Your data rights

Last updated: 13 July 2026

1. Your rights

If the GDPR applies to the processing of your personal data, you have the following rights, subject to the conditions and exceptions in the Regulation:

• Access - obtain confirmation of whether we process your data and a copy of it.
• Rectification - have inaccurate or incomplete data corrected.
• Erasure - have your data deleted where there is no overriding reason to keep it.
• Restriction - limit how we use your data in certain circumstances.
• Portability - receive data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller.
• Objection - object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent - where processing is based on consent, withdraw it at any time without affecting prior processing.
• Automated decisions - not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. For the data Gapfy controls, we make no such decisions and our AI features are assistive only. Job application forms on career sites we host may include knockout questions configured by the employer that automatically decline non-matching applications; the employer is the controller of that decision, and you can ask the employer for human review, express your point of view and contest the decision.

2. How to make a request

Send your request to privacy@gapfy.io and tell us which right you want to exercise. We may need to verify your identity before acting. We respond within one month; for complex or numerous requests we may extend this by up to two further months - if so, we will tell you within one month of your request, together with the reasons for the delay. Exercising your rights is free unless a request is manifestly unfounded or excessive.

If you have a Gapfy account, the fastest way to exercise erasure is self-service: you can delete your account yourself in the app's account settings, and workspace owners can delete their entire workspace, with the option to export the data first (a reversible grace period applies before anything is permanently deleted). Where you have used AI features, erasing an item also removes it from our AI semantic-search index, short-lived AI caches expire automatically, and our AI usage records hold only counts and metadata, not the content of your prompts.

3. If your data is held inside an organisation's workspace

When you use our products through an employer or another organisation, or when you apply for a job on a career site hosted by us, that organisation is the controller of the data in its workspace and Gapfy acts as its processor. In that case we will refer your request to the organisation and assist it in responding. Contact the organisation directly, or write to us and we will route your request.

4. Job applicants (career sites)

If you applied for a job through a career site hosted on gapfy.io, the employer that published the job is the controller of your application and Gapfy is its processor. You do not need to contact anyone to exercise your core rights: every career site links to a privacy page where you can request erasure of your application data, a full export (downloadable archive), restriction of processing, or the lifting of a restriction. Each request is verified by a link sent to the email address you applied with. If you agreed to stay in an employer's talent pool, you can withdraw that consent at any time by submitting an erasure or restriction request through the same page, or by contacting the employer.

5. Complaints

If you believe we have not handled your data correctly, please contact us first so we can put it right. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or with the data-protection authority in your country of residence or work.

6. Contact

Our data-protection contact point is privacy@gapfy.io. For more detail on what we process and why, see our Privacy policy.

This English-language version is the authoritative, legally binding version of this document. Translations are provided for convenience only.