Legitimate Interest Assessment

Processing

Alion's company profiles name the people who run and hire for a company: about 254,000 entries in September 2026. We did not collect them from the people concerned. The notice we publish for them is at People in Company Profiles; this section documents the three-step test for that processing, source by source.

Purpose test

Our legitimate interest is to publish accurate profiles of hiring companies, including who leads a company and who hires for it. The interests of third parties are those of job seekers, who want to know whom they are applying to, and of business users, who want to reach the right company. A further use is covered: delivering the applications and proposals that users send through Alion to the contact a company published for that purpose.

Necessity test

A name and a role are the minimum that describes who leads a company or hires for it. We take only what the source itself publishes, hold no photographs, private addresses, identity numbers or special-category data, and do not infer anything about a person beyond reading their stated role as founder, decision-maker or hiring contact. Contact details are never shown or sold to another user: no page and no paid feature shows a person's email address or telephone number, and paid contact features open only a company's own role mailboxes, such as jobs@ or info@, and its main telephone number.

Balancing, by source

A. The company's own website (legal notice or imprint). The company publishes its officers' names itself, in many countries under a legal duty to do so. Officers expect their name and role to be public in a business context. Impact: low. Shown on the company page with a link to the source page and marked as unchecked until an editor or the company confirms it.

B. SEC Form D filings. Executive officers, directors and promoters are named in filings the law makes public on EDGAR. Expectation of publicity: high. Impact: low. Shown on the company page with the source.

C. Official company registers. These registers exist to make a company's officers public. Impact: low. Shown on the company page with the source.

D. Public job portals. On some public job portals an employer names a contact person in its own vacancy so that applicants can reach them. Showing that person's name and role next to the company's vacancies, and delivering applications for the company's vacancies to the contact the employer published, stay within that expectation and are compatible with the original purpose (GDPR Art. 6(4)). Selling or displaying the contact details, or using them for unrelated marketing, would not be, and neither happens.

E. Startup directories. Startups list their team on a public directory to present themselves. Names and roles are shown in the "Who decides" panel of the company's cards in the job and startup listings; the company page itself shows them only after the company has claimed its profile on Alion. Impact: low.

Individual notice: Article 14(5)(b)

We do not write to each person individually. The profiles name several hundred thousand people in many countries; for many of them we hold no contact address at all, and for the others the only address is a work address published for another purpose, so writing to it would itself be an unrequested use of that address. Instead we publish the notice and link to it from every place a name appears (the people list on a company page, the "Who decides" panel of a listing card and the site footer), each company page carries a correction and removal link, and this assessment and our Record of Processing Activities are public.

Objection and erasure

An objection hides the entry from every page, and a hidden entry is no longer used to deliver applications. It stays hidden when the source is read again, because a new reading updates the existing entry rather than creating another one. For an erasure request an editor deletes the person's details (role, email, telephone numbers, LinkedIn address, source link) and keeps only the name at that company, hidden and marked as checked, so that a new reading of the same public source cannot fill the details in again; an address that also sits among the company's own mailboxes is removed there too. Requests are answered within one month; write to [email protected].

Conclusion

We consider this processing capable of relying on legitimate interest while contact details are neither shown nor sold, the notice stays linked wherever a name appears, and objections are honoured as described. The assessment must be revisited if contact details are ever displayed or sold, if a new source or purpose is added, or if the retention rule changes. Entries are kept for as long as the company's profile is kept.