This policy explains how Showrunner HR collects, uses, and protects personal data belonging to venue staff, candidates, and employees.
The venue organisation using Showrunner HR ("the organisation") is the data controller for candidate and employee data entered into the product — it decides what to collect and why. Showrunner ApS ("Showrunner") acts as the organisation's data processor, handling that data only on the organisation's instructions and for the purpose of providing the service.
Depending on how an organisation uses Showrunner HR, this can include: candidate contact details, CVs and application answers, screening notes, interview scores, right-to-work and age-verification records, trial-shift evaluations, employment and onboarding records, and account/billing details for the organisation itself (billing email, VAT number, Stripe customer reference — never full card numbers, which Stripe holds directly).
To operate the hiring workflow the organisation has set up: receiving and screening applications, scheduling interviews, running trial shifts, generating employment and trial documents, onboarding new hires, and billing the organisation for its subscription.
Candidate data is retained for 6 months from the last activity on an application by default (an organisation can shorten this in its own settings), after which it is automatically deleted. Employee records are kept for the duration of employment plus whatever statutory retention period applies in the organisation's country. Billing records are kept as required by tax law.
If you are a candidate or employee whose data is held in Showrunner HR, you can ask the organisation that manages your data to access, correct, or delete it, or to explain how it is used. Because the organisation is the data controller, requests should go to them first; Showrunner will assist the organisation in responding as required by applicable data protection law (including the GDPR for organisations and data subjects in the EU/EEA, and the UK GDPR for organisations and data subjects in the UK).
Showrunner uses the following sub-processors to provide the service, all under written data processing agreements: Supabase (EU region — database and authentication), Vercel (application hosting), AWS Bedrock EU (AI-assisted screening), Mailgun EU (transactional email), GatewayAPI (SMS delivery, Denmark), and Stripe (billing and payment processing). An up-to-date list is available on request.
Questions about this policy, or about a specific organisation's use of your data, can be sent to privacy@showrunner.it.
This is a draft — pending legal review. It is not yet a final, legally binding document.