Candidate Privacy & GDPR Consent

Last updated: April 21, 2026

Kula includes features to help your team handle candidate data responsibly and in line with data privacy regulations, including GDPR. This article covers what controls are available and how they work.

Candidate data in Kula

When a candidate is created — whether through an application, manual entry, CSV import, or email forwarding — their personal information is stored in your Kula account. This includes:

  • Name and contact details (email, phone)

  • Resume and uploaded files

  • Application answers

  • Interview notes and scorecards

  • Communication history

Deleting a candidate

If you need to permanently remove a candidate and all associated data from Kula:

  1. Open the candidate's profile.

  2. Click the three-dot menu (⋯).

  3. Select Delete candidate.

  4. Confirm the deletion.

Deleting a candidate removes all their data from Kula, including profile details, files, notes, and conversation history. This action cannot be undone.

Note: If the candidate is part of multiple jobs, deleting them from one job may affect their profile across all jobs. Review carefully before deleting.

GDPR consent on application forms

If your job post includes a GDPR consent field, candidates are asked to confirm their consent to data processing at the point of application. This consent is recorded and stored alongside their profile.

To add a GDPR consent field to your application form, go to the job's Settings → Application form and enable the consent option.

Notes visibility and privacy

Internal notes on a candidate profile are set to Public by default, meaning all team members with job access can read them. Use the visibility dropdown on the Notes panel to restrict access where needed.

Frequently asked questions

How can we display our company's privacy policy to candidates during all Kula interactions?

You can add a privacy policy link or statement to your job application form. Go to the job's Settings → Application form and add a consent field or custom text field with your policy URL. For GDPR or DPDP compliance, the recommended approach is to include a mandatory consent checkbox that links to your policy. Candidates must accept before submitting the application.

Can we block submission if a candidate selects "No" to the consent field?

Currently, Kula does not natively disable the Submit button based on a "No" consent selection. This is a feature request that has been raised by customers. As a workaround, you can make the consent field mandatory (required), which will prevent form submission unless the candidate actively responds. Contact support@kula.ai to log this as a feature request for your account.

Does Kula automatically delete candidate data after a certain time?

No. Kula does not apply automatic data retention or deletion policies. Your team is responsible for managing candidate data in line with your own retention policy. Use the anonymise or delete features manually when required.

Where is consent data stored if a candidate agrees via the application form?

Consent captured through the application form is stored as part of the candidate's application record in Kula. It is visible to users with access to the job and application data.

Need Help?

If you have questions or need assistance, reach out to us at support@kula.ai or use the in-app chat.