1. Who we are
Veer operates the veer.ie recruitment platform and AI-assisted candidate assessment service for the UK and Ireland market, acting as a data controller for candidate and employer personal data processed through veer.ie and the Veer assessment platform. Throughout this policy, "we," "us," and "our" refer to Veer.
2. What we collect
| From candidates | From employers |
|---|---|
| Name, email, location, work-authorisation answers | Company name, registered address, contact person, billing details |
| CV, cover letter, work history, education, skills, certifications | Job specifications: title, required skills, salary band, location |
| Assessment answers and scores (Stage 1 multiple-choice, Stage 2 code) | Payment records (processed by Stripe — we do not store card numbers) |
| On-camera video and audio interview recordings and a coarse framing/movement signal (Stage 3) — see section 4 | Communications with our team |
| Anti-cheat security events: browser tab/window focus changes during Stage 2 (coding) and Stage 3 (interview), recorded as timestamped events | |
| Technical data recorded for assessment integrity: a masked/partial IP address (not your device's full IP), approximate country, coarse browser/device information | |
| Text extracted from your uploaded CV file (parsed automatically from PDF/Word documents) for screening and search |
3. Why we process it
Candidate data: to assess suitability for a role you've applied to, to run the timed skills assessments fairly and securely, and — where you've given consent at registration — to contact you about your application or match you to other roles. This processing is necessary to perform our contract with you (Art. 6(1)(b) GDPR) and, for the assessment-integrity signals, our legitimate interest in running assessments fairly for every candidate (Art. 6(1)(f)). Employer data: to perform our contract with you (posting roles, running assessments, billing) and to comply with our legal obligations, e.g. tax records for Stripe payments (Art. 6(1)(b) and 6(1)(c)). We do not sell personal data, and candidates are never charged to apply.
4. On-camera interview data & anti-cheat monitoring
The final interview stage (Stage 3) asks you to record short video and audio answers to a small number of questions, with your camera active throughout. Recordings and your typed/text answers are stored as evidence for the human reviewer assessing your application. While recording, your browser computes a coarse signal — how consistently you're framed in shot and how much movement is detected — from downscaled video frames, entirely on your own device.
- This is not facial recognition and is never used to identify or verify who you are.
- It is not true eye-contact or gaze tracking — it is a coarse proxy for framing and movement, described accurately as such to your reviewer, never oversold as more than it is.
- It is advisory context for a human reviewer only. No score or signal from this stage can automatically reject or advance you.
- Recordings are used solely for review of your application for the role you applied to, retained only for the period in section 7, and never used to train AI models without separate, explicit, opt-in consent.
Anti-cheat monitoring. During the timed coding stage (Stage 2) and the interview stage (Stage 3), Veer records when your browser tab or window loses focus, as a zero-tolerance integrity control described to you before each stage begins. A confirmed tab/window-switch event during Stage 3 ends that assessment attempt and can result in a 7-day ban on re-attempting assessments on Veer. This monitoring is limited to focus-change timestamps — Veer does not capture your screen contents, other applications, or browsing activity.
5. Automated scoring & human review
We use an explainable scoring model (your "Scorecard") that breaks a match down into named, weighted factors with the evidence behind each one — never a single opaque number. Consistent with UK/EU GDPR Article 22, a Scorecard alone never makes or determines a recruitment decision. A qualified human reviewer — with real authority to change the outcome, the competence to assess it, and the time to do so — confirms or overrides every recommendation before it reaches you or the employer. We treat a reviewer override rate near zero as a red flag, not a sign of a well-tuned model, and it triggers internal review: human oversight here is meant to be genuine, not a rubber stamp.
Our scoring is deterministic and versioned. If we identify a flawed question or rubric item, we can trace which candidates it affected and re-score them retroactively.
6. High-risk AI system disclosure & what we don't do
Under the EU AI Act, an AI system used to evaluate candidates for employment is classified as high-risk (Annex III). We're telling you this because the Act treats it as something you're entitled to know, not because it changes how your application is handled — human review of every outcome, described above, was already how we operate. The Act's specific high-risk obligations (technical documentation, logging, oversight design) have a compliance deadline of 2 December 2027 under the EU's Digital Omnibus amendment, but we're building the underlying architecture — audit logging, human-in-the-loop review, and documented data governance — now, not waiting for the deadline. We've also carried out a Data Protection Impact Assessment for this processing, as GDPR requires for systematic, at-scale, automated evaluation of individuals.
Separately, and as a firm commitment rather than a bare legal minimum: Veer's assessment platform performs no emotion inference or emotion recognition of any kind, no facial recognition or facial image scraping, and no biometric processing — no facial matching, no gaze tracking, no voice-print analysis. These are prohibited practices under the AI Act (in force since February 2025), and we don't do them regardless of what the law requires, because we don't think they belong in a fair hiring process. Interview recordings are held only for human viewing, as described in section 4.
