Last updated: October 12, 2026
If you've been contacted about a role through Umamy, or you'd like to know what data we hold about you, this page explains it. Umamy helps companies find and reach candidates. Sometimes that means we process professional information about you before you've interacted with us directly — this notice covers that, as required by Article 14 of the GDPR.
Umamy SAS — 11 Hameau du Reptou, 64200 Biarritz, France ([email protected]). Data Protection Officer: [email protected]. Umamy acts as a processor on behalf of its recruiting clients when it selects candidates and sends messages for them, and as an independent data controller when it builds its candidate database and improves its matching technology. This notice concerns Umamy's own (controller) processing.
Professional information — name, role, company, career history, professional contact details — obtained from a data-broker partner and public professional sources. If you exchange messages with a recruiter through us, those exchanges are analysed to assess your fit for a role. To improve our matching technology, we only reuse interest signals derived from your replies — such as your availability or openness to new opportunities — never the content of your exchanges or any client-confidential information, and never in a way that identifies you to another client. Our AI providers do not reuse your data to train their own models.
To identify you as a potential candidate and connect you with relevant opportunities. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
We calculate a fit score. This profiling has no legal or similarly significant effect on you; the final shortlist is decided by a human (no solely automated decision under Art. 22 GDPR). You can ask for a decision to be reviewed.
We may share your data with our recruiting clients (only in connection with a specific opportunity) and with the technical sub-processors needed to run our service (hosting, AI analysis, LinkedIn messaging, analytics). Our core data is hosted in the EU (AWS, Frankfurt); some tools may process data outside the EU under appropriate safeguards (EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework). The current list is on our Trust Center.
Only as long as needed for sourcing, then deleted per our retention policy: profiles never contacted are removed or anonymised after 24 months; if we have contacted you, we keep your data for up to 2 years after our last contact.
Access, rectification, erasure, objection, restriction and portability — email [email protected]. You can also object to any further contact ("do not contact") and lodge a complaint with the CNIL. If you ask not to be contacted, we apply this across all our clients: we keep a do-not-contact list checked before any outreach.
To exercise your rights or opt out, email [[email protected]](mailto:[email protected]?subject=Data%20request).