Privacy & GDPR

How Vakanssi captures consent, answers a candidate's data export or erasure request through WordPress's own tools, and cleans up old candidate data on its own, all in the free plugin.

Hiring means holding other people’s personal data: names, emails, phone numbers, CVs. Vakanssi’s privacy tooling is part of the free plugin (the Privacy & Data Retention module, renamed from Privacy & Compliance in v0.37.11), and it is built so the safe thing happens on its own.

Since v0.35.1 the module is always on: it cannot be switched off on the Features tab, because doing so would silently stop exports, erasures, and the retention purge.

Consent is recorded with every application, old data is cleaned up daily without you lifting a finger, and when a candidate asks to see or delete their data, you handle it with tools that are already in WordPress.

This page covers what runs automatically, and what to do when a real person asks you for something.

Consent at application time

Every application form ends with a required consent checkbox. The candidate cannot submit until they tick it. If your site has a privacy policy page set (under Settings, then Privacy in WordPress) and that page is published, the checkbox links to it, so the candidate can read what they are agreeing to before they apply.

How long you keep applications is normally stated in that privacy policy. If you want it on the form as well, turn on Show on the apply form under Settings, then General, then Data retention: a line of small print beneath the Submit button then states the with-consent window described below, for instance “We keep your application for up to 24 months, then delete it.” It is off by default.

When the application arrives, Vakanssi records the consent on the application itself: whether it was given, and when. That record travels with the application, shows up in data exports as “Consent given: Yes/No”, and sets how long the application is kept (see the retention purge below).

Candidate data rights

Privacy laws like the GDPR give people the right to see the data you hold about them and to have it deleted. You do not need an extra plugin for either. WordPress itself ships two tools for exactly this, under Tools in the left sidebar of the WordPress admin: Export Personal Data and Erase Personal Data.

Vakanssi plugs its candidate data into both, registered under the name “Hiring: candidate data”, and matches people by their email address. Because it plugs into the built-in tools, one request reaches everything at once: the candidate’s profile, their applications, their uploaded files, and the details attached to each application.

What an export contains

When you run an export for a candidate’s email, WordPress builds a downloadable file. The Vakanssi part comes in these groups, each shown only when there is something in it:

• Candidate profile: their name, email, phone, and location, plus any LinkedIn, country, website, headline, or recruiter note saved on the person.
• Candidate tags (Sourcing Pro feature, requires a Vakanssi Pro license): their talent-pool tags.
• Job applications: one entry per application, with the position, the stage it reached, its status, the date they applied, whether consent was given, their cover letter, their LinkedIn profile, each uploaded file, and the referrer and country (from their IP address) recorded when they applied. Screening Pro feature, requires a Vakanssi Pro license answers are included too.
• Recruiter notes, Interviews, and Emails sent to you, each tied to the position it belongs to.
• Evaluations / scorecards (Scorecards Pro feature, requires a Vakanssi Pro license): the recommendation, comment, and scores.

The free plugin does not export or erase data that only Pro features create, so a site that once ran Pro and downgraded to free can no longer rely on its export or erasure to fully cover tags, scorecard evaluations, screening answers, or webhook history left over from that period. Only the Pro plugin still handles all of it.

Every CV the candidate has on file is also enclosed in the downloaded archive itself, in a “curriculum-vitae” folder, not just named in the listing, so the download WordPress emails the candidate is a complete copy of what you hold on them.

Notes go out as the candidate’s data, so the note text itself is included, but the author’s identity is not, and neither is a teammate’s name that a Collaboration Pro feature, requires a Vakanssi Pro license @mention inserted: it shows as ”@[teammate]” instead. Those are your staff’s personal data riding inside the candidate’s record, not the candidate’s own. For the same reason, the export never names who gave a scorecard or conducted an interview.

What an erasure removes

An erasure is permanent and thorough. It starts with the person: it clears the extra profile details (LinkedIn, website, and so on). On the Pro plugin, it also removes their talent-pool tags (Sourcing Pro feature, requires a Vakanssi Pro license) and wipes their name and email from any webhook delivery still in the log (Integrations Pro feature, requires a Vakanssi Pro license).

