CvRadar — User obligations: responsible use guide

Version 1.0 — 31 October 2026

This text is a draft prepared with the assistance of artificial intelligence and should be reviewed by a lawyer before relying on it.

This document is available in Italian, English and Russian. In case of any discrepancy between the versions, the Italian version prevails.

This guide summarises the main obligations of anyone using CvRadar to recruit staff. It is not legal advice and does not replace an analysis of your specific case. The legislation cited is up to date as of 31 October 2026.

1. Who is responsible

When you collect and assess CVs with CvRadar you are the data controller (Article 4(7) GDPR) of the candidates' data and the deployer of the AI system under Regulation (EU) 2024/1689 ("AI Act"). The author of CvRadar does not receive or process the data.

2. Legal basis

• Applications for a position you advertised: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
• Unsolicited CVs: Article 111-bis of Italian Legislative Decree 196/2003 ("Italian Privacy Code") provides that, within the limits of the pre-contractual purpose, consent is not required and that the information notice must be provided at the first useful contact after the CV is sent.
• Profiles captured from portals, or unsolicited CVs you keep for future positions: usually legitimate interest (Article 6(1)(f) GDPR), subject to a documented balancing test and the candidate's right to object.
• Classifier trained on your assessments: falls within the same recruitment purpose; reflect it in the information notice and in the balancing test.

Consent is not an appropriate basis in the employment context, owing to the imbalance between the parties, save in particular cases.

3. Information notice to candidates (Articles 13 and 14 GDPR)

• If the data come from the candidate (email, Telegram, folder, import), provide the notice at the time of collection or, for unsolicited CVs, at the first useful contact (Article 111-bis Italian Privacy Code).
• If the data come from a portal or from third parties, provide the notice within a reasonable period and at the latest within one month, or at the first contact with the candidate (Article 14(3) GDPR).
• In the notice, state that you use an automated tool to support the assessment and that the final decision is human. You may use the "Candidate Privacy Notice" template provided with CvRadar.
• The automatic acknowledgement-of-receipt message sent by the Telegram bot is a first useful contact: consider accompanying it with the notice or a link to it.

4. Minimisation and relevance

• Process only data relevant to assessing professional aptitude (Article 5(1)(c) GDPR; Article 113 Italian Privacy Code).
• Do not configure skills, keywords or descriptions relating to age, sex, nationality, marital status, pregnancy, health, religion, political or trade union opinions or other protected grounds.
• From portals, capture only the pages and files needed for a specific recruitment.
• If a CV contains unnecessary data (photograph, marital status, health data), do not use them in the assessment and delete them where possible.

5. Retention

Define and document retention periods. Suggestion (not a statutory period; adapt it to your case):

• candidates for a specific position: until the recruitment closes and then 6 months, to handle any requests and disputes;
• unsolicited CVs: 12 months from receipt;
• longer retention only for candidates you hire (in the employee file) or where there is a dispute.

When the period expires, delete CVs, extracted texts, scores and assessments, including in backups and in the mailboxes or chats they came from. CvRadar keeps data on your computer and has a CV retention setting (6, 12 or 24 months; 12 by default) that automatically deletes files, texts, scores and choices of older CVs. Copies outside CvRadar (email, chats, backups) are yours to delete. Every "suitable / maybe / rejected" choice is saved with date and time and can be exported to CSV: you can use it as a decision log.

6. Security (Article 32 GDPR)

• Use a password-protected operating system account and disk encryption (BitLocker, FileVault, LUKS).
• Keep the operating system and CvRadar up to date.
• Protect the Telegram bot token and email credentials; revoke them if compromised.
• Restrict access to the computer to authorised and instructed persons (Article 29 GDPR; Article 2-quaterdecies Italian Privacy Code).
• Encrypt backups. In the event of a personal data breach, assess notification to the supervisory authority within 72 hours (Article 33 GDPR).

7. Human decision (Article 22 GDPR)

CvRadar does not decide on or reject candidates. To keep the decision genuinely human:

• review the CVs and not just the score, especially before excluding someone;
• the person deciding must have the competence, authority and time to depart from the score;
• be aware that, according to the Court of Justice of the EU (Case C-634/21, SCHUFA, 7 December 2023), a score may itself constitute an automated decision if the decision-maker relies on it decisively;
• allow the candidate to express their point of view and to contest the assessment.

8. Data protection impact assessment (Article 35 GDPR)

Using CvRadar combines evaluation or scoring of persons, use of innovative technologies (AI) and data subjects in a weaker position (candidates). Under the WP248 Guidelines and the Italian Garante's list (decision No. 467 of 11 October 2018), meeting two or more of these criteria usually makes a DPIA necessary. If you use CvRadar systematically or for a non-negligible number of candidates, consider a DPIA necessary and carry it out before starting. If you conclude that it is not necessary, document why.

9. Special categories of data (Article 9 GDPR)

CVs may contain health data (for example membership of protected categories of workers), religious, political or trade union data, or photographs. Do not search for them, do not use them as a criterion and do not configure keywords relating to them. Processing is allowed only where one of the conditions of Article 9(2) applies (for example obligations on compulsory employment of persons with disabilities, Italian Law 68/1999) and only for that purpose.

10. Non-discrimination in access to employment

Recruitment choices, even when supported by CvRadar, must comply in particular with:

• Legislative Decree 198/2006 (Equal Opportunities Code), Article 27: prohibition of gender discrimination in access to employment, including indirect discrimination;
• Legislative Decree 215/2003: equal treatment irrespective of racial or ethnic origin;
• Legislative Decree 216/2003: equal treatment in employment regardless of religion, belief, disability, age and sexual orientation;
• Article 8 of Law 300/1970 (Workers' Statute): prohibition of inquiries into opinions and facts not relevant to professional aptitude;
• Article 10 of Legislative Decree 276/2003: prohibition of inquiries into and processing of data on beliefs, trade union membership, sex, marital or family status, pregnancy, age, disability, race, ethnic origin, nationality, health and any disputes with previous employers, unless these are essential and determining characteristics for performing the work.

