GDPR-First ATS Options in 2026: Who Hosts Where, Who Publishes a DPA

A GDPR-first ATS is one whose own trust page names an EU hosting region, whose sub-processor list you can read before you sign, whose data processing agreement is public or arrives unprompted, and whose retention, erasure and AI features can be set up so that the compliant path is the default one. The two tables below put ten vendors side by side on exactly those columns, every cell taken from the vendor's own pages opened on 14 October 2026. Several US-headquartered vendors host in the EU; almost none of them keeps sub-processing in the EU, and that gap is where most "we are GDPR compliant" claims break.

I built Pickr, so Pickr is one row of each table and you should read its cells as sceptically as the others. I also run ScalingPPL, a recruitment agency, which is where the questions come from. This article is the vendor table that the nine questions to put to any recruiting software vendor deliberately left out: that checklist tells you what to ask, this one shows what the public pages already answer. It is not legal advice; check the DPA and sub-processor list with whoever carries your data protection responsibility.

Why do "GDPR compliant ATS" lists usually name no evidence?

Because the phrase costs nothing. Every vendor in the table says it is GDPR compliant. What differs is whether the page behind the claim names a city, a cloud provider and a list of third parties, or stops at the adjective. The CMS GDPR Enforcement Tracker Report 2026, whose employment section is dated 21 May 2026, counts 191 fines imposed on employment-data processing, 40 more than the 2025 edition. The largest fine in that category came from the Dutch authority in July 2024 against a mobility provider that had stored sensitive data on US servers for over two years, and the highest fine since the 2025 report was issued by Poland's UODO in July 2025 over a third-party processor used for work schedules (CMS, Enforcement Tracker Report 2026, employment, accessed 2026-10-14). Where data sits and which processors touch it is exactly what regulators look at, and the report's outlook adds that the information given to applicants and employees could be examined more frequently.

What does the hosting and contract table show, as of 14 October 2026?

"Not stated" means the pages I opened do not say it. HQ country is the contracting entity's registered country from the vendor's terms or imprint. "EU-only sub-processors" asks whether the published list stays inside the EU/EEA; a "No" does not mean the vendor is non-compliant, it means at least one named processor sits outside.

Vendor	HQ country	Hosting region as stated	EU-only sub-processors	Public DPA	Source
Recruitee (Tellent)	Netherlands (Recruitee B.V., Amsterdam)	"Strictly" EU: Google Cloud Frankfurt and Berlin, AWS Frankfurt; AWS Ireland for video answers	No: Intercom in AWS us-east-1 for support; core infrastructure and AI/ML (Google Cloud Germany, Azure NL/SE/DE) in the EU	Yes, as an addendum to the public terms	Data centre article, Terms
Personio	Germany (Personio SE & Co. KG, Munich)	"Our customer data is exclusively stored in the European Union"; AWS Frankfurt per the 2018 GDPR letter	Not stated publicly: the security page says the list is inside the customer account; the trust centre lists a Subprocessors item	Generated and signed inside the product; listed in the trust centre	Privacy notice, GDPR letter, Security, Trust centre, Legal notice
softgarden	Germany (softgarden e-recruiting GmbH, Berlin)	Germany: WIIT AG and Equinix data centres in Frankfurt and Düsseldorf	Applicant data: no third-country transfer stated; support via Intercom may transfer to the US	Yes, Art. 28 DPA as PDF or digital signature	Data protection SaaS, Imprint
Teamtailor	Sweden (Teamtailor AB, Stockholm)	Customer chooses: AWS Ireland (EU), Oregon or Australia; regions do not share data	EU-region core list is EU; optional Twilio (US) for SMS, Google push, Fastly CDN; OpenAI Ireland for Co-pilot	Listed under Legal on the trust centre; access may need a request	Regions, EU sub-processors, Trust, Privacy notice
Homerun	Netherlands (Homerun B.V., Amsterdam)	AWS EMEA SARL, processing location EU; no city named	No: SendGrid (US) for email	Yes, integral part of the public terms	Sub-processors, Terms
Greenhouse	USA (Greenhouse Software, Inc., New York)	AWS in the United States, Germany and Australia; the page does not say which applies to a given customer	No: 30 sub-processors, almost all US, including OpenAI and Anthropic	Yes, template with DocuSign, last updated 9 March 2026	Sub-processors, DPA, Security
SmartRecruiters	USA (SmartRecruiters, Inc.)	Default Frankfurt, Germany; Ohio or Sydney if the order form says so	No: 46 entries including SmartRecruiters Inc., Google, Salesforce, Twilio (US), Atlassian (AU)	Yes, pre-signed GDPR DPA on the legal page	Sub-processors, Legal
Lever (Employ)	USA (Employ, Inc.)	AWS "US-West2 and EU-Central1 regions"	No: AWS, Google Cloud, Mailgun, Snowflake (US); BitQit (India); Textkernel (NL)	Yes, Employ DPA, last updated 20 May 2025	Security, Sub-processors, DPA
Workable	UK contracting entity (Workable Software Ltd, London); Workable, Inc. operates the service in the US	"Hosted and operated in the United States"; DPA names processing in the UK, US and Greece; AWS, Google Cloud and MongoDB hosting in US East	No: 19 US entries including OpenAI, Microsoft Azure, Deepgram	Yes, public addendum	Privacy, Sub-processors, DPA
Pickr	Austria (Agusta GmbH)	Data in Europe	No: the AVV annex lists a hosting and database provider (production data and functions run in Europe) and AI model, transcription, video, e-mail delivery and payment providers in the US, all under EU standard contractual clauses	Yes, Art. 28 AVV published on the legal page and included	AVV, Privacy, /features/pipeline

