Effective date: 15 October 2026 | Version: 1.0
Scope and responsibilities
RecMark RapidReach is operated by Recmark Ltd, trading as RecMark, registered in Ireland, with its registered office at 29 Rosehill, Wicklow Town, Co. Wicklow, Ireland. It helps employers receive applications from connected applicant tracking systems and Facebook lead forms, communicate through WhatsApp, conduct screening and arrange human follow-up. This notice applies to the RecMark RapidReach service and communications sent through it. For service access or privacy enquiries, contact privacy@rec-mark.com.
For applicant records processed on an employer's documented instructions, that employer is normally the controller and RecMark is its processor. The employer determines recruitment purposes, lawful bases, screening criteria, recipients and retention. RecMark provides the service under a Data Processing Agreement. Recruitment agencies acting for another controller are outside the initial service scope.
RecMark is a controller for its own employer account administration, business billing, support relationship and limited platform security processing. Contract labels do not override actual responsibilities. Where RecMark uses a record for its own distinct lawful purpose, that use must be described here; employer candidate data is not generally available for RecMark's own purposes.
Contact RecMark at privacy@rec-mark.com or our registered office marked Privacy. For recruitment decisions, contact the employer named in the application or WhatsApp message. If you are unsure who that is, we can help route your request. RecMark has not appointed a statutory Data Protection Officer; the RecMark Privacy Team handles enquiries at privacy@rec-mark.com.
Information processed
Employer user information includes names, business contact details, organisation, role, account permissions, authentication records, settings, subscriptions, support correspondence and acceptance records. Integration information includes authorised account and asset identifiers, connection permissions, token status and protected credentials needed to maintain connections.
Applicant information may include name, phone number, email, job and application identifiers, source, employment information supplied for the job, screening questions and answers, rule results, recruiter decisions and notes. The service also processes WhatsApp message content, message identifiers, timestamps, delivery states, conversation assignments and human takeover records.
Consent and preference records include the wording shown, collection source, date, channel, notice version and subsequent opt-out or withdrawal. Operational records include technical errors, access events and delivery attempts. We limit message content and personal data in general diagnostic logs.
Sources are the applicant, the employer and authorised recruiters, connected ATS records, selected Facebook lead forms and WhatsApp responses or delivery events. These integrations do not give us unrestricted access to social accounts or all client data. Authorisation is limited to the assets and permissions needed for the configured service.
How employer account data is used
We use business user contact details to administer access, support the account and communicate service changes based on our legitimate interests in delivering the service to the employer. Contract is the basis where the user is themselves the contracting individual. Legal obligations support necessary accounting and regulatory records. Limited security processing is based on our legitimate interests in protecting users and the platform. RecMark does not operate optional promotional email marketing at launch; necessary account, security, billing and service communications remain separate.
The employer's agreement with RecMark is not, by itself, a lawful basis for all processing of applicants. The employer identifies and explains the applicable basis for each recruitment purpose. RecMark acts on those documented instructions when processing applicant data as a processor.
Recruitment communications and screening
The service imports selected applications, matches them to jobs, prevents duplicate communications, sends acknowledgements, collects screening answers and alerts authorised employer staff. An acknowledgement within five minutes is an operational target, subject to valid consent, messaging permissions, provider availability and configured rules. It is not a guaranteed delivery time.
Screening compares applicant-supplied answers with job-related criteria set by the employer, such as an essential qualification or availability requirement. Results and the relevant answers are presented to a recruiter. A result can affect which applications are brought to attention first, so employers must monitor pending and unanswered applications and must not let an automated result or failure to respond silently exclude someone.
Under our permitted launch workflow, an authorised person reviews an application before a rejection or a decision that prevents progression is issued. The reviewer must consider relevant answers and context and have authority to change the result. A human review button alone does not constitute meaningful review. Contact the employer to correct information, explain circumstances or request review and an alternative screening method.
The service does not infer protected characteristics, score personality from messages or make hiring decisions using a general-purpose AI model. Applicant information is not used for shared model training, cross-employer talent pools, advertising audiences or sale. Introducing materially different analysis requires a separate assessment, appropriate agreements and updated notices before use.
Employers must not solicit full identity or financial account numbers or unnecessary health, criminal-record or other sensitive information through WhatsApp. If sensitive information is volunteered, it must be restricted, assessed and deleted or moved to an appropriate channel unless a lawful need and safeguards support retaining it. Special categories and criminal-offence data require additional legal conditions beyond an ordinary lawful basis.
