Candidate privacy notice

This notice explains how we use your personal data when you apply for a role at Whitesmith.

Odyssey Perspective, Lda., trading as Whitesmith, is the data controller. Its registered office is at Instituto Pedro Nunes, Rua Pedro Nunes, 3030-119 Coimbra, Portugal.

Last updated: 30 September 2026.

What we collect

• What you give us in the application form: your name, email address, LinkedIn profile, CV, your answers about location, right to work, notice period, package expectations and availability for an in-person session, and your declarations.
• Your demo video, and a written transcript of it made from the audio.
• Later in the process, if you continue: your recorded answers, what you share in interviews and exercises, our assessors’ notes and scores, and what referees you name tell us.
• When you apply, and which version of this notice and of the job post you saw.
• Your gender, only if you choose to give it, for the equality record described below.

We do not ask for, and do not want, information about your age, health, ethnicity, religion, family or similar. Please leave it out of your CV and demo.

Why, and on what legal basis

We use your data to assess your application and, if we hire you, to prepare an offer. This is necessary to take steps at your request before a possible employment contract (GDPR Article 6(1)(b)). Where we use software, including AI, to organise the evidence and plan our review, we rely on our legitimate interest in reviewing applications carefully and on time (Article 6(1)(f)); you can object to that (see “Your rights”).

If you tell us your gender, we use it only for the record of each recruitment that Portuguese law asks employers to keep, broken down by sex (Labour Code, Article 32; GDPR Article 6(1)(c)). It is kept apart from your application: the people reviewing it don’t use it, and the AI never sees it. Answering is optional.

How AI is used

AI helps us organise what you said in your recordings and wrote in your CV: it lists your claims with exact quotes and timestamps, so we can check them against the source. It may also score your demo against the published criteria for the first stage, to decide the order in which we review applications and to prepare suggestions for our reviewers. A person makes every decision about your application. AI does not reject anyone, and never looks at your face, voice or tone: it works from the written transcript only. You can ask for a person to look at any decision again by replying to any of our emails.

Where your data is processed, and by whom

• Cloudflare runs our website and stores your files in its European Union storage while we process them. Your submission passes through Cloudflare’s global network on its way. It also checks your browser for automated abuse, using your IP address and browser details.
• AssemblyAI makes the transcript, using its European Union service. It deletes its copy once we have filed ours.
• Google Workspace holds your application folder, our register of candidates and our emails with you.
• Anthropic provides the AI described above, through a business account whose data is not used to train its models. Anthropic is based in the United States; the transfer is covered by the European Commission’s standard contractual clauses.

Each of them processes your data only on our instructions, under a data processing agreement. Only the people involved in hiring can see your application.

How long we keep it

Your application is kept until 12 months after the process closes for you, so we can consider you for other openings in this search and answer any question about the decision. It is then deleted within 30 days. The working copy of your files in Cloudflare’s storage is deleted after 30 days. If we hire you, your application becomes part of your employee record. The yearly equality counts are anonymous and kept for five years, as the law requires.

Your rights

You can ask to see the data we hold about you, to correct it, to have it deleted, to limit how we use it, to object to our use of it (including the AI described above, in which case a person reviews your application without it), and to receive your data in a portable format. You can also ask for an alternative format for any stage of the process. Write to [email protected]; we answer within a month. If you are unhappy with our answer, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).

If someone named you as a referee

A candidate gave us your name and contact details, with their consent, so we could ask about their work with you. We use them only to arrange and hold that conversation, keep what you tell us under the same period as the candidate’s application, and never ask about their personal life. The rights above apply to you too.