Vendor pages change without notice. A region on a marketing page is a description; the DPA and its sub-processor annex are the commitment. Put the region in the order form.

Which vendors host in the EU by default?

Four vendors describe the EU as the place data lives, not a choice. Recruitee says it strictly hosts in the EU and names Google Cloud europe-west3 (Frankfurt and Berlin) and AWS eu-central-1 (Frankfurt), with AWS Ireland used for the video answers feature alone (Recruitee data centre article, accessed 2026-10-14). softgarden names the operators, WIIT AG and Equinix, and the cities, Frankfurt and Düsseldorf, and states that applicant data in the applicant management system is not transferred to third countries (softgarden data protection, accessed 2026-10-14). Personio's current privacy notice says customer data is stored exclusively in the EU; the Frankfurt AWS detail comes from its 2018 GDPR letter, which is the most specific public statement I found (Personio privacy notice, Personio GDPR letter, accessed 2026-10-14). Pickr stores candidate data in Europe.

Two US-headquartered vendors also default to Germany. SmartRecruiters' sub-processor page states Frankfurt as the default hosting location unless the order form designates Ohio or Sydney (SmartRecruiters sub-processors, accessed 2026-10-14). Greenhouse lists AWS in the United States, Germany and Australia but does not say on the pages I opened which region a given customer gets (Greenhouse sub-processors, accessed 2026-10-14), so ask.

Teamtailor and Lever make the region a choice: Teamtailor lets the customer pick Ireland, Oregon or Australia in the settings, and the regions do not exchange data (Teamtailor regions, accessed 2026-10-14); Lever names AWS US-West-2 and EU-Central-1 (Lever security, accessed 2026-10-14). Workable says the service is hosted and operated in the United States, with the hosting provider storing data in the USA as well as the EEA (Workable privacy, accessed 2026-10-14).

Does an EU region mean the data stays in the EU?

Usually not, and the sub-processor list is where you find out. Recruitee hosts in Frankfurt and still routes support through Intercom in AWS us-east-1 (Recruitee terms, accessed 2026-10-14). Homerun processes in the EU on AWS and sends email through SendGrid in the USA (Homerun sub-processors, accessed 2026-10-14). SmartRecruiters' Frankfurt default sits above a list of 46 entities, effective March 2025, with addresses in the US, UK, Australia, Singapore and Canada (SmartRecruiters sub-processors, accessed 2026-10-14). Workable's list, updated 18 June 2026, names 19 US companies, among them OpenAI and Microsoft Azure for AI model inference (Workable sub-processors, accessed 2026-10-14).

Teamtailor's EU-region list is the cleanest I opened: the core sub-processors are in Ireland, Germany and Finland, and the US entries are optional features such as SMS via Twilio (Teamtailor EU sub-processors, accessed 2026-10-14). softgarden states no third-country transfer of applicant data but notes that its support tool, Intercom, may transfer data to the US (softgarden data protection, accessed 2026-10-14). Personio does not publish its list; the security page says it is available inside the customer account (Personio security, accessed 2026-10-14).

