Our Commitment to Data Protection
Idonara is fully committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We understand that when you use our platform—whether as a candidate seeking employment or an organisation managing recruitment—you're trusting us with sensitive personal information.
We've built our platform with privacy by design and by default, ensuring that data protection is embedded in everything we do, from the initial system architecture to day-to-day operations.
Your Data Protection Rights
Under UK GDPR, you have specific rights regarding your personal data. We make it easy to exercise these rights through our platform and dedicated support team.
Right to be Informed
You have the right to know how your data is being collected and used. We provide clear privacy notices at every point of data collection.
Right of Access
You can request a copy of all personal data we hold about you. We respond to Subject Access Requests within 30 days.
Right to Rectification
If your data is inaccurate or incomplete, you have the right to have it corrected. Update your profile anytime or contact us.
Right to Erasure
Also known as the "right to be forgotten". You can request deletion of your data when it's no longer necessary.
Right to Restrict Processing
You can request that we limit how we use your data while disputes are resolved or accuracy is verified.
Right to Data Portability
Receive your data in a machine-readable format and transfer it to another service provider.
Right to Object
Object to processing based on legitimate interests, direct marketing, or research purposes.
Rights Related to Automated Decisions
Request human review of AI-assisted decisions that significantly affect you.
How We Apply GDPR Principles
Lawfulness, Fairness & Transparency
We process data lawfully, fairly, and transparently. You always know what we're doing with your data.
Purpose Limitation
We only collect data for specified, explicit, and legitimate purposes related to recruitment.
Data Minimisation
We only collect data that is necessary for the purpose. No excessive data collection.
Accuracy
We take steps to ensure personal data is accurate and kept up to date.
Storage Limitation
We don't keep data longer than necessary. Clear retention policies apply to all data.
Integrity & Confidentiality
We implement appropriate security measures to protect against unauthorised access.
Accountability
We take responsibility for compliance and can demonstrate our adherence to GDPR.
AI and Automated Decision-Making
Our platform uses artificial intelligence to assist in recruitment processes. Under Article 22 of UK GDPR, you have specific rights regarding automated decision-making. Here's how we ensure compliance:
Human Oversight
All final hiring decisions are made by humans, not AI
Transparency
Clear explanations of how AI recommendations are made
Right to Contest
Request human review of any AI-assisted decision
Bias Monitoring
Continuous monitoring for fairness across protected groups
Data Protection Impact Assessments
Regular DPIAs for all AI features
Audit Trails
Complete records of all AI-assisted decisions
Identity & Right-to-Work Verification
Where a role requires it, we verify your identity online through Veriff, a DIATF-certified identity verification provider, to a UK Government GPG45 Medium level of confidence — supporting the recruiting organisation's statutory right-to-work check.
What we collect
A photo of your identity document and a short liveness check (selfie or brief video) — special category (biometric) data under Article 9 UK GDPR
Our lawful basis
Article 9(2)(b) UK GDPR and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018 (employment-law obligations, including right-to-work checks)
Where it's processed
Veriff processes data on servers within the European Economic Area, defaulting to Ireland — never on Veriff's own premises
Veriff's role
Veriff is our processor for running the check, but also acts as an independent controller for its own "Permitted Business Purposes" — reusing verification data to train its own machine-learning and fraud-detection models
Alternative to online verification
You can ask your recruiter for an in-person, manual identity check instead
Your rights
You can ask to see, correct, export, or delete your data, or dispute a verification outcome, at any time
Data Retention Periods
| Data Type | Retention Period | Basis |
|---|---|---|
| Active candidate profiles | Duration of recruitment + 2 years | Legitimate interest |
| Application records | 3 years from application date | Legal requirement |
| Interview recordings | 6 months post-decision | Consent |
| Account data | Until deletion + 30 days | Contract |
| Audit logs | 7 years | Legal requirement |
| Identity verification — document/biometric data | 30 days, then reduced to outcome | Legal obligation |
| Identity verification — right-to-work outcome | Duration of employment + 2 years | Legal obligation |
How to Exercise Your Rights
Through the Platform
- Access and download your data from Settings > Privacy
- Update or correct your information in your profile
- Delete your account and associated data
- Manage your consent preferences
Contact Our DPO
For complex requests or if you need assistance, contact our Data Protection Officer:
We respond to all requests within 30 days. Complex requests may require an additional 60 days, in which case we'll notify you.
Making a Complaint
We take all complaints seriously and aim to resolve them promptly. If you're not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane, Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
Questions About Your Data?
Our Data Protection Officer is here to help. Get in touch if you have any questions about how we handle your personal information.