Beware of indirect discrimination: apparently neutral criteria (minimum years of experience, career breaks, native language, schools attended) and the classifier trained on your past assessments may reproduce biases. Periodically check results across groups and revise the criteria. In anti-discrimination proceedings the burden of proof is partly shifted onto the employer: document the criteria used.

11. AI Act (Regulation (EU) 2024/1689)

11.1 Classification

AI systems intended to be used for the recruitment or selection of natural persons, in particular to analyse and filter job applications and to evaluate candidates, are listed in Annex III, point 4(a) and are therefore high-risk (Article 6(2)). The exception in Article 6(3) does not apply to systems that perform profiling of natural persons. CvRadar should therefore be regarded as a high-risk system.

11.2 Application timeline (verified as of 31 October 2026)

• Since 2 February 2025: prohibited practices (Article 5) and AI literacy (Article 4).
• Regulation (EU) 2026/1744 ("Digital Omnibus on AI"), published in the Official Journal of the EU on 24 July 2026 and in force since 27 July 2026: postponed the application of the obligations for Annex III high-risk systems from 2 August 2026 to 2 December 2027 (and to 2 August 2028 for Annex I systems). It also reworded Article 4.
• Source: https://eur-lex.europa.eu/eli/reg/2026/1744/oj

Until 2 December 2027 the Article 26 obligations do not yet apply, but it is advisable to get organised now: the GDPR and anti-discrimination law already apply today.

11.3 AI literacy (Article 4) — already applicable

You must take measures to support a sufficient level of AI literacy among staff who use CvRadar on your behalf, taking into account their knowledge, experience, training, the context of use and the persons affected. Since Regulation 2026/1744 this is an obligation of means. In practice: explain to those using the app how the score is formed, its limits (extraction errors, rough estimate of experience, possible biases of the classifier) and how to document the human decision.

11.4 Deployer obligations (Article 26) — from 2 December 2027

• Use in accordance with the instructions: use CvRadar according to its instructions for use and for its intended purpose (Article 26(1)).
• Human oversight: assign oversight to persons who have the necessary competence, training, authority and support (Article 26(2); Article 14).
• Input data: to the extent you control them, ensure that job descriptions, required skills and the assessments used for the classifier are relevant and sufficiently representative (Article 26(4)).
• Monitoring: monitor operation; if you consider that use presents a risk, suspend it and inform the provider and the authority; report serious incidents (Article 26(5)).
• Logs: keep the logs automatically generated by the system, to the extent they are under your control, for at least six months unless otherwise provided (Article 26(6)).
• Workers: if you are an employer, before putting the system into service at the workplace inform workers' representatives and the affected workers (Article 26(7)).
• Informing candidates: inform natural persons that they are subject to the use of a high-risk system in decisions concerning them (Article 26(11)); candidates have a right to an explanation of individual decisions (Article 86).
• DPIA: use the information supplied by the provider (Article 13) for the impact assessment (Article 26(9)).
• Public bodies: additional registration obligations (Article 26(8); Article 49) and fundamental rights impact assessment (Article 27).

If you substantially modify the system, use it for a different purpose or distribute it under your own name or trademark, you may take on the provider's obligations (Article 25).

11.5 Prohibited practices (Article 5)

Prohibited practices include, among others, using AI systems to infer the emotions of a person in the workplace (except for medical or safety reasons) and biometric categorisation to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation. Do not use CvRadar, or the photographs in CVs, for such purposes.

12. Italian AI law (Law No. 132 of 23 September 2025)

Law 132/2025, in force since 10 October 2025, provides in Article 11 that:

• AI at work is to be used to improve working conditions, protect workers' psychophysical integrity and increase quality and productivity;
• the use of AI must be safe, reliable and transparent and must not conflict with human dignity or breach the confidentiality of personal data; the employer or principal must inform the worker of the use of AI in the cases and in the manner set out in Article 1-bis of Legislative Decree 152/1997 (introduced by Legislative Decree 104/2022, the "Transparency Decree");
• AI in organising and managing the employment relationship must guarantee the worker's inviolable rights, without discrimination.

Article 1-bis of Legislative Decree 152/1997 concerns fully automated decision-making or monitoring systems that provide information relevant, among other things, to hiring, and requires written information on purposes, logic, data, metrics and control measures, also to trade union representatives. Since in CvRadar the final decision is human, its application to the specific case is debated; as a precaution, provide this information anyway to candidates and, where present, to trade union representatives.

Source: Italian Official Gazette No. 223 of 25 September 2025, https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg

13. Third-party portals

Use job portals with your own account and in compliance with their terms of service. Many portals restrict copying or reusing profiles: check before capturing pages. CvRadar does not automate navigation: every capture is your choice and your responsibility.

14. Checklist before you start

1. Candidate information notice ready (template provided with CvRadar).
2. Legal basis and retention periods defined in writing.
3. DPIA carried out, or reasons why it is not needed documented.
4. Selection criteria checked: no reference to protected grounds.
5. Staff instructed on the use and limits of the app (Article 4 AI Act).
6. Procedure for the human decision and for candidates' challenges.
7. Computer, accounts, tokens and backups secured.
8. Use of portals compliant with their terms of service.
9. From 2 December 2027: Article 26 AI Act obligations implemented (oversight, logs, information).