From our work at ScalingPPL, the processor that surprises clients is rarely the database. It is the email relay, the support chat and the AI model, because nobody thought of them as recruiting software. Read the list for those three before anything else.

Who publishes a DPA, and who makes you ask?

Eight of the ten publish the document or fold it into public terms: Greenhouse (template with a signing link, last updated 9 March 2026), Employ for Lever (last updated 20 May 2025, Data Privacy Framework first and standard contractual clauses as the fallback), Workable (addendum on its legal page, processing in the UK, US and Greece), SmartRecruiters (pre-signed GDPR DPA on the legal page), softgarden (Art. 28 DPA as a PDF or signed digitally), Tellent for Recruitee (addendum to the terms, six weeks' notice of sub-processor changes) Homerun (DPA as an integral part of the terms, last updated 11 February 2025) and Pickr (Art. 28 AVV on its legal page). Sources are in the table rows.

Teamtailor lists its DPA under Legal on the trust centre, where sensitive documents sit behind an access request (Teamtailor trust centre, accessed 2026-10-14). Personio's 2018 letter describes the agreement being generated and executed inside the application, and the trust centre lists a Data Processing Addendum (Personio GDPR letter, Personio trust centre, accessed 2026-10-14).

A public DPA is convenient, not decisive. What matters is whether it names the transfer mechanism, the notice period for new sub-processors and the deletion window after termination. Greenhouse's gives 30 days' notice and automatic deletion 90 days after termination; Employ's gives 15 days to object and deletion by 45 days; Workable's allows deletion 90 days after termination. Those three clauses are the ones a client's procurement team will read.

What does the operations table show, as of 14 October 2026?

The second table covers the features you use every month: whether deletion runs without a person clicking, whether a subject access request produces an export, and what the AI does and under which rules.

Vendor	Retention auto-delete	DSAR export	AI features	AI Act status on the pages opened	Source
Recruitee	Yes: GDPR automation deletes expired, non-consenting and requesting candidates (Advance and Optimize plans)	Candidate-facing links in confirmation emails to request deletion or correction; access export not described on the pages opened	Screening Assistant on monthly credits, Matching Assistant, AI writing; AI/ML via Google Cloud Germany and Azure in the EU	Not stated	GDPR features, Pricing, Terms
Personio	Yes: automatic anonymisation after a number of days the customer sets, for candidates in the Rejected or Withdrawn stage; manual and bulk anonymisation also described	Data subject rights functions and full data export described in the 2018 letter	AI Talent Screening Agent: "AI narrows the field and you make the call"; models on AWS Bedrock	AI FAQ of 5 October 2026: Personio Assistant classed as limited risk; Talent Screening Agent stated as compliant with GDPR Art. 22 and AI Act Art. 14; Personio as provider, customer as deployer	Help article, Recruiting, GDPR letter, AI FAQ
softgarden	Yes: automated deletion set by the customer; six months recommended	Requests forwarded and pre-qualified by softgarden's data protection team; the customer answers within four weeks	AI matching: opt-in, off by default, own model trained on anonymised data, no automated decisions	Not stated	Data protection, AI matching
Teamtailor	Yes: rules for inactivity, rejection, no purpose, removal request or expired permission; deletion one week after flagging	Yes: automatic or manual response with a .zip download	Co-pilot on OpenAI Ireland, opt-in; Teamtailor AI "included, unlimited usage"	States Annex III applies from 2 December 2027; Teamtailor as provider where applicable, customer as deployer; ISO/IEC 42001 certified August 2026	Auto removal, Data requests, AI Act
Homerun	No: bulk deletion by date filter; automation "intended"	Not described; the customer removes the data on request	None stated on the pages opened	Not stated	GDPR guide, Security
Greenhouse	Notification: retention rule emails a user when the timer lapses; "deleting a candidate's personal data must be done manually"	Yes: candidate packet download, all customers	Talent Matching: fine-tuned and third-party models including OpenAI; personal data not used to train models; a human decides each candidate	Not mentioned in the Talent Matching FAQ (GDPR Art. 22 discussed); ISO 42001:2023 certified	Retention rule, GDPR overview, Talent Matching FAQ
SmartRecruiters	Not stated on the pages opened	Data subject rights resources listed on the legal page; no in-product export described	Winston Chat, Match, Screen, Companion; AdeptID (Boston, US) listed as an optional sub-processor for Winston Match, hosted in AWS Frankfurt for EU customers	AI addendum names the EU AI Act; customer is the deployer of high-risk features; features "do not independently evaluate, score, or rank"	AI addendum, GDPR page, Sub-processors
Lever	Reminder-driven: candidates past the retention period are flagged for deletion or anonymisation by configuration; owners get reminders to anonymise	Yes: "Send personal data" generates an email draft with the stored fields	AI screening, unlimited transcripts, fraud signals; built with IBM watsonx.governance	Not stated	GDPR settings, Data requests, Pricing
Workable	Yes: hard-delete after a period counted from profile creation; sourced, never-contacted candidates after 30 days	Erasure link for candidates; access export not described	Workable Agent on credits; inference at OpenAI and Microsoft Azure (US); privacy policy states no automated decision-making or profiling	Not stated	GDPR automation, Pricing, Sub-processors, Privacy
Pickr	Not stated on the feature pages	Candidate portal with consent management; DSAR export not stated on the feature pages	Every candidate scored with reasoning; names and emails redacted from AI prompts by default; no training on candidate data	Matching treated as a high-risk system: candidates informed before use, no fully automated decision	/features/matching, /features/communication