WhatsApp Facebook and ATS connections
Employers authorise their own WhatsApp account and number. Meta processes messaging and account data under the applicable WhatsApp and Meta terms. Employers pay Meta directly for messaging; RecMark does not collect their Meta payment card details or Facebook passwords. Authorisation credentials received by the service are held in protected backend storage.
Applicants must have an appropriate expectation of WhatsApp contact and the required opt-in. Reply STOP or otherwise tell the employer to stop WhatsApp messages. We stop future automated WhatsApp outreach when that request is processed, including pending messages, and retain only the minimum suppression information needed to respect it. Stopping WhatsApp does not by itself withdraw the job application or request deletion of all records.
Business-initiated WhatsApp messages use approved templates where required. Recruiters can take over the conversation, which pauses screening automation. Human replies remain subject to WhatsApp's messaging rules. An already transmitted message cannot always be recalled.
Facebook lead information is imported only from authorised Pages and selected forms. The employer must display a suitable candidate notice and obtain the required communication permissions at collection. ATS integration is similarly restricted to authorised recruitment records. Disconnecting stops future access as described in our deletion instructions; it does not automatically erase every record previously received or delete the source platform's copy.
Recipients and locations
Applicant records are accessible to authorised staff of the relevant employer and to RecMark personnel only where needed for agreed support, operations, security or legal responsibilities. Employer permissions are designed to prevent one client accessing another client's information. Employer alert emails contain only the applicant name, role and a secure link. Screening answers remain inside the authenticated service.
Approved infrastructure and delivery providers may process data to deliver the service. Meta, an employer's ATS and other connected services may have their own controller or processor roles under the applicable contracts. Our register at https://www.rec-mark.com/subprocessors distinguishes RecMark subprocessors from client-appointed integrations and independent providers. We do not describe every external provider as a subprocessor merely because it connects to the app.
The production database is hosted by Supabase in a selected EU region. The production application is initially hosted through Lovable and will be reassessed before any hosting migration. Backups and administrative access locations are the selected EU hosting region, with authorised RecMark access from Ireland; supplier support and onward-processing locations are listed in the current supplier terms. The register identifies any restricted transfers and the mechanism used, such as a relevant adequacy decision or approved contractual clauses with supplementary safeguards where needed. Contact privacy@rec-mark.com for information about applicable safeguards. Choosing an EEA database alone does not establish that all processing stays in the EEA.
Retention and security
The employer sets a documented retention period for candidate records and communicates it in its Candidate Privacy Notice. The default configured period for unsuccessful applications is six months after the recruitment decision; each employer must confirm and disclose its appropriate period before activation. Active applications, unsuccessful applications and any separately authorised talent pool must have appropriate and distinct periods. A talent pool is not enabled by default.
RecMark retains employer account information for the active account period plus 12 months, financial records for the period required by Irish tax and company law, support records for the active relationship plus 12 months and platform security logs for 90 days. The service deletes or returns employer applicant data under the Data Processing Agreement. Live records scheduled for deletion are removed within 30 days, with backup expiry within 90 days, subject to a narrowly applicable legal hold.
We use access restrictions, separation of employer data, protected credentials, secure transmission and risk-appropriate storage and recovery controls. Security commitments and supplier arrangements are documented in the client agreement. No security certification or absolute protection is claimed by this notice.
Rights complaints and choices
You may have rights to access, correct, erase, restrict or receive portable copies of data, object to legitimate-interest processing and withdraw consent. Applicable rights depend on the purpose and legal basis. Candidates can request human intervention and challenge relevant screening outcomes as described above. Contact the employer for applicant records; RecMark forwards requests securely and assists it. Contact privacy@rec-mark.com for RecMark-controlled records.
We normally respond to requests for which we are responsible within one month, explain any lawful extension within that period and request only proportionate identity evidence. There is generally no charge. You may complain to a relevant supervisory authority, including the Irish DPC at https://www.dataprotection.ie or UK ICO at https://ico.org.uk where applicable. RecMark's relevant authority is the Irish Data Protection Commission.
Employers explain which application fields are necessary and what happens if they are not supplied. WhatsApp should not be the only practical route where a candidate needs another channel or an accommodation. Employer administration accounts and the initial recruitment scope are restricted to adults. Employers must not activate a recruitment workflow for anyone under 18 in the launch version of the service.
We date and publish material changes and give appropriate advance notice where needed. Reading a revised notice does not provide consent to new processing. Cookie and similar-technology choices are explained at https://www.rec-mark.com/cookies.