Data Protection Impact Assessment
Last reviewed: 27 October 2026. Controller and contact details are in the Privacy Policy; the full record of processing is in the RoPA. Questions go to [email protected].
Three activities meet criteria the European Data Protection Board lists for likely high risk: evaluation and scoring of people with new technology (AI models reading resumes and public work, matching, screening for employers), processing on a large scale of data not obtained from the people concerned (names and business contacts connected with companies), and systematic monitoring of a publicly accessible service (security and bot detection). Each is assessed below.
Description: resume text and public GitHub or Hugging Face activity are sent to OpenAI models to fill in profiles, describe skills, write tailored resumes and letters, and produce screening reports for employers. Jobs are ranked for each candidate by comparing profile and posting.
Necessity and proportionality: each use serves a feature the candidate or employer asked for. Only the text needed for the task is sent. Uploaded files are deleted right after extraction, tailored resumes and screening reports after 180 days.
Risks: inaccurate descriptions or rankings that disadvantage a candidate; screening of a person without their knowledge; exposure of resume content outside Alion.
Measures: candidates can see and edit every extracted field; rankings only order what a candidate sees and never block an application; Alion makes no decision with legal or similar effect about anyone, hiring decisions stay with employers; registered candidates can refuse screening in their settings; the employer is the controller of a screening and Alion acts as processor; screening records are private to the employer and deleted after 180 days; the AI provider receives data under its data processing terms with Standard Contractual Clauses.
Residual risk: low to medium, accepted with the measures above and reviewed when models or features change.
Description: names, titles and roles of about 254,000 people who lead or hire for companies, with the source page and, where the source publishes them, a work email address, telephone number or LinkedIn address, collected from company websites, public registers, public job portals, startup directories and company representatives. Names and roles are shown with the company; work contacts are used only to deliver applications and proposals users send to that company.
Necessity and proportionality: only professional identity and work contact are held, from sources where they were published for business purposes. The legitimate interest balance, source by source, is set out in the LIA.
Risks: people not knowing their details are held; unwanted contact; outdated or wrong details.
Measures: the Art. 14 notice at People in Company Profiles is linked wherever a name appears; no page or paid feature shows or sells a person's email address or telephone number; an objection hides the entry everywhere and stops its use for delivering applications; an erasure removes the details so that the source cannot fill them in again; requests through [email protected] are answered within one month; email addresses are removed from API, MCP and dataset outputs.
Residual risk: medium. The main remaining risk is that people whose details come from a public source may not learn of it; this is reviewed at each annual review of the assessment.
Description: IP address, user agent, pages, a random device identifier, sign-in events and browser automation signals are recorded for every visit.
Necessity and proportionality: needed to protect accounts and stop scraping and abuse. No advertising or third-party analytics tools are used.
Risks: tracking of visitors beyond what security needs.
Measures: first-party only; raw page views reduced to statistics without IP addresses after about two days; bot-detection records deleted after 30 days; unused sessions and devices after 13 months; days a signed-in person was active after 13 months; security logs after 24 months; deletion runs automatically.
Residual risk: low.
The assessment was approved by the controller. It is reviewed at least once a year and before any new high-risk processing starts or an existing one changes materially. If an assessment shows a high risk that cannot be reduced, the competent supervisory authority is consulted before the processing starts.
What changes: since 27 October 2026 the open profiles of registered users are served to the AI agents of third parties, which can search them at scale and write to them.
Risks: harvesting of the base; agents posing as a known employer; unwanted or fraudulent messages; exposure of people with sensitive backgrounds; solely automated decisions by an agent’s owner.
Measures: privacy settings applied per viewer level; no contact details; daily limits by trust, no page past row 100, decoy profiles that block a harvester and a per-agent watermark; a company is named only from a verified domain and lookalike domains are refused; companies on sanctions lists are refused and not named to agents; sensitive backgrounds and minors excluded; the person’s filters, daily cap and queue; content rules for first messages; automatic pauses and blocks; the agent terms forbid keeping a profile beyond 30 days, resale and solely automated decisions; a switch and a journal for the person.
Residual risk: acceptable with these measures; reviewed after three months of operation.