Which ATS deletes candidate data without a person clicking?

Five describe unattended deletion or anonymisation. Teamtailor flags candidates who meet an enabled rule and removes them a week later, with hired candidates excludable (Teamtailor auto removal, accessed 2026-10-14). Workable hard-deletes after a period counted from the profile's creation date and does not notify you when it happens (Workable GDPR automation, accessed 2026-10-14). Recruitee's GDPR automation deletes expired candidates and those who never consented, on the Advance and Optimize plans (Recruitee GDPR features, accessed 2026-10-14). softgarden describes an automated deletion the customer configures and recommends six months (softgarden data protection, accessed 2026-10-14). Personio anonymises candidates in the Rejected or Withdrawn stage automatically after a number of days you select; the application ID, date and channel stay for reporting (Personio help, accessed 2026-10-15).

Greenhouse and Lever are built around a person confirming. Greenhouse's retention rule notifies a designated user and states that deletion must be done manually (Greenhouse retention rule, accessed 2026-10-14). Lever flags candidates past their period and reminds opportunity owners to anonymise, with the hashed-email setting deciding whether a returning candidate is recognised (Lever GDPR settings, accessed 2026-10-14). Neither is wrong; a confirmed deletion is defensible. It just means the retention policy only runs if someone reads the email.

The question to ask any vendor, including Pickr, is what the deletion removes. Lever's data-request article states that non-identifiable notes, interview feedback and events remain on the backend after anonymisation and feed analytics (Lever data requests, accessed 2026-10-14). That is a legitimate design, and you should know it before a candidate asks what you still hold.

Which vendors say anything about the EU AI Act?

Four do on the pages I opened. Teamtailor's support article states that the Annex III high-risk requirements apply from 2 December 2027, positions Teamtailor as the provider where it makes AI available and the customer as the deployer, and reports ISO/IEC 42001 certification in August 2026 (Teamtailor AI Act, accessed 2026-10-14). SmartRecruiters' Artificial Intelligence Addendum, last updated 18 June 2025, lists the EU AI Act among the laws it tracks and assigns the deployer role for high-risk features to the customer (SmartRecruiters AI addendum, accessed 2026-10-14). Personio's AI FAQ, updated 5 October 2026, classes the Personio Assistant as limited risk, states that the Talent Screening Agent is compliant with GDPR Article 22 and AI Act Article 14, and names Personio as provider and the customer as deployer (Personio AI FAQ, accessed 2026-10-14). Pickr's matching page treats candidate matching as a high-risk system under the Act: candidates are informed before it is used, every score comes with reasoning, and no hiring decision is fully automated (/features/matching).

The date itself moved this summer. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. It moves the application date for stand-alone Annex III high-risk systems, which include recruitment and selection tools, from 2 August 2026 to 2 December 2027; the Article 50 transparency duties stay on the 2 August 2026 schedule (Cooley, Digital AI Omnibus delays key deadlines, accessed 2026-10-14). The deployer obligations land on you, not the vendor; what the EU AI Act requires of recruiters covers that side.

