GDPR Compliance
Last updated: March 26, 2026
1. Our Commitment
QuestEdge is committed to complying with the General Data Protection Regulation (GDPR) for all users in the European Economic Area (EEA), United Kingdom, and Switzerland. This page explains how we handle personal data under GDPR requirements.
2. Data Controller & Processor
When you use QuestEdge, your organization acts as the Data Controller for candidate and hiring data. QuestEdge acts as the Data Processor, processing data on your behalf according to your instructions and our Data Processing Agreement (DPA).
For account and usage data, QuestEdge acts as the Data Controller.
3. Legal Basis for Processing
We process personal data under the following legal bases:
- Contract performance — processing necessary to provide the QuestEdge service as agreed in our Terms of Service
- Legitimate interest — improving and securing the platform, preventing fraud, and providing customer support
- Consent — for optional analytics cookies and marketing communications, where applicable
- Legal obligation — where we are required to retain or disclose data by law
4. Your Rights Under GDPR
As a data subject, you have the following rights:
Right to Access
You can request a copy of the personal data we hold about you. We will respond within 30 days.
Right to Rectification
You can request that we correct inaccurate personal data. You can also update your profile information directly in the platform.
Right to Erasure
You can request deletion of your personal data. We will comply unless we have a legal obligation to retain it. Deletion will be completed within 30 days.
Right to Data Portability
You can request your data in a structured, commonly used, machine-readable format (JSON or CSV).
Right to Object
You can object to processing based on legitimate interest. We will cease processing unless we have compelling legitimate grounds.
Right to Restrict Processing
You can request that we restrict processing of your data while a complaint or dispute is being resolved.
5. AI Processing & Automated Decisions
QuestEdge uses AI to generate suggestions such as candidate scores and feedback summaries. These are recommendations only — no hiring decisions are made automatically by the platform. Human oversight is required for all hiring decisions.
Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing. QuestEdge is designed so that all AI outputs require human review before action is taken.
6. Data Transfers
If your data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. Our AI processing provider (Anthropic) maintains their own GDPR compliance measures.
7. Data Protection Officer
For GDPR-related inquiries, you can contact our data protection team at dpo@questedge.com.
8. Data Processing Agreement
Enterprise customers can request a Data Processing Agreement (DPA) that details our obligations as a data processor. Contact legal@questedge.com to request a DPA.
9. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33 and 34.
10. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.