Paradox

GDPR overview

GDPR coverage is concrete but comes from the parent group: the privacy statement served on paradox.ai is a Workday document effective 27 February 2026, not a Paradox-specific policy. It names Workday Limited (Dublin) as controller for the EEA, UK and Switzerland, with Workday (UK) Limited in London and Workday Switzerland GmbH in Zurich as representatives, and Workday, Inc. as controller elsewhere; the Irish Data Protection Commission is the competent supervisory authority. Transfers out of the EEA rely on the European Commission's standard contractual clauses, backed by certification under the EU-U.S. Data Privacy Framework, its UK extension, the Swiss-U.S. framework and APEC Cross-Border Privacy Rules. A DPA is incorporated by reference into the service terms (updated 18 June 2025), and Paradox maintains a written information security program covering GDPR and CCPA. The DPO is reachable only through a OneTrust form; candidates should contact the client employer directly.

Who owns the data?

The service terms are explicit: as between client and Paradox, the client owns all Client Data, and Paradox acquires no rights in that data or in the related intellectual property beyond what the agreement grants. Paradox keeps ownership of the software itself and of any improvements made to it. Client Data may only be used to deliver the cloud software and professional services and to detect security incidents. One caveat matters: once client data has been deidentified it becomes Improvement Data, which Paradox owns outright and treats as its own confidential information. Ownership therefore flips at the moment of deidentification.

Reuse rights

Contractually, Paradox may use Client Data for two purposes only: to provide the cloud software and professional services, including preventing or fixing service and technical problems, and to detect security incidents and protect against fraudulent or illegal activity. Its FAQ confirms that client data is processed only as required to deliver the services, in line with the client's instructions. There is, however, a training carve-out that applies "notwithstanding anything to the contrary in the Agreement": deidentified Client Data may be used to build, improve and enhance Paradox offerings, including the training of its natural language processing. So training does happen, but on data stripped of identifiers, not on identifiable candidate records, and no opt-out mechanism is published. Paradox states that it does not sell personal or candidate data; the Workday privacy statement adds that you can object to sale or sharing for targeted advertising through Cookie Preferences or a Global Privacy Control signal.

Data retention & training

Hosting summary

Paradox names no hosting country and no hosting region anywhere on its site, which is a notable gap for a platform that processes candidate personal data. The security page mentions AWS, but the emphasis is deliberately placed on Paradox's own audited certifications rather than its provider's: "We're not relying solely on AWS or anyone else for their certification, we went out and got our own." The public web front end is served behind Cloudflare. What is documented is the legal framing of international transfers rather than their physical location: the applicable privacy statement, published by Workday, covers cross-border transfers with the European Commission's standard contractual clauses and with participation in the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework. For transfers from the EEA, the UK or Switzerland to the United States, additional contractual, technical and organizational measures are applied where necessary. In practice, buyers who need to know which jurisdiction their candidate data sits in will have to obtain that answer contractually, because it is not published.