Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Greenhouse retains Personal Information as long as a legitimate business need exists, after which it will delete or anonymize the data; if deletion is not immediately possible due to backup storage, the data will be isolated from further processing until deletion is feasible.
This analysis describes what Greenhouse's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an indefinite retention period tied to the existence of a legitimate business need, without specifying fixed retention durations for particular data categories, which may require evaluation under GDPR storage limitation principles.
Interpretive note: The policy does not specify category-specific retention periods, and the practical duration of retention under the legitimate business need standard depends on operational circumstances not described in the document.
Under this clause, Greenhouse retains Personal Information for an unspecified duration tied to legitimate business need, with backup archive copies potentially remaining in isolated storage after active processing ends. Users may submit deletion requests via the Data Subject Request Portal.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →Monitoring
Greenhouse has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.Excerpt from Greenhouse's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR Article 5(1)(e) storage limitation principles, which require personal data to be kept in a form that permits identification for no longer than necessary for the purposes for which it is processed. UK GDPR and CPRA contain equivalent requirements. The absence of specific retention periods for defined data categories may require evaluation against regulatory guidance on storage limitation compliance. 2. GOVERNANCE EXPOSURE: Medium. The policy's reliance on legitimate business need as the retention criterion without specifying category-specific retention schedules may be insufficient to demonstrate GDPR storage limitation compliance in the event of a regulatory review. The backup archive carve-out is common in industry practice but should be documented with an associated maximum retention period. 3. JURISDICTION FLAGS: EEA and UK users have the highest exposure given GDPR and UK GDPR storage limitation requirements. California residents may have deletion rights under CPRA that interact with this retention framework. The policy does not specify jurisdiction-specific retention schedules. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should request Greenhouse's data retention schedule as part of their Data Processing Addendum review to confirm specific retention periods for candidate and employee data processed by Greenhouse as a processor. The backup archive isolation practice should be confirmed as operationally implemented through audit or certification documentation. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether a published category-specific retention schedule is available or can be requested from Greenhouse, and whether the backup archive isolation practice is subject to a maximum retention cap. Data mapping documentation should reflect the backup archive scenario as a distinct processing state.
This provision establishes an indefinite retention period tied to the existence of a legitimate business need, without specifying fixed retention durations for particular data categories, which may require evaluation under GDPR storage limitation principles.
Under this clause, Greenhouse retains Personal Information for an unspecified duration tied to legitimate business need, with backup archive copies potentially remaining in isolated storage after active processing ends. Users may submit deletion requests via the Data Subject Request Portal.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Greenhouse.