GDPR and EU AI Act compliant
Ployo meets the requirements of the EU General Data Protection Regulation and the EU Artificial Intelligence Act. Built for regulated hiring in Europe, Australia and the UK.
How we handle candidate data
Every candidate who interviews with Ployo is protected the same way, regardless of which customer invited them. This is what that means in practice.
Transparency
Candidates are told what is collected and why before the interview begins.
Lawful basis
We process candidate data as a processor on our customer's instructions, under a signed Data Processing Agreement.
Data minimisation
We collect what the role requires, nothing more.
Retention
90 days by default, configurable per customer, down to 30 days or shorter on request. Your retention window is agreed at onboarding and committed in the Data Processing Agreement.
Candidate rights
Access, correction, erasure, portability and objection, all handled within one month.
Human decision
Ployo never makes the hiring decision. It produces evidence and a score. A person decides.
Explainability
Every score is backed by the verbatim answer that produced it, so a candidate can be told exactly why.
Security
Encryption in transit and at rest, least-privilege access, and signed time-limited URLs for all candidate media.
Breach notification
Customers are notified without undue delay and within 72 hours.
EU representative
European customers are given our EU representative details at contracting, as required by GDPR Article 27.
Our position under the EU AI Act
AI used to screen candidates for employment sits in the highest risk tier the EU AI Act defines outside of outright banned uses. We built Ployo to that standard rather than treating it as a compliance afterthought.
Classification
AI used to evaluate candidates is high risk under Annex III, point 4(a). Ployo is classified accordingly and built to that standard.
Risk management
We maintain a documented process for identifying and reducing bias, error and misuse.
Data governance
The data driving evaluation has documented sources and controls.
Technical documentation
We maintain documentation describing how the system works, its accuracy and its limits.
Human oversight
Ployo is designed so a person can review, override and reject any output.
Logging
The system automatically records its activity, retained for at least six months.
Transparency
Candidates are told clearly that they are speaking with an AI interviewer.
No emotion inference
Ployo does not infer emotions, mood, personality or affect. Inferring emotion in the workplace is prohibited in the EU, and we do not do it anywhere we operate. We assess what a candidate says against the role's requirements, nothing else.
Accuracy and robustness
Performance is monitored in production and regressions are tested before every release.
Post-market monitoring
We run ongoing monitoring with a defined process for reporting serious incidents.
Data residency
EU, UK, Australian and US regions are available. Customer data is provisioned in the region chosen at onboarding, and that choice is committed contractually in the Data Processing Agreement.
Sub-processors
These are the sub-processors that support the Ployo platform, and why each one is there.
| Sub-processor | Purpose |
|---|---|
| Amazon Web Services | Infrastructure and storage |
| OpenAI | Interview reasoning and evaluation |
| Deepgram | Speech to text and text to speech |
| LiveKit | Real-time video, self-hosted by Ployo |
| SendGrid | Transactional email |
| PostHog | Product analytics |
| Stripe | Billing |
The current list is maintained here, and customers are notified of any change to it.
Retention schedule
| Data | Retention period |
|---|---|
| Candidate data (recordings, transcripts, scores) | 90 days by default, configurable per customer |
| System and audit logs | Minimum 6 months, required for AI Act record-keeping |
Documentation available on request
The following are available to customers and prospective customers on request:
- Data Processing Agreement
- Data Protection Impact Assessment template
- Sub-processor list
- Security overview
- AI Act technical summary
- Instructions for use
Compliance questions before you commit?
Book a 30-minute call with the founder. We'll walk through the Data Processing Agreement, data residency options and how human review works inside Ployo for your organisation.
Talk to the Founder