SourceGeek is an AI assistant for recruitment teams, built and operated in the Netherlands. This page summarises how the platform relates to the GDPR. It complements our Privacy Policy, our Data Processing Agreement and our Trust & Data Protection page.
When a customer uses SourceGeek to process candidate data — from their applicant tracking system, from public professional sources, or in chats and documents — the customer is the controller and SourceGeek is the processor, acting only on the customer's instructions under the Data Processing Agreement. SourceGeek is the controller only for its own account, billing, support and marketing data, as described in the Privacy Policy.
Customers are responsible for having a legal basis for the candidate data they process through SourceGeek. For sourcing candidates for a specific role, customers typically rely on legitimate interest (GDPR Art. 6.1.f); where that does not apply, consent must be obtained. The platform supports the customer's transparency and documentation duties: data is retrieved per request rather than stockpiled, and actions on connected systems are recorded in an audit log.
SourceGeek uses AI to analyse and score candidates against a vacancy. This analysis constitutes profiling in the sense of GDPR Art. 4(4), and we are transparent about that. What the platform does not do is take decisions on its own: no candidate is rejected, contacted or moved through a pipeline by the platform autonomously. AI output is presented to recruiters as evidence-backed suggestions, every action that changes data in a connected system requires prior approval by a person, and hiring decisions are always made by people. The platform therefore does not make decisions based solely on automated processing within the meaning of GDPR Art. 22.
Candidates can exercise their GDPR rights — access, rectification, erasure, objection and the others — with the organisation that processes their data: the recruiting customer, who is the controller. SourceGeek assists customers in answering such requests, as set out in the Data Processing Agreement; any request a candidate sends to SourceGeek directly is forwarded to the customer concerned without undue delay.
The platform is not intended for the processing of special categories of personal data (such as health, religion, ethnicity or trade union membership, GDPR Art. 9). Customers must not instruct such processing unless they have an explicit legal basis for it.
AI model requests are routed exclusively to providers under zero-data-retention terms — prompts are not stored by the model providers and are never used to train models. Connected systems are accessed on demand and never bulk-copied. Credentials are stored encrypted, workspaces are strictly isolated, and deleting a workspace permanently erases its content. Details are in the Data Processing Agreement and on the Trust & Data Protection page; international transfers are safeguarded as described on the sub-processors page.
Easy plug & play, no technical knowledge needed. Have your assistant ready in a matter of minutes.