GDPR Statement

This statement is written for the person at your organisation who has to sign off on using Lanced — a data protection officer, a legal counsel, an IT lead, or whoever owns procurement. It explains how Lanced is structured under the GDPR, which obligations sit with us, which sit with you, and where the boundary runs.

It is an explanatory document. It is not a contract. The binding instrument is the Data Processing Addendum, which forms part of the Business Terms and takes effect when you accept them — no separate signature is required. Where this statement and the DPA differ, the DPA governs.

Three companion documents carry the detail this one summarises:

For Layer 1, our bases are set out purpose by purpose in Section 5 of the Privacy Policy. In summary: performance of contract for the account, profile and discovery functions; explicit consent for special category data; legitimate interests for security, fraud prevention, support and product improvement; consent for product analytics and marketing; legal obligation for tax records and platform moderation duties.

For Layer 2, you identify the basis. In a recruitment context that is usually legitimate interests or steps prior to entering a contract, but it is your assessment to make and document. Where you receive special category data you must additionally identify an Article 9 condition before processing it.

What is held. Four fields — ethnicity, date of birth, nationality and gender — sit in a dedicated store, separated from the ordinary profile, protected by database-enforced row-level security, and excluded from ordinary profile reads. Of these, ethnicity is special category data within the meaning of Article 9. Nationality and gender are not Article 9 data but are protected grounds under equal treatment law. Date of birth reveals age, which is separately protected.

Nothing is disclosed by default. Having a field on a profile does not make it visible to you. It is not returned by network search, ordinary profile views or talent discovery.

Disclosure is per application, on the artist's explicit choice, recorded as a point-in-time consent record. Your review interface reads that record rather than the live profile, so a later profile edit cannot retroactively change what was disclosed, and every disclosure is auditable per application.

Where Lanced requires it, you must state on the call why you are requesting a field. You may request restricted information only where you have a specific and legitimate reason connected to the role, opportunity, eligibility requirement or contract type. Unless the information genuinely determines eligibility and its use is lawful, an artist must be able to decline without being removed from consideration.

Unsolicited special category data will still reach you. Health, disability, religion and ethnicity routinely appear in motivation letters, CVs and free-text answers, whatever the form asks for. You need an Article 9 condition for that too, and a plan for what to do when it arrives unrequested.

The authoritative list is the Sub-Processor Register, and DPA Annex 3 lists those processing data on your behalf. Two providers carry substantially all of it — DigitalOcean (Amsterdam: the entire database) and Cloudflare (EU: every uploaded file). The remainder are narrow, single-function, and most receive only a name and an email address.

Change process. We give prior notice of any addition or replacement. You may object on reasonable data protection grounds within 30 days. We will work with you in good faith to resolve the objection; if it cannot be resolved, you may terminate the affected service with a pro-rata refund of prepaid fees, which is your remedy. Objection does not suspend the change.

We also publish providers we have committed to but not yet engaged, so that notice runs before any data moves rather than after.

Core infrastructure is in the European Economic Area. The EU jurisdiction setting on object storage is enforced when the application starts, rather than left as a deployment option that can be forgotten.

A limited set of transfers goes to the United States, each under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914):

Sentry runs in its EU data region and is additionally certified under the EU–U.S. Data Privacy Framework. We maintain transfer impact assessments and provide a summary on request.

Whose job. Requests about Layer 1 come to us and we answer them. Requests about Layer 2 are yours, and we assist. If an individual sends us a Layer 2 request, we confirm receipt, direct them appropriately, and forward it to you without undue delay — we do not answer on the substance.

Our assistance timescale is 10 working days from a request for help, so that you can still meet your own one-month deadline under Article 12(3).

Tooling. Self-service tooling exists in the workspace, supplemented by manual assistance where it does not cover a request. An in-product activity log covering actions in your own workspace is available under DPA clause 12.4.

Layer 2 retention is yours to set. We do not currently apply a platform-wide maximum to applications, review records or saved artist records. We expect to introduce one and will give notice before it takes effect.

This is where most of our public-sector and institutional customers have work to do, so it is worth being direct about the Dutch position: the Autoriteit Persoonsgegevens' guideline is four weeks after the procedure ends, extendable to a maximum of one year with the candidate's explicit consent. The NVP Sollicitatiecode 2025 does not permit tacit extension — silence is not consent, and a pre-ticked box is not consent. If you operate across several jurisdictions, note that the periods differ materially and the shortest applicable clock generally governs.

Periods the platform enforces are listed in DPA clause 11.3 and Section 12 of the Privacy Policy. In summary: candidate conversations 30 days after closure; message attachments 30 days after the last referencing conversation closes; deleted media removed from storage within 7 days; workspace data after downgrade to a free profile 12 months with export reminders at 9 and 11 months; workspace deletion on a 30-day grace period.

On termination, you elect within 30 days whether we return or delete Customer Personal Data. If you make no election, we delete. Data in routine backups is deleted in the ordinary course of the backup cycle and remains subject to the DPA until it is.

