Version 2026-09-23. Applies to both the public demo and the private recruiter tool. German summary heading: Datenschutzerklärung. See also the Impressum.
Before public launch the controller identity and DPO contact below (marked [ … ]) must be completed — they are legal essentials under GDPR Art. 13 and cannot be left blank.
Special category data (Art. 9). A CV can incidentally contain data such as a photo, health information, or religious/trade-union affiliation. The profile extractor is instructed not to extract or infer any special category data, nor date of birth, age, gender, nationality or a photo — these are irrelevant to job matching and are dropped rather than stored in the profile. The uploaded source document is not deliberately scanned for such data, and none of it is used to rank candidates.
Purpose: parse the CV into a candidate profile and narrative, evaluate profile strength/seniority, match the candidate against live job listings, and route the candidate toward Skillia's B2B placement channel or its B2C paid job-search service.
Automatic applications (optional). When the candidate uses “Apply automatically” and explicitly authorises it, Skillia writes a cover letter in their name from the CV and emails it, with the CV attached, to the contact address the employer published for the vacancy. The candidate receives a copy of every application and employers reply to the candidate directly. Each send is logged (time, employer domain, job title, outcome — never CV content).
Lawful basis: consent (Art. 6(1)(a) GDPR). In the public wizard the candidate confirms this directly; in the private tool the recruiter confirms a lawful basis on the candidate's behalf. Each consent event is logged (time, policy version, scope) so it is demonstrable (Art. 7(1)). Consent is withdrawable at any time by contacting the controller.
A predicted routing channel (B2B placement vs. B2C paid) is derived from an AI-generated profile score. This is decision support: it is shown to a recruiter, who decides whether and how to act on it — it is not applied end-to-end without human review, so it does not constitute a solely automated decision under Art. 22. If that routing is ever fully automated, this notice and the safeguards will be revisited.
| Recipient | Data | Transfer safeguard |
|---|---|---|
OpenAI, L.L.C. (USA) — gpt-4.1-mini parsing/evaluation, text-embedding-3-small ranking |
CV text and derived profile | Processing under OpenAI's API Data Processing Addendum, which incorporates the EU Standard Contractual Clauses; OpenAI self-certifies under the EU–U.S. Data Privacy Framework. API inputs are not used to train OpenAI's models. [Confirm the DPA is executed and current before launch.] |
| Job listing sources — BA Jobbörse, Arbeitnow, Adzuna, Jooble, Brave Search | Only derived search terms — never the raw CV | Non-personal search queries only. |
| Bright Data (scraping proxy, only if the scraper source is enabled) | Target job-page URLs | SCCs via Bright Data's DPA. [Confirm processing location before enabling in production.] |
| Skillia CRM | Candidate profile, if a recruiter clicks "Send to CRM" | [State hosting/processing location; keep within the EEA where possible.] |
| Hiring companies | Strong profiles placed through the B2B channel; CV and cover letter when the candidate authorises automatic applications | Only with the candidate's knowledge. |
"Send to CRM" and "Export to CRM" are always deliberate, human-reviewed actions from the private tool — never automatic or silent.
The matching app persists nothing past the browser session — CV and profile live only in memory and are gone on refresh or when the session ends. Once a candidate record is sent to the CRM, it is retained for 24 months (configurable per deployment), after which it is deleted or anonymised by the CRM's retention process. Erasure on request happens sooner (see below).
Your account is kept until you delete it. Under "My account" you can edit your profile, download all account data (JSON) and delete the account immediately and permanently.
Job listings and any contact emails found in them concern real people (HR
contacts) not directly informed under Art. 14. Exposure is limited to
role-based inboxes (info@, bewerbung@, hr@)
found in public job ads or a company's own listing pages — no scraping of
personal social profiles or non-work contact details. This processing relies
on legitimate interest (Art. 6(1)(f)); a legitimate-interest assessment is on
file [complete the LIA before relying on this at scale].
As a candidate you can at any time withdraw consent; request access, rectification, erasure, restriction or portability; and object to processing — by contacting the controller above. You can also lodge a complaint with a supervisory authority (in Germany, the data protection authority of your federal state).