7. How long we keep it
Every candidate and employer account gets a retention date set at sign-up, one year from registration (or from your last "retain" decision). We do not silently auto-delete when that date passes: we email you once and prompt you in-app to choose Retain (keeps your account and history for another year) or Delete (permanently anonymizes your account — see below). If you don't respond, your data simply remains stored, unchanged, until you make a choice. This one-year cycle governs your identity and account data.
On top of that account-level cycle, specific assessment artifacts are purged automatically on their own shorter schedule, independent of whether you've made a retain/delete choice: interview video and audio recordings are deleted after 12 months from the interview being scored, interview transcripts and written responses are deleted after 12 months, and audit logs are deleted after 36 months on a rolling basis. These purges run automatically — you don't need to request them — and are themselves logged for regulatory evidence (except the audit-log purge itself, which isn't logged a second time, to avoid the log immediately re-populating the window it just cleared). You can still request earlier deletion of any of this data at any time under section 10.
8. Who we share it with
With the employer whose role you applied to, for the purpose of that application only. With service providers acting on our instructions under a data processing agreement — our application hosting and database infrastructure, Stripe (payments), and our email delivery provider. We do not sell data to third parties or brokers, and we never share your data with a third party for their own marketing purposes.
9. Where it's stored
Candidate and employer data is stored in the EU West (Ireland) region. We do not transfer personal data outside the UK/EEA without an appropriate legal safeguard (such as Standard Contractual Clauses). For the assessment platform, EU-only residency is a deliberate design target — the intent is to keep hosting, database, file storage, and any AI-processing components EU-resident and technically enforced, not merely contractual. If we become aware of a personal data breach, our internal target is to notify affected individuals within 24 hours of becoming aware, giving room within the 72-hour regulatory notification window.
10. Your rights
Under UK GDPR, the Data Protection Act 2018, and EU GDPR, you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; and not be subject to a decision based solely on automated processing. We aim to respond within one month.
Access & export. Your account settings include a self-service export that returns everything Veer holds about you — profile, applications, quiz attempts, scorecards, verification status, notifications, talent-pool activity, and cookie consent history — immediately, with no need to wait for a manual request.
Erasure. Self-service account deletion is immediate and irreversible. It anonymizes your name, email, and contact details, deletes your uploaded CV and interview recordings from storage, and permanently disables login to the account. Your application and scorecard records are kept in anonymized form because employers rely on them as a hiring record, but they can no longer be linked back to you by name, email, or contact details. Every export and deletion request is logged for audit purposes.
What access requests don't cover. You're entitled to your own data — your responses, scores, scoring rationale, and recordings. You are not entitled to the underlying question bank: correct answers, difficulty weightings, and rubric definitions are withheld from access and export requests. This isn't a way of hiding how you were scored — the reasoning behind your score is disclosed — it's to preserve assessment integrity for every other candidate who takes the same questions after you.
To exercise any of these rights, use the tools in your account settings, or contact privacy@veer.ie.
11. Security
Session cookies are HttpOnly and restrictively scoped. Assessment timers, scoring, and invitation tokens are enforced server-side, never trusted from the browser. Access to candidate data is restricted to authenticated staff on a least-privilege basis. Full technical controls are documented in our internal security architecture and available to regulators on request.
12. Cookies
We use strictly necessary cookies to run the platform (login sessions, security, remembering your cookie choice), plus optional analytics cookies you can accept or decline — with no marketing/advertising cookies in use today. Declining optional cookies is exactly as easy as accepting them and never degrades the site. See our full Cookie Policy for the complete list of cookies and how to change your preference at any time.
13. Contact & complaints
Questions or requests: privacy@veer.ie. If you're unhappy with how we've handled your data, you also have the right to complain to the Irish Data Protection Commission (dataprotection.ie) or the UK Information Commissioner's Office (ico.org.uk).
Frequently Asked Questions
How do I delete my data?
Use the self-service deletion tool in your account settings. It's immediate and irreversible: it anonymizes your name, email, and contact details and deletes your uploaded CV and interview recordings. Application and scorecard records are kept in anonymized form as an employer hiring record but can no longer be linked back to you.
Do you sell my data?
No. We never sell personal data to third parties or brokers, and we never share your data with a third party for their own marketing purposes. Data only goes to the employer whose role you applied to, and to service providers processing it on our instructions (hosting, payments, email delivery).
How do I get a copy of everything Veer holds about me?
Your account settings include a self-service export covering your profile, applications, quiz attempts, scorecards, verification status, notifications, talent-pool activity, and cookie consent history — delivered immediately, no manual request needed.
Is a hiring decision ever made purely by an algorithm?
No. Your Scorecard breaks a match into named, weighted, explainable factors — never a single opaque number — and consistent with GDPR Article 22, a Scorecard alone never makes or determines a recruitment decision. A qualified human reviewer makes every hiring-stage decision.
Where is my data physically stored?
In the EU West (Ireland) region. We do not transfer personal data outside the UK/EEA without an appropriate legal safeguard, such as Standard Contractual Clauses.