Records of processing. We maintain records under Article 30 in both capacities.

Data Protection Officer. Not appointed. Data protection requests are handled directly by our team at privacy@lancedhq.com. We keep the question under review as the platform grows; the triggers we watch are the volume of accounts holding Article 9 data, the launch of AI-assisted matching, taking a first public-sector customer, and establishment in a second member state. If your procurement policy requires a named data protection contact, we will provide one.

Data protection impact assessments. Your DPIA obligation is yours; we assist under DPA clause 8.1 with the information available to us. Separately, we assess our own obligation under Article 35 and the Autoriteit Persoonsgegevens' binding list (Besluit lijst verwerkingen persoonsgegevens waarvoor een DPIA verplicht is, in force 27 November 2019), and will complete a DPIA before deploying material AI-assisted candidate discovery or ranking functionality.

Staff access. Authorised personnel can access a workspace, or view the product in the context of a user account, where necessary for support, fault investigation or a suspected breach. Access is restricted by role and individual permission, limited to what is necessary, time-limited, blocked from administrative tooling, and recorded start to end in an audit trail available to you on request. We disclose this rather than leaving it implicit, because it is real processing.

Personnel. Everyone with access to personal data is under a confidentiality obligation.

The full technical and organisational measures are in the Security Statement and DPA Annex 2. Highlights a reviewer usually asks about: TLS 1.2/1.3 in transit with one-year HSTS; AES-256 at rest with provider-managed keys; database-enforced row-level security on artist-owned tables, with the application refusing to start on a database role capable of bypassing it; contracts held in a separate private store with no public route; scoped, hashed, expiring tokens for external reviewers; two-factor authentication on all plans and Single Sign-On on Custom; three separate audit trails; fail-closed production start-up.

One thing we do not claim. Publicly reachable media — what an artist has chosen to publish — is served over long, random, unindexed addresses. That is protection by unguessability, not access control: anyone holding such a link can open it. We say so rather than describing it as access-controlled.

Breach notification. Without undue delay and in any event within 48 hours of becoming aware of a breach affecting your data, with the content required by Article 33(3) to the extent available, in phases if necessary. Notification is not an admission of fault. As controller, your own Article 33 and 34 obligations remain yours. Our disclosure channel is security@lancedhq.com.

We do not train on your data. Customer Personal Data is not used to train, fine-tune or develop AI or machine learning models. AI-assisted functionality is developed using data for which Lanced is controller, together with aggregate statistical information from which individuals cannot be identified and which cannot be attributed to any customer. This is DPA clause 3.5(a).

AI-assisted features are opt-in at workspace level. Where we make search, discovery, matching, organisation or application-review functionality available, you decide whether to enable it.

Outputs are assistive, never determinative. We do not provide functionality intended to produce decisions with legal or similarly significant effects based solely on automated processing within the meaning of Article 22. Recommendations and rankings support human review; selection and hiring decisions remain yours.

AI Act. Where functionality you enable falls within a high-risk category under Regulation (EU) 2024/1689, you act as deployer and carry the obligations attaching to that role — human oversight, transparency to affected individuals, record-keeping. We will provide the information reasonably necessary for you to meet them.

Notice before anything changes. We will tell you before AI-assisted functionality processing Customer Personal Data becomes available, and any third-party provider engaged to deliver it goes onto the Sub-Processor Register before processing begins.

• Identify and document your legal basis for the recruitment processing you run through Lanced, and an Article 9 condition for any special category data you request or receive.
• Inform candidates about your processing — your identity, purposes, retention and their rights. Our Privacy Policy covers Layer 1; it does not cover you.
• Set your retention, and apply it. Do not leave applications in the workspace indefinitely because no maximum is enforced.
• Assess before you filter. Determine whether any distinction on a protected characteristic is permitted before applying it. We may require you to record a reason for using certain filters.
• Answer data subject requests relating to your workspace, including those we forward to you.
• Keep access current — remove users who leave, enable two-factor authentication, do not share credentials between individuals.
• Control your exports. Once material leaves the platform it is outside every control we have, including printed material.
• Do not collect identity documents through the platform.
• Complete your own DPIA where your processing requires one.
• Tell us at security@lancedhq.com if you become aware of unauthorised access to your workspace.

Security questionnaires, the countersigned DPA, transfer impact assessment summaries, sub-processor change notifications and the incident response procedure are available from privacy@lancedhq.com. The incident response procedure is provided under NDA.

Audit rights are set out in DPA clause 12: written information requests and completed questionnaires as standard, with on-site audit limited to once per twelve months save where a supervisory authority requires otherwise, on 30 days' notice, at your cost, and without affecting other customers' data.

This statement describes Lanced's position as at 1 September 2026 and is reviewed annually, or whenever the platform, its hosting, its sub-processors or applicable law materially change.

It is an explanatory summary prepared by Lanced. It is not legal advice, it is not a warranty, and it does not vary the DPA or the Business Terms. Your organisation should form its own assessment, and where the processing is significant to you, take its own advice.