◎Candidates in practice

As soon as someone is seriously in the running for a placement — not at the first loose contact.

The difference matters because obligations are attached to a candidate record: you store a CV, qualifications, often a photo. That is more than a business card.

Create one if:

• Documents are available.
• There has been a conversation with a concrete aim.
• The person knows that you are using their data for the placement.

Do not create one for:

• Contacts from a trade fair without documents.
• Names from a network whom you have never spoken to.

The last one in the list is also the legally delicate one: compiling a profile from public sources without the person knowing is something different from receiving an application.

Enlarge

For an application that was sent to you: generally not — the processing is necessary to initiate the relationship.

What you need consent for:

• Passing details on to clients before the person has agreed.
• Adding them to a pool beyond the current process.
• A photo in a profile that you send around.

What it looks like in practice: ask once, in writing, with a clear statement — for what, for how long, to whom. Record when and how the answer came.

What you must communicate regardless of consent: that you are processing the data, for what purpose, for how long and which rights exist. That is an information obligation, not a question of consent.

And the most important rule in everyday work: give nothing to a client before the person knows about it.

On the candidate record, not in the mailbox and not on a drive.

What belongs there:

• CV, in the version you actually use.
• References, where relevant.
• A photo, if one is available and may be used.

What you should bear in mind:

• One version, not five. When the CV is updated, replace it.
• Meaningful file names. “CV_Meier_2026.pdf” instead of “scan001.pdf”.
• No loose notes in files. Whatever you want to remember belongs in the note on the record — there it can be found and deleted.

And a technical note: uploaded files are kept in permanent storage that survives a software update, and they are included in backups. You do not need to do anything for this.

Only with agreement — and that is narrower than many people assume.

What applies:

• A photo in the CV does not mean you may pass it on. It means you may see it during the application process.
• For passing it on to clients, you need agreement.
• For a profile you send around, all the more so.

What you should do: ask explicitly once — “May we use your photo in the profile we send to the company?” — and record the answer.

And the practical advice: ask yourself whether the photo adds anything. In many cases, a profile without a photo is more objective and at the same time avoids a whole class of discrimination complaints.

As for pictures from other sources: you may not simply take a picture from a networking profile.

In this order — each step before the next:

1. Talk to the person. Is the position interesting? Do the location, salary and timing fit?
2. Obtain agreement to be introduced to this company. By name, not across the board.
3. Put the profile together — what the client needs, not everything you have.
4. Send it and record the status.
5. Follow up if nothing comes back.

What breaks this order and still often happens: sending documents in advance “just to have a look”. That is passing on personal data without a legal basis.

Data minimisation here means: few clients need date of birth, address and marital status for an initial assessment.

Whatever supports the decision, and nothing beyond that.

What belongs in it:

• Qualifications and professional experience, related to the position.
• Availability.
• Special skills that count.
• Your assessment, clearly marked as such.

What does not belong in it:

• Date of birth, marital status, nationality, photo — unless objectively necessary.
• Health information.
• Your notes from the conversation that were not meant to be passed on.

The last point is the most common mistake when putting a profile together: an internal note slips into the profile because it is attached to the same record.

Check the profile before sending it. Read it through once, asking yourself: would I want to show this to the person?

Factual things you need professionally, and nothing you would not say to the person’s face.

The yardstick is practical: every note may have to be disclosed in response to a subject access request. Write in a way you can live with.

Fine:

• “Looking for something close to home, max. 30 km.”
• “Notice period 3 months to the end of a quarter.”
• “Professionally suitable, has experience in the required area.”

Not fine:

• Value judgements about the person.
• Information on health, religion, origin, political opinion — unless, exceptionally, it is objectively necessary and permitted.
• Assumptions about private circumstances.

And the side effect of factual notes: colleagues can use them too. A note that was just your own annoyance helps nobody.

Particular caution is needed here — this is the most legally sensitive point in the whole system.

What applies: AI systems used for selection decisions in an employment context are classed as high-risk under the European AI Act. Obligations come with this: human oversight, transparency, documentation, checking for discrimination.

What Aurora Hive Sales does: the AI produces an assessment of how well a profile matches a position. It does not decide and does not screen anyone out.

What you must do:

• Check every assessment yourself. The order of a list is a suggestion, not a decision.
• Do not reject anyone on the basis of a machine assessment alone.
• Remain able to explain why you decided for or against someone.

If you are unsure how far you may use this: have it checked legally before you use it widely.

Promptly, kindly and without reasons that can be challenged.

The structure:

1. Thanks for the application.
2. The rejection, clearly.
3. No assessment of the person.
4. If applicable: an offer to stay in touch for other positions — with a note that you would keep the documents for that purpose.

What you should avoid:

• Reasons that could be linked to a protected characteristic — age, origin, gender, disability. Even well-meant wording can do that.
• “We have decided on a younger applicant” is the textbook case.
• Long explanations. The more reasons, the more there is to attack.

And the timing: rejections should be sent promptly. Weeks of silence are not only impolite — they keep the documents on file without a purpose.

After the process has ended, only as long as there is a reason.

The usual practice:

• About six months after the rejection. That covers the period within which claims for discrimination can be made, with a little margin.
• Then delete them — unless the person has agreed to be added to a pool.
• With agreement, for as long as agreed, and then send a reminder instead of extending silently.

What you should set up: a fixed date on which you go through the completed processes. Quarterly is enough.

What is not acceptable: keeping documents “just in case”. That is the norm in practice and still not permitted.

Periods like these are guidelines from practice, not a guarantee — if in doubt, have your retention checked.

To a limited extent — and the line is not where many people suspect.

What is generally fine: a look at a professional networking profile that the person created themselves for professional purposes.

What is problematic:

• Private social networks. They are not intended for professional purposes.
• Systematically compiling a profile from several sources.
• Copying photos.
• Anything you learn about protected characteristics — and then let influence the decision.

The last of these is the dangerous one: once you know something, you cannot un-know it. If you reject the person later, the suspicion is there.

And the information obligation: if you collect data from other sources, you must inform the person about it.

With agreement, with maintenance and with an expiry date.

The three conditions:

1. Agreement to be added, explicit and documented.
2. Being up to date. A two-year-old CV describes someone else.
3. A date on which you ask whether the interest still exists.

What a pool needs in practice:

• Clear characteristics you can search by — qualification, region, availability.
• A note on the status: when you last spoke, what was discussed.
• Consistent clearing out. Anyone who no longer wants to be in it or can no longer be reached should be removed.

The most common mistake: a pool into which everything goes and from which nothing ever leaves. After two years it is both unusable and legally vulnerable.

An annual message — “Are you still interested?” — solves both problems at once.