GDPR and data protection
How Cavuno handles GDPR, the DPA, subprocessors, security, and data requests
Last updated: 14 October 2026
This page explains how Cavuno meets the General Data Protection Regulation (GDPR). It covers our data processing agreement, the services that process data for us, how we protect data, and how to ask for your data.
GDPR checklist
63%
- 12 completed
- 5 in progress
- 2 not applicable
Data Processing Agreement
How we process personal data for customers who run job boards on Cavuno.
Subprocessors
Every third-party service that processes data for us, what it does, and where it runs.
Security
How we host, encrypt, back up, and control access to data.
To get a countersigned copy, sign our Data Processing Agreement in Cavuno under Settings → Legal and download the PDF.
Where we stand on GDPR
We track each GDPR requirement below and update this list when a status changes.
Lawful basis and transparency
2 of 3 completed- In progress
Keep a record of what personal data we process and who can access it
- Completed
Have a lawful basis for each processing activity
- Completed
Explain our processing and its legal basis in our privacy policy
Data security
3 of 5 completed- Completed
Build data protection into the product from the start
- Completed
Have a written process to notify customers of a data breach
- Completed
Encrypt personal data in transit and at rest
- In progress
Keep an internal security policy and train the team on data protection
- In progress
Know when a data protection impact assessment is needed and how to run one
Accountability and governance
2 of 4 completed- Completed
Name who is responsible for GDPR compliance
- Completed
Have a data processing agreement with every subprocessor, except the restricted providers named in our DPA
- In progress
Appoint representatives in the EU and the UK
- Not applicable
Appoint a data protection officer, if required
Privacy rights
5 of 7 completed- Completed
Let people access the data we hold about them
- Completed
Let people correct inaccurate data
- Completed
Let people delete their data
- Completed
Let people ask us to stop processing their data
- In progress
Let people get a portable copy of their data
- Completed
Let people object to processing
- Not applicable
Protect people from decisions made solely by automated processing
AI parses CVs and suggests matches, but no decision with legal effect is fully automated.
Requesting your data
- Job seekers — Each job board on Cavuno controls the data it collects about you. To access, correct, or delete your data, contact the job board that holds it.
- Cavuno customers — Email hi@cavuno.com to access, correct, export, or delete the data in your account.
Breach notification
If a breach affects personal data we process for you, we notify you without undue delay and give you the information you need to notify authorities and the people affected.
We have had no data breaches to date.
International transfers
We store most data in the United States.
Transfers of personal data from the EU, Switzerland and the UK are covered by the EU Standard Contractual Clauses and the UK Addendum, which are part of our DPA. The exception is the restricted providers named in clause 6.5 of our DPA. Transfer impact information is available on request.
Questions
Email hi@cavuno.com with any data protection question.