GDPR & Data Processing — Wilma

This page summarises how Wilma supports customers with data protection obligations under the GDPR, UK GDPR, Swiss data protection law, and similar privacy frameworks.

In most cases, the customer organisation using Wilma is the data controller for candidate and recruiter data processed in the platform.

Wilma acts as the data processor or service provider, processing personal information on the customer’s behalf and according to the customer’s instructions.

Wilma supports recruitment processing activities such as:

• Application collection and candidate workflow management
• Recruiter-to-candidate communication
• Interview scheduling and coordination
• Transcription, summarisation, and structured review support

Wilma may engage subprocessors to provide hosting, infrastructure, email delivery, analytics, customer support, and AI-assisted functionality. We require subprocessors to implement appropriate safeguards and contractual protections.

Where Wilma processes data on behalf of customers, we support customers in responding to valid requests relating to access, correction, deletion, portability, or objection rights, to the extent required by law and our contractual commitments.

Where personal information is transferred outside the EEA, UK, or Switzerland, Wilma relies on appropriate safeguards such as contractual protections, including Standard Contractual Clauses where applicable.

Wilma can provide a Data Processing Agreement where required for customer use of the service. Customers who need a DPA in place should contact privacy@withwilma.com.