the-loop at the decision point: Picked scores, ranks, and recommends; a named human hiring manager makes the final hire-or-no-hire call.

The candidate sees who decided. The dashboard tells the candidate "scored by Picked, decided by [hiring manager name, title]". The decision is logged with the manager's identity, the timestamp, and the score breakdown that informed it.

• ●Candidates can request human review of any score or stage. 14-day SLA (legal requirement is 30).
• ●Candidates can request deletion of any artefact. Done within the 30-day default retention.
• ●Candidates can export the full file (transcript, recording, scores, notes) in JSON or PDF.
• ●Candidates can opt out of AI screening entirely in favour of human screening. Same fee to the employer.

For hiring data, the employer is the controller (they decide why the data is being processed). Picked is the processor (we act on their instructions to screen, assess, and interview). The candidate is the data subject. This is standard for SaaS hiring tools and matches the GDPR posture of every other vendor in this category.

• ●DPA available at /legal/dpa. Signable per customer. Standard Contractual Clauses included.
• ●Sub-processor list at /trust/sub-processors. Notification of changes 30 days in advance.
• ●Joint controller arrangement available for enterprise customers who require it.

Any candidate (or any employee at a customer org) can request access, correction, deletion, restriction, portability, or objection. The form is at /legal/data-rights-request. We respond within 5 working days; legally we have 30.

• ●Identity verification via existing magic-link auth (no separate verification required for active users).
• ●Free of charge for the first request in any 12-month period. Subsequent requests in the same period may carry a reasonable fee.
• ●We never use a DSAR to retain or process additional data; the request itself is logged only as a compliance record.
• ●Contact: privacy@picked.ai.