Greenhouse's Talent Matching FAQ, last updated 2 February 2026, discusses GDPR Article 22 and states that a human decides each candidate, but does not mention the AI Act; it also names OpenAI as a third-party model provider with a DPA that bars training on personal data (Greenhouse Talent Matching FAQ, accessed 2026-10-14). Workable's privacy policy states that Workable does not engage in automated decision-making or profiling while its sub-processor list names OpenAI and Azure in the US for inference (Workable privacy, accessed 2026-10-14). Those two facts together are the question to put in writing: which model, in which region, with what stripped first.

Where is Pickr the wrong choice here?

• You want a region picker. Teamtailor's three regions and Lever's two are a clean answer for a company with hiring teams on several continents. Pickr stores candidate data in Europe.
• You want retention rules that delete without a person clicking. Teamtailor, Workable, Recruitee and softgarden describe that on their pages, and Personio describes automatic anonymisation. Pickr's feature pages do not describe a timed auto-delete.
• You want a vendor that documents the AI Act position in a support article. Teamtailor's is the most complete I found, including an ISO 42001 certification.
• You hire in the US and only in the US. EU hosting is not a reason to pick anything.

Where Pickr fits is a European agency or in-house team that wants the candidate data in Europe, names and email addresses redacted from AI prompts by default, and the reasoning behind every score stored with the decision. Pricing on request. The obligations that come with an ATS are set out in what GDPR requires from a recruitment ATS; the compare page has the head-to-head pages for individual vendors.

Then do what the table cannot: send the nine questions, get the region and the sub-processor list in the order form, and read the deletion clause before the first candidate record exists.

