Your rights
Data subject rights · Last updated: 2nd April 2026
Depending on your location and applicable law, you may have the following rights in relation to your personal information processed through HiveRef. Below, each right is described in plain language, with how to exercise it and when you can expect a response.
To exercise any of these rights, contact us at privacy@hiveref.com. We will respond within one calendar month.
Right to access
What it means: You can ask for confirmation of whether we hold personal information about you and, if we do, request a copy of that information together with details of how it is used.
How to exercise it: Email privacy@hiveref.com describing your request and, if you are a candidate or referee, the reference check or role where possible so we can locate your data. For some requests, the hiring organisation (data controller) may need to be involved.
Response time: We aim to respond within one calendar month.
Right to rectification
What it means: You can ask us to correct personal information that is inaccurate or incomplete.
How to exercise it: Email privacy@hiveref.com with the correction you need and any evidence that helps us verify it.
Response time: We aim to respond within one calendar month.
Right to erasure
What it means: In certain circumstances you can ask for your personal information to be deleted; for example, where it is no longer needed for the purpose it was collected, you have withdrawn consent, or processing is unlawful. This right is not absolute (for example, some records must be kept where the law requires).
How to exercise it: Email privacy@hiveref.com with your erasure request. Where the hiring organisation is the data controller, we may need their instruction to complete the request.
Response time: We aim to respond within one calendar month.
Right to restrict processing
What it means: In certain situations you can ask us to limit how we use your personal information; for example, while a dispute about accuracy is resolved or where you object to processing and we are assessing that objection.
How to exercise it: Email privacy@hiveref.com explaining why you are seeking restriction and which processing should be paused.
Response time: We aim to respond within one calendar month.
Right to data portability
What it means: Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
How to exercise it: Email privacy@hiveref.com stating that you are making a portability request and the format you prefer where we can reasonably provide it.
Response time: We aim to respond within one calendar month.
Right to object
What it means: Where we process personal information on the basis of legitimate interests, you may have the right to object to that processing. We must then stop unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is needed for legal claims.
How to exercise it: Email privacy@hiveref.com with details of your objection and the processing you are concerned about.
Response time: We aim to respond within one calendar month.
Rights related to automated decisions
What it means: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you, unless specific exceptions apply. HiveRef does not make automated hiring decisions. Reports support human review by the hiring organisation only.
How to exercise it: If you believe you have been subject to an unlawful solely automated decision in connection with our services, email privacy@hiveref.com with a short description of your concern.
Response time: We aim to respond within one calendar month.
Right to withdraw consent
What it means: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before you withdrew.
How to exercise it: Candidates can withdraw consent from their HiveRef account where that flow is available, or email privacy@hiveref.com to request withdrawal. Withdrawing consent may mean a reference check cannot continue.
Response time: We aim to respond within one calendar month.
Data subject requests: contact
For all requests relating to these rights, contact privacy@hiveref.com. We will respond within one calendar month.
If you are not in the EU or the UK
The rights described above reflect the GDPR framework that HiveRef uses as its global baseline. If you are not located in the European Union, European Economic Area, or United Kingdom, similar rights may still apply under your local law; for example, the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles for individuals in Australia, or comparable laws in Brazil, South Korea, and other jurisdictions.
You may still contact privacy@hiveref.com with your request; we will handle it in line with applicable law. Australian residents may also use the complaint processes available through the Office of the Australian Information Commissioner at oaic.gov.au.
For more context on how we process personal data, see our Privacy Policy.