Applicants always have the power to remove their data at any time. If however they leave their data in place for extended periods, the data retention policy configured by you will be applied and their data will eventually be removed.
To edit your organisations data retention policies you must be have the "Company Admin" or "Account Admin" security role. If you are in either of these roles, select "My Account" and then navigate to the "Edit Preferences".
If you are a member of either security role mentioned earlier, you can see the current Data Protection policy retention options available to you as shown in the screenshot below.
In all circumstances where necessary, an anonymised version of an application will be retained for reporting purposes until the data retention policies finally remove all the data involved.
Candidates v Applicants
Candidates are generated from the Talent pool recruiters build when Applicants provide consent to be in the Talent pool. Candidate records are created when a new vacancy is created and the system searches the existing Talent pool for suitable matches. Any suitable matches become "Candidates" for the new vacancy.
Candidates are not Applicants and are not linked to a vacancy in the same way as an Applicant. Instead, they can be removed, or invited to apply. If Candidates are removed, they are not removed from the Talent pool, instead, only the link as a "Candidate" the the new vacancy is removed.
If someone applies who was a "Candidate" then they are linked to the vacancy as an Applicant. Their candidate record is updated with the notion of the application for reporting purposes.
Candidates are typically only useful for a short period of time before their data is stale. As such, retaining candidate records is limited to a choice of three to six months. Candidate records that are marked as "Invited" or as "Applied" are retained regardless of the limit for reporting purposes.
Talent pool vacancies
Talent pool vacancies are special types of vacancy that people can register against to be notified of jobs they may be suitable for in the future. People who register against a talent pool vacancy can be retained for between six months and three years from the point of their registration.
Retaining applicant data
Applicant data is retained based on a cumulative approach to data retention based on a few key points in the time-line of a vacancy and application.
Initially vacancies are archived after they've been closed for a specified period of time between three months and a year *after* they've been closed.
Archived vacancies can then be retained for a period of three months to three years after they've been archived for reporting purposes.
Applicants are then retained for a further period of three months to three years after the archived vacancies have been removed.
All of these limits are "upper limits" for data retention. At any time a recruiter can close or archive a vacancy early, after which the data retention policy for the following part of the overall policy applies. In addition, applicants can remove themselves from the talent pool or from the system entirely.
Tracking applicants even after they've removed their data
When an applicant makes an application, it creates a one-way hash of some critical parts of their data and uses it as a "fingerprint" to identify them. These fingerprints are stored anonymously against vacancies and are used to identify attempted duplicate applications. There is no way to identify an derive any personal data of an applicant from a fingerprint.
If an applicant re-applies to a vacancy, the same critical data they provide is used to generate a copy of their fingerprint and it is compared against all the fingerprints stored against the vacancy. If the fingerprint matches an existing one, then the application is identified as a duplicate.