Then, for each application, Vakanssi deletes the CV files first (the actual file, not just the link; when an application has several, they are removed all-or-nothing), then any extra details they submitted, internal notes, interviews, evaluations, and the email history. Once every one of the candidate’s applications is fully cleared, it deletes the candidate record itself.

Honest footnotes, shown in the tool’s own results:

• One anonymised entry is kept in the audit log for accountability. It holds no name, no email, and no CV, and the IP address is anonymised.
• If a stored CV file cannot be removed (a permissions problem, or the storage folder has moved), Vakanssi stops before touching that application’s records, rather than reporting the erasure done with the bytes quietly left behind.
• If any part of a candidate’s data cannot be erased, the candidate record itself is kept too, not deleted, so the request is reported as retained with an explanation and can be found and re-run once the cause is fixed, rather than being quietly counted as erased.

On a multisite network, export and erasure work one site at a time. Erasing a person on one site leaves their applications on other sites of the network untouched, so run the request on each site they applied to.

Handling an erasure request, step by step

Say a former applicant emails you: “Please delete my data.” Here is the whole process.

An export works the same way from Tools, then Export Personal Data: you request it, the candidate confirms, and WordPress emails them a download link.

The automatic retention purge

You should not keep candidate data forever, and with Vakanssi you do not have to remember to clean it up.

Every application is stamped with a retention deadline the moment it is submitted: 24 months if the candidate gave consent, and 6 months if not. Once a day, a scheduled background task (part of WordPress’s built-in scheduler) finds applications past their deadline and anonymises them. Anonymise, not delete, and the difference matters:

• Deleted for good: the CV files and any extra details the candidate submitted, plus the personal data left in linked records: recruiter notes, the sent-email log, interviews, and Scorecard Pro feature, requires a Vakanssi Pro license evaluations for that application.
• Blanked out: the person’s name, email, phone, location, and extra profile details, once none of their other applications is still waiting to be anonymised. On the Pro plugin, this also clears their talent-pool tags (Sourcing Pro feature, requires a Vakanssi Pro license) and wipes their name and email from any webhook delivery in the Integrations Pro feature, requires a Vakanssi Pro license log, the same as a manual erasure does.
• Kept, anonymously: the application’s shell, meaning which job it was for, which stage it reached, and its dates, so your hiring statistics stay accurate.

After the purge runs, nothing that identifies a person remains, but “we had 120 applicants for this role and hired 2” is still true. Each anonymisation is noted in the audit log.

The purge works in batches of 200 applications. When a batch is full, the next one runs a minute later, up to 100 follow-ups, so a backlog of up to about 20,000 applications clears in a single day without one long run slowing your site.

If a CV file cannot be removed on a given run (rare, usually a filesystem hiccup), Vakanssi keeps that application’s retention deadline in place and retries the file removal on the next run, rather than marking it done with the bytes still left behind.

Beyond the file removal, each application’s own purge (notes, interviews, scorecard evaluations, email history, and the anonymisation itself) is all-or-nothing: if it is interrupted partway through, nothing from that step is left half-done, and the next run picks the whole application back up.

This clean-up normally runs once a day through WordPress’s own background scheduler. If that scheduler ever stalls (rare, but possible on a very quiet site, one with the scheduler disabled, or one where a firewall blocks it), Vakanssi runs the same clean-up as a fallback the next time an admin visits wp-admin, at most once an hour, so the deadline still holds.

This is a safety net, not a substitute: see Going live: production setup for keeping the scheduler itself healthy.

What is automatic, and what needs you

In short: day-to-day compliance runs itself. You only step in when a real person asks for something, and the built-in WordPress tools carry you through it.

Deleting everything on uninstall

Removing the Vakanssi plugin does not delete your hiring data. That is deliberate, so an accidental uninstall can never destroy your records. If you genuinely want everything gone when the plugin is removed, there is an explicit opt-in: Delete all data on uninstall, under Hiring, then Settings, then General, in the Data & privacy section. See Backups & data for exactly what it removes and how to back up first.