instaview

Legal

Processing of Personal Data

Last Updated: 05.03.2026

I. PERSONAL DATA PROCESSED (INCLUDING SENSITIVE PERSONAL DATA UNDER ART. 9 GDPR IF APPLICABLE)

Job Position Information

  • Job position URL
  • Job title
  • Description
  • Benefits
  • Type of employment
  • Workplace location
  • Human recruiter
  • Salary range
  • Required level of education
  • Experience
  • Language skills
  • Other requirements

Team Information (the company for which the screening will be conducted)

  • Company (team) name + company description

Candidate Information

  • First name
  • Last name
  • Phone number
  • Email
  • Date of GDPR consent expiration
  • Candidate CV

Interview Settings

  • Template name
  • Interview type
  • Focus
  • Questions
  • Instructions
  • Interview language
  • Interview duration

No sensitive data is processed.

II. DATA SUBJECTS

Candidates:Natural persons who apply for job positions with the Controller (or Controller's clients, if Controller acts as a service provider) and whose data is provided to the Processor by the Controller for the purpose of conducting AI-powered interviews and assessments, or natural persons whose data is sourced from Public Professional Networks (e.g., LinkedIn) on behalf of the Controller.

Users: Authorized employees and representatives of the Controller who are granted access to the InstaView Platform to manage job positions, candidates, and review interview results.

III. NATURE OF PROCESSING (DESCRIPTION OF THE PROCESSING ACTIVITY)

The Processor (InstaView) provides the Controller with access to its SaaS Platform, through which the Controller can manage and conduct automated AI-powered interviews as part of their recruitment and candidate screening process. The processing activities undertaken by the Processor on behalf of the Controller include:

1. Data Input & Management by Controller: The Controller inputs or imports Candidate data (including CVs) and job position details directly into the InstaView Platform. The Controller manages interview templates and settings within the Platform.

2. Interview Initiation & Management: The Controller initiates AI voice interviews for selected Candidates directly from the InstaView Platform. The Platform then orchestrates the interview process, utilizing Candidate contact details and configured interview templates. This involves using sub-processors for call management (VAPI) and real-time AI voice synthesis (ElevenLabs) and potentially real-time AI interaction assistance (Azure Speech, Azure OpenAI).

3. Interview Recording: Recording the full audio of the AI voice interview and storing these recordings securely, making them accessible to the Controller via the Platform.

4. Interview Transcription: Transcribing the audio recordings into structured text format, accessible to the Controller via the Platform.

5. AI-Powered Analysis: Analyzing the interview transcript (and potentially the CV text) using AI models. This analysis generates insights such as evaluation of education, experience, language skills, identification of strengths and weaknesses, an overall summary of the candidate, a job match score, and a company fit rating. These analyses are made available to the Controller within the Platform.

6. Public Data Collection/Scraping: Collecting, sourcing, and scraping Personal Data from public sources and Public Professional Networks (e.g., LinkedIn) at the specific instruction of the Controller via search queries or matching requests on the Platform.

7. Results Access & Review:The Controller accesses and reviews all processed data – including audio recordings, transcripts, AI-generated analyses, summaries, and ratings – directly within the InstaView Platform's user interface. The Platform provides tools for viewing, and potentially managing or exporting this data (depending on Platform features).

The processing is limited to the scope necessary for delivering the Services as defined in the Contract and the features of the InstaView Platform used by the Controller. All processing is performed based on the Controller's actions and configurations within the Platform and in accordance with the GDPR consent obtained from Candidates (which the Controller is responsible for obtaining and ensuring its validity).

IV. PURPOSES OF THE PROCESSING ON BEHALF OF THE CONTROLLER

All personal data is processed by the Processor on behalf of the Controller for the following purposes:

  • To provide the Controller with access to and use of the InstaView Platform and its features for conducting automated AI-powered interviews.
  • To enable the Controller to manage job positions, Candidate data, and interview templates within the Platform.
  • To facilitate the screening and initial assessment of Candidates for job positions defined by the Controller within the Platform.
  • To record, transcribe, and analyze Candidate interviews to extract relevant information and generate insights.
  • To present the Controller with comprehensive results (recordings, transcripts, AI analyses, summaries, ratings) directly within the InstaView Platform to support their decision-making in the recruitment process.
  • To fulfil any other actions initiated by the Controller within the InstaView Platform related to the processing of Candidate data.

V. DURATION OF THE PROCESSING (DATA RETENTION)

  • The Processor will process and retain Personal Data on behalf of the Controller for the duration specified by the Controller within the Platform (e.g., linked to the expiration date of the GDPR consent obtained from the Candidate, candidate.gdpr_expiry_date), or as otherwise instructed by the Controller.
  • Notwithstanding the candidate.gdpr_expiry_date or Controller's specific instructions, all Personal Data of a Candidate will be retained by the Processor for a maximum period of two (2) years from the date of their initial input into the Platform, unless the gdpr_expiry_date is earlier, or unless the Controller deletes the data sooner using the functionalities of the Platform or instructs the Processor to do so.
  • Upon expiration of the retention period or upon a valid instruction or action from the Controller via the Platform, Personal Data will be securely deleted from the Processor's production systems.
  • Logs related to User activity within the Platform and API calls (if any) are retained for a defined period (e.g., 30/60 days) for security, auditing, and troubleshooting purposes.