Privacy Policy

1. Who is responsible

The controller for this site is [Company legal name], [Street address], [Postcode City], Germany.

You can reach us at [privacy@example.com]. Our data protection officer is [name or: we are not required to appoint one].

2. What we collect

We collect what the product needs, and we tell you at the point we ask for it.

• Account data: name, email address, password hash, role (candidate or employer).
• CV data: the file you upload and the structured work history we extract from it.
• Profile data: the skills, seniority and preferences you confirm during onboarding.
• Employer data: company name, contact details, the role descriptions you write.
• Usage data: pages viewed, matches opened, interest expressed, and basic technical logs.

3. Why we use it

Candidate data exists to rank you against open roles and to let an interested employer contact you. Employer data exists to describe roles and to invoice a successful hire.

We also use aggregated, non-identifying figures to see whether the matching is getting better.

4. Legal basis

Processing your CV and running matches is necessary to perform our contract with you under Art. 6(1)(b) GDPR.

Security, fraud prevention and product improvement rest on our legitimate interests under Art. 6(1)(f) GDPR.

Where we ask for consent, for example for optional analytics or marketing email, the basis is Art. 6(1)(a) GDPR and you can withdraw it at any time.

5. Your CV and the matching algorithm

When you upload a CV we parse it into structured work history: employers, titles, dates, seniority and the skills those roles evidence.

Matching runs on that work history. An employer describes the person they need, and the algorithm scores candidates against that description.

The score is not a final decision about you. A human at the employer decides who to contact, and you can ask us to explain how a score was produced.

A CV can contain special category data under Art. 9 GDPR, such as a photo, a health note or union membership. We ask you not to include it, and we do not use it as a matching signal.

6. What employers can see, and when

Before contact, an employer sees an anonymised profile: work history, seniority, skills and the match score with its reasoning. Your name, contact details and CV file are not shown at that stage.

When an employer decides they want to talk to you, they unlock your identity. At that point they receive your name, contact details and CV so they can reach out.

This is how the product works, so it is not optional while your profile is active. You can pause or delete your profile at any time to stop new introductions.

We also share data with service providers who host and run the platform for us. They act on our instructions under Art. 28 GDPR.

7. How long we keep it

Your account data and CV stay with us while your account is open. Delete your account and we remove them within [30] days, backups included in the next cycle.

Records of an introduction and a resulting hire are kept for [10] years to meet German commercial and tax retention rules.

Technical logs are kept for [90] days.

8. Your rights

Under the GDPR you can exercise the following rights, free of charge, by writing to [privacy@example.com].

• Access: ask what we hold about you (Art. 15).
• Rectification: have inaccurate data corrected (Art. 16).
• Erasure: have your data deleted where no retention rule applies (Art. 17).
• Restriction: limit how we process your data (Art. 18).
• Portability: receive your data in a machine readable format (Art. 20).
• Objection: object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time, without affecting processing already carried out.

You may also complain to a supervisory authority, for example [competent state authority] in [State].

9. Cookies

We use a session cookie to keep you logged in, and little else. The Cookie Policy lists every cookie and how to control them.

10. International transfers

We keep data in the EU wherever we can. If a provider processes data outside the EU, we rely on the EU Standard Contractual Clauses or an adequacy decision.

Our current sub-processors are listed at [link to sub-processor list].

11. Changes and contact

We update this policy when the product changes. The date at the top of the page always shows the current version.

Questions or requests go to [privacy@example.com].