For Recruiters

Candidate Privacy Notice

Last updated: June 6, 2026 Required before uploading under RA 10173 & NPC Circular 2022-01

Before uploading a candidate's resume to Shortlist, Philippine data privacy law requires that the candidate be informed. This page gives you a ready-to-send notice you can copy and paste into your email or message to the candidate.

Recruiter action required

Send or show the notice below to each candidate before uploading their resume. Keep a record (e.g., the sent email) as evidence of notification. You do not need a signed form — informing the candidate in writing is sufficient in most cases, unless your organization's policies require explicit consent.

—Ready-to-send notice

Copy the text below and paste it into an email or message to the candidate. You can personalize the greeting and sign-off.

Candidate notice template

Hi [Candidate Name], Thank you for your interest in the [Job Title] role at [Company]. As part of our screening process, we use Shortlist — an AI-assisted resume screening tool — to help review applications. I want to be transparent about how your resume will be handled: - What is processed: The text content of your resume and the job description. - Who processes it: Shortlist (operated by Stephen Dalanon) acts as our data processor. Your resume text is sent to AI model providers (Groq and/or Together AI, both based in the United States) for scoring. This is a cross-border transfer of your personal data. - How long it is kept: Your resume text is deleted from Shortlist's systems within minutes of analysis. It is not stored beyond that. - Training: Neither Groq nor Together AI use API inputs to train their models. - Your rights: Under the Philippine Data Privacy Act (RA 10173), you have the right to be informed, to access your data, to correct inaccuracies, to object to processing, and to erasure. To exercise any of these rights, reply to this message. If you have any concerns or do not consent to this processing, please let me know and I will review your application through other means. [Your Name] [Your Title / Company]

—Why this is required

Under the Philippine Data Privacy Act of 2012 (RA 10173) and NPC Circular 2022-01 on cross-border data transfers, the recruiter — as the Personal Information Controller — is responsible for ensuring candidates are informed before their personal data is transferred outside the Philippines for processing.

Uploading a resume without this notification creates legal exposure for you and your organization. Shortlist's Terms of Service require recruiters to confirm this notification has been given before each upload.

What counts as sufficient notice

Sending the template above by email or private message to the candidate before uploading is generally sufficient. You do not need a signed document — but keep evidence (e.g., the sent email) in case of a future inquiry or complaint.

—Questions

If you have questions about data privacy compliance or Shortlist's data handling, see the full Privacy Policy or contact Stephen Dalanon at heystephn@gmail.com.