Privacy policy

This notice informs you under Art. 13 and 14 GDPR and Art. 19 revDSG which personal data we process, for what purpose, for how long and which rights you have. It applies to skillreveal.io and to our recruitment activity.

1. Controller

The controller for data processing on skillreveal.io and for mandates in Germany is Skill Reveal GmbH, Hafenweg 8, 48155 Münster, Germany, represented by Managing Director Iurii Turok, e-mail info@skillreveal.io. The second entity, skillreveal OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia, registry code 16835468, is bound by the same policy; the allocation of roles between the two entities (joint or separate controllership) will be defined before publication.

No data protection officer has been appointed under § 38 BDSG (to be verified). Please send privacy requests to info@skillreveal.io with the subject "Datenschutz".

2. Which data we process

Candidates: name, contact details, CV or LinkedIn profile, qualification, work experience, projects, software and standards knowledge, language level, salary expectation, notice period, commute, preferred region, permit status, firms we may not approach, and notes and feedback from calls and interviews.

Employers: company, contact person, contact details, job description, requirements, salary band, contract and invoicing data.

Website visitors: technical access data in server logs (truncated IP address, time, page requested, browser), see section 9. We ask for certificates and diplomas only after the first call; we do not deliberately collect special categories under Art. 9 GDPR.

3. Purposes and legal bases

Placing professionals with employers, preparing and holding first calls, short profiles, interviews and offers: Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(f) GDPR (legitimate interest in placement); in Switzerland Art. 6 and 31 revDSG.

Passing a short profile or dossier to an employer: only with your consent for the specific job, Art. 6(1)(a) GDPR. Inclusion in the talent pool beyond the end of a process: only with your separate consent, Art. 6(1)(a) GDPR. You may withdraw both consents at any time.

Contract handling with employers, invoicing and statutory retention: Art. 6(1)(b) and (c) GDPR. Answering contact requests: Art. 6(1)(b) and (f) GDPR. Job alert by e-mail: Art. 6(1)(a) GDPR, confirmed by double opt-in.

4. Where your data comes from (direct approach)

If we approach you without you having contacted us, your data comes from publicly accessible professional profiles (for example LinkedIn or Xing), from referrals or from earlier contact with us.

We inform you at first contact about source and purpose (Art. 14 GDPR, Art. 19 revDSG). We use no automated scraping tools and make no automated decisions under Art. 22 GDPR: whether and to whom we present a profile is decided by a recruiter after a conversation with you.

5. Disclosure only with your consent

No dossier leaves us without your consent. We show you the short profile before it goes and name the employer before the first interview. Firms you place on your blocked list are not approached and receive no data about you.

Employers receive only the data needed to assess the specific job. Under our terms they commit to confidentiality and to deletion once the process ends.

6. Processors and recipients

We use service providers that process data on our behalf and are bound by contract under Art. 28 GDPR:

• Recruiting platform: TwoRocks (turocks.com), structured profiles, application and requirement forms, hosted in the EU.
• Web hosting and e-mail: (provider and server location to be added).
• Appointment booking: (EU/CH-hosted provider to be added); loads only after you click.
• WhatsApp Business (Meta Platforms Ireland Ltd.), only if you contact us through it; WhatsApp's privacy terms apply.

Further recipients: employers (only with your consent, section 5), tax advisers and authorities where required by law.

7. Data transfers: Switzerland, EU, third countries

Data is transferred between Germany and Switzerland. Switzerland has an adequacy decision from the EU Commission; the EU is deemed to provide adequate protection under the revDSG.

Our systems are hosted in the EU. Transfers to third countries occur only when you yourself use a channel such as WhatsApp or LinkedIn; the respective provider's safeguards then apply (EU standard contractual clauses, Data Privacy Framework).

8. Retention

We delete candidate data six months after the end of the process (rejection, withdrawal or start of employment) unless you have consented to the talent pool. With consent, the data remains stored until you withdraw it; we ask at least every 24 months whether the consent still stands.

Where a hire takes place, we keep the data needed for remuneration and guarantee for the guarantee period and thereafter for the commercial and tax retention periods (up to ten years). Server logs are deleted after 14 days. Job alert data is deleted when you unsubscribe.

9. No cookies, no tracking services

skillreveal.io sets no cookies and uses no analytics or advertising services. There is no cookie banner because there is nothing to consent to.

Your browser stores locally only your chosen language (entry "sr-lang" in localStorage). This is a strictly necessary setting under § 25(2) no. 2 TDDDG and is not used for recognition.

Server logs: when a page is requested, the hosting provider stores the IP address (truncated), time, page requested, referrer and browser for 14 days for security and error analysis, Art. 6(1)(f) GDPR. Should we introduce cookieless audience measurement in future, we will amend this section beforehand.

10. Forms, applications and job alerts

Our forms (post a requirement, apply, submit your profile, contact, job alert) transmit the entered data encrypted to a system hosted in the EU. An invisible field is used to block automated submissions; it stores no data from people.

For the job alert we store e-mail, discipline and region; the subscription is activated by a confirmation link and can be cancelled with every mailing.

11. Your rights

You have the right of access (Art. 15 GDPR, Art. 25 revDSG), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future.

Write to info@skillreveal.io. We reply within one month. We carry out deletion on request immediately unless a statutory retention obligation prevents it.

Complaints may be addressed to the North Rhine-Westphalia data protection authority (ldi.nrw.de) or to the supervisory authority where you live; in Switzerland to the Federal Data Protection and Information Commissioner FDPIC (edoeb.admin.ch).

12. Data security

Transmission over TLS, access only for people who need the data for placement, access logging, regular deletion runs. We do not send dossiers to third parties as unencrypted attachments.

13. Changes

We amend this notice when processing, providers or the legal situation change. The version published on this page with the date stated above applies.

• Legal notice
• Terms for employers