PRIVACY & GDPR

Privacy is built into every screening

Background checks run on personal data, so we treat privacy as a product feature, not a legal afterthought. Consent comes first, data flows are controlled and our privacy office is one email away.

GDPR-aligned process ISO/IEC 27001:2022 certified Licensed screening agency (POB 1551)

Contact our privacy office Visit the Trust Center

Privacy by design, in practice

These are the same controls we publish in our Trust Center, in plain language.

Consent comes first

Candidates start their own screening through a secure link and give explicit consent before any check runs. Results are shared with the candidate.

Impact assessments

We run Data Protection Impact Assessments on our processing, so privacy risks are identified and addressed before they reach production.

Trained people

Everyone who works with candidate data completes privacy training. Handling personal data carefully is part of the job, not an option.

Governed data intake

Personal data enters our platform through controlled, documented flows, from cookies on the website to data submitted into the screening system.

Candidate rights under the GDPR

Candidates keep full control over their personal data. We support every GDPR right, directly through our privacy office.

1 Access your data

2 Correct inaccurate data

3 Request erasure

4 Restrict processing

5 Data portability

6 Object to processing

Requests go to our privacy office and are handled within the GDPR timelines.

GDPR checklist for employee screening

Eight points to settle before you screen a candidate or employee. Each one names the GDPR article it rests on and how Pescheck supports it.

1
Establish a legal basis

Decide which basis under Art. 6(1) GDPR applies before any check starts, and write it down per check type.

Art. 6(1) GDPR

How Pescheck helps: Checks are configured per role, so each one can be tied to a documented purpose.
2
Screen only what the role needs

Process only data that is adequate, relevant and limited to what is necessary for the purpose.

Art. 5(1)(c) GDPR

How Pescheck helps: Role-based packages: choose the checks per position instead of one size fits all.
3
Treat criminal record data with extra care

Processing data on criminal convictions and offences may only take place under official supervision or where Union or Member State law allows it with appropriate safeguards. Confirm that a legal basis exists for each country and role before you request it.

Art. 10 GDPR

How Pescheck helps: Checks are chosen per role, so criminal record checks only run where you select them.
4
Get valid, provable consent where you rely on it

Consent must be provable, can be withdrawn at any time and is only free if the contract does not depend on data that is not necessary for it. In an employment context, assess carefully whether consent is really free.

Art. 7 GDPR

How Pescheck helps: Candidates give explicit consent through a secure link before any check runs.
5
Inform the candidate up front

Tell candidates what is processed, why, on which basis, who receives it, how long it is kept and which rights they have.

Art. 13 GDPR

How Pescheck helps: Candidates follow clear steps in the candidate portal and give consent before any check runs.
6
Sign a data processing agreement

Only work with processors that offer sufficient guarantees, and bind them by contract that sets subject matter, duration, purpose and your instructions.

Art. 28(1) and (3) GDPR

How Pescheck helps: The DPA is part of our Terms of Service and published in the Trust Center.
7
Check whether a DPIA is needed

Large-scale processing of criminal conviction data is one of the cases where a data protection impact assessment is required.

Art. 35(1) and (3) GDPR

How Pescheck helps: We run DPIAs on our own processing and publish the control in the Trust Center.
8
Set retention and deletion rules

Keep personal data in identifiable form no longer than the purpose requires, and delete it after that.

Art. 5(1)(e) GDPR

How Pescheck helps: Retention rules are configurable.