Sources

• CMS, "GDPR Enforcement Tracker Report 2026: Employment", https://cms.law/en/int/publication/GDPR-Enforcement-Tracker-Report/employment (accessed 2026-10-14)
• Cooley, "Digital AI Omnibus delays key deadlines, introduces new rules" (3 August 2026), https://cdp.cooley.com/digital-ai-omnibus-delays-key-deadlines-introduces-new-rules/ (accessed 2026-10-14)
• Recruitee, "Recruitee's data center and GDPR", https://support.recruitee.com/en/articles/1066285-recruitee-s-data-center-and-gdpr (accessed 2026-10-14)
• Recruitee / Tellent terms, DPA and sub-processors, https://recruitee.com/terms (accessed 2026-10-14)
• Recruitee, "Intro to Recruitee's GDPR features", https://support.recruitee.com/articles/4728994 (accessed 2026-10-14)
• Recruitee pricing, https://recruitee.com/pricing (accessed 2026-10-14)
• Personio, recruiting product page, https://www.personio.com/product/recruiting/ (accessed 2026-10-14)
• Personio, security page, https://www.personio.com/security/ (accessed 2026-10-14)
• Personio trust centre, https://trust.personio.com/ (accessed 2026-10-14)
• Personio privacy notice, https://www.personio.com/privacy-policy/ (accessed 2026-10-14)
• Personio, "EU GDPR at Personio", https://www.personio.com/gdpr/ (accessed 2026-10-14)
• Personio legal notice, https://www.personio.com/legal-notice/ (accessed 2026-10-14)
• Personio, "Manage data protection in Recruiting", https://support.personio.de/hc/en-us/articles/360000932398 (accessed 2026-10-14; automatic anonymisation section re-read 2026-10-15)
• Personio, "Frequently asked questions about AI data privacy and security", https://support.personio.de/hc/en-us/articles/38476681365149 (accessed 2026-10-14)
• softgarden, "Data protection information for the use of softgarden Software as a Service", https://softgarden.com/en/data-protection-software-as-a-service/ (accessed 2026-10-14)
• softgarden imprint, https://www.softgarden.com/en/imprint/ (accessed 2026-10-14)
• softgarden, "What is the AI-assisted applicant matching?", https://support.softgarden.de/en/articles/319436-what-is-the-ai-assisted-applicant-matching (accessed 2026-10-14)
• Teamtailor, "Different regions for data processing", https://support.teamtailor.com/en/articles/8031426 (accessed 2026-10-14)
• Teamtailor, EU region sub-processors, https://support.teamtailor.com/en/articles/4723968-sub-processors-used-for-the-service (accessed 2026-10-14)
• Teamtailor trust centre, https://trust.teamtailor.com/ (accessed 2026-10-14)
• Teamtailor, "Automatically remove your candidates data", https://support.teamtailor.com/en/articles/3924510-automatically-remove-your-candidates-data (accessed 2026-10-14)
• Teamtailor, "Candidate Data requests", https://support.teamtailor.com/en/articles/10769250-candidate-data-requests (accessed 2026-10-14)
• Teamtailor, "The New EU AI Act: Recruiting with Teamtailor", https://support.teamtailor.com/en/articles/9116269-the-new-eu-ai-act-recruiting-with-teamtailor (accessed 2026-10-14)
• Teamtailor, "Responsible AI Principles", https://support.teamtailor.com/en/articles/10450488-teamtailor-responsible-ai-principles (accessed 2026-10-14)
• Teamtailor pricing, https://www.teamtailor.com/en/pricing/ (accessed 2026-10-14)
• Teamtailor privacy notice, https://www.teamtailor.com/en/privacy-policy/ (accessed 2026-10-14)
• Homerun, GDPR hiring guide, https://www.homerun.co/gdpr (accessed 2026-10-14)
• Homerun, "List of Sub-Processors", https://homerun.co/sub-processors (accessed 2026-10-14)
• Homerun, "Security Measures", https://homerun.co/security-measures (accessed 2026-10-14)
• Homerun terms of service, https://homerun.co/terms-of-service (accessed 2026-10-14)
• Greenhouse security, https://www.greenhouse.com/security (accessed 2026-10-14)
• Greenhouse, "Subprocessors in use", https://www.greenhouse.com/subprocessors-in-use (accessed 2026-10-14)
• Greenhouse, "Data Processing Addendum", https://www.greenhouse.com/data-processing-addendum (accessed 2026-10-14)
• Greenhouse, "Configure a data retention rule", https://support.greenhouse.io/hc/en-us/articles/360002418112-Configure-a-data-retention-rule (accessed 2026-10-14)
• Greenhouse, "GDPR features overview", https://support.greenhouse.io/hc/en-us/articles/360061849112-GDPR-features-overview (accessed 2026-10-14)
• Greenhouse, "Talent Matching - Data Processing FAQ", https://support.greenhouse.io/hc/en-us/articles/41131616864283-Talent-Matching-Data-Processing-FAQ (accessed 2026-10-14)
• Greenhouse privacy policy, https://www.greenhouse.com/privacy-policy (accessed 2026-10-14)
• SmartRecruiters, "List of Subprocessors", https://www.smartrecruiters.com/legal/subprocessors (accessed 2026-10-14)
• SmartRecruiters legal page, https://www.smartrecruiters.com/legal/ (accessed 2026-10-14)
• SmartRecruiters, "Artificial Intelligence Addendum", https://www.smartrecruiters.com/legal/artificial-intelligence-addendum/ (accessed 2026-10-14)
• SmartRecruiters, "Is your Recruiting Data GDPR Compliant?", https://fran.smartrecruiters.com/resources/gdpr-recruiting (accessed 2026-10-14)
• SmartRecruiters trust centre, https://trust.smartrecruiters.com/ (accessed 2026-10-14)
• Lever security, https://www.lever.co/security/ (accessed 2026-10-14)
• Employ, "Sub-processors", https://www.employinc.com/sub-processors/ (accessed 2026-10-14)
• Employ, "Data Protection Addendum", https://www.employinc.com/dpa/ (accessed 2026-10-14)
• Lever, "Configuring General Data Protection Regulation (GDPR) Settings", https://help.lever.co/s/article/Configuring-General-Data-Protection-Regulation-GDPR-settings (accessed 2026-10-14)
• Lever, "Resolving data requests", https://help.lever.co/s/article/Resolving-data-requests (accessed 2026-10-14)
• Lever pricing, https://www.lever.co/pricing/ (accessed 2026-10-14)
• Workable privacy policy, https://www.workable.com/privacy (accessed 2026-10-14)
• Workable, "Sub-processors", https://www.workable.com/subprocessors (accessed 2026-10-14)
• Workable, "Data Processing Addendum", https://www.workable.com/legal/data-protection (accessed 2026-10-14)
• Workable, "Setting up GDPR automation features", https://help.workable.com/hc/en-us/articles/360041472254 (accessed 2026-10-14)
• Workable terms, https://www.workable.com/terms (accessed 2026-10-14)
• Workable pricing, https://www.workable.com/pricing (accessed 2026-10-14)