GDPR & Data Processing — Wilma

This page explains how Wilma supports customers with data protection obligations under the GDPR, UK GDPR, Swiss data protection law, and similar privacy frameworks.

In most cases, the employer or organisation named in the job posting is the controller for candidate application data processed in Wilma.

Wilma acts as the processor or service provider, processing personal information on the customer’s behalf and according to the customer’s instructions.

Wilma processes recruitment data to provide the platform and support these activities:

• Application collection and candidate workflow management
• Recruiter-to-candidate communication
• Interview scheduling and coordination
• Transcription, summarisation, and structured review support
• Candidate-role matching, strengths and gaps, and candidate packs where enabled by a customer

Wilma may use AI systems, including large language models, as part of these processing activities. These systems may process candidate-submitted application materials to parse, structure, summarize, and extract role-relevant information for human review.

Where Wilma uses AI-assisted processing, the purpose is to support recruitment administration and human review. AI outputs may include summaries, structured extractions, transcripts, suggested interview questions, and workflow support.

Customers remain responsible for ensuring that their use of Wilma has an appropriate lawful basis, that candidates receive appropriate transparency notices, and that hiring decisions comply with applicable employment, equality, and data protection laws.

Wilma configures AI-assisted processing to avoid using candidate data for general-purpose model training unless explicit permission is obtained. Where practical, Wilma applies data minimisation measures, access controls, retention controls, and contractual safeguards with relevant subprocessors.

Wilma may engage subprocessors to provide hosting, storage, email delivery, AI processing, analytics, support, monitoring, and other platform services.

A current subprocessor list is available to customers on request. See the Subprocessors page or contact privacy@withwilma.com.

Where Wilma processes data on behalf of customers, we support customers in responding to valid requests relating to access, correction, deletion, portability, or objection rights, to the extent required by law and our contractual commitments.

Where personal information is transferred outside the EEA, UK, or Switzerland, Wilma relies on appropriate safeguards such as contractual protections, including Standard Contractual Clauses where applicable.

Wilma acts as a processor where it processes candidate and recruitment data on behalf of a customer. The customer is normally the controller of candidate application data and is responsible for determining the lawful basis, role requirements, hiring process, retention period, and hiring decisions.

Wilma can provide a Data Processing Agreement on request for customers who require one. The DPA is intended to cover processing instructions, confidentiality, security measures, subprocessors, data subject rights support, breach and security incident support, deletion or return of data, audit and compliance information, and international data transfers.

To request a DPA, contact privacy@withwilma.com.

A summary of the DPA request path is also available on the Data Processing Agreement page.