GDPR & Your Rights

Last updated: April 14, 2026

VScout is committed to full GDPR compliance. This page explains your rights under the EU General Data Protection Regulation and how to exercise them.

Our GDPR Commitment

The General Data Protection Regulation (GDPR) applies to VScout when we process personal data of individuals in the European Economic Area (EEA) and United Kingdom. We take our obligations seriously:

Privacy by design: Data protection is built into our architecture from the ground up - row-level security, encryption, and data minimization
Lawful processing: We process personal data only with a valid legal basis (contract, consent, legitimate interest, or legal obligation)
Transparency: Our Privacy Policy clearly explains what data we collect, why, and who we share it with
Data minimization: We collect only the data necessary to provide our Service
Breach notification: In the event of a data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay

Your Data Rights

Right of Access

You can request a complete copy of all personal data we hold about you. We will provide this in a structured, machine-readable format within 30 days.

How: Go to Settings → Privacy & Data → Export Data, or email admin@vscout.co

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

How: Update your profile in Settings, or email admin@vscout.co with the corrections needed

Right to Erasure

You can request that we delete all your personal data ("right to be forgotten"). This includes your account, candidate data you uploaded, and AI action logs.

How: Go to Settings → Privacy & Data → Delete Data, or email admin@vscout.co

Right to Data Portability

You can export all your data in standard formats (CSV, Excel). This includes candidates, jobs, pipeline history, and interview records.

How: Go to Settings → Privacy & Data → Export Data

Right to Restrict Processing

You can request that we temporarily stop processing your personal data while a dispute is resolved or accuracy is verified.

How: Email admin@vscout.co with your restriction request

Right to Object

You can object to processing based on legitimate interests (e.g., analytics) or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

How: Email admin@vscout.co or unsubscribe from marketing emails directly

Controller & Processor Roles

Scenario	Data Controller	Data Processor
Your account data (name, email, etc.)	VScout	-
Candidate data you upload	Your organization	VScout
Candidates applying via career page	Your organization	VScout
Website analytics & cookies	VScout	PostHog, Google

When we act as a data processor on your behalf, we process candidate data only according to your instructions and our Data Processing Agreement.

International Data Transfers

VScout's infrastructure is primarily located in the United States. For transfers of personal data from the EEA/UK, we implement:

Standard Contractual Clauses (SCCs) as approved by the European Commission, incorporated into our Data Processing Agreement
Technical safeguards: AES-256 encryption at rest, TLS 1.3 in transit, and strict access controls
Sub-processor compliance: All our sub-processors maintain their own GDPR compliance and data transfer mechanisms
EU data residency: Available for Enterprise customers upon request

For Candidates

If you are a job candidate whose data has been uploaded to VScout by a prospective employer:

The company that uploaded your data is the data controller. Contact them first for access, rectification, or deletion requests
If you applied via a VScout career page, you provided consent at the time of application. You can withdraw consent by contacting the company or emailing admin@vscout.co
We support candidate data rights through our platform: employers can process erasure and portability requests directly
Candidate data is subject to retention policies set by the employer. After the retention period, data is automatically anonymized

Data Processing Agreement & Contact

Enterprise customers and organizations requiring formal GDPR compliance documentation can access our Data Processing Agreement (DPA), which includes Standard Contractual Clauses and our sub-processor list.

Data Protection Contact

Email: admin@vscout.co
Entity: VScout
Response time: Within 30 days (within 72 hours for erasure requests)

You also have the right to lodge a complaint with your local supervisory authority if you believe your personal data is being processed unlawfully.

Manage your data

Logged-in users can export or delete their data directly from their account settings.

Privacy & Data settings Contact privacy team