How long may a company keep my CV and application?

Application data exists for one purpose — filling that vacancy. When you are rejected, the purpose dies, and storage limitation (Art. 5(1)(e)) starts the clock: national guidance across Europe converges on a few weeks to a few months after the process ends (the common anchor: long enough to answer discrimination claims about the process, and no longer — several DPAs say around four weeks by default, up to a year where an equality-claim window justifies it). Years-old CV databases of silently rejected people are plainly unlawful. “May we keep your details for future roles?” is fine — as a question. It needs your freely given consent, a stated retention period (a year is the common decent practice), and an easy withdrawal. Pre-ticked or assumed retention is not consent. Recruitment agencies are controllers of their candidate pools: the same rules, plus your access right to see notes and placements history, and erasure when you want out of the pool. Practical move after a rejection you want gone: one line — “The process has ended; please delete my application data per Art. 17 and confirm.” Follow the escalation if ignored; and if you suspect the rejection itself was discriminatory, request the file first, deletion second.