Privacy policy

Who processes your data

• José Ulises Suárez Victoria
• Tax number 50232706S
• Theodor-Heuss-Straße 16, 37075 Göttingen, Germany
• kayaosv@gmail.com

This is the controller for the purposes of the General Data Protection Regulation. No data protection officer has been appointed: the project meets none of the conditions that would require one. For anything to do with your data, the address above is the place.

What data is collected

• When you create an account: your email address and a password. The password is not stored anywhere readable — the account system keeps a cryptographic digest of it, and nobody, the controller included, can read it back.
• When you complete your profile: first and last name, date of birth, nationality, the country and city you live in, your English level, your work experience and the sectors it is in, whether you hold a driving licence, whether you have worked in Germany or the Netherlands before, and whether you need housing or transport.
• The documents you upload: ID card or passport on both sides, CV, driving licence and tax identification documents.
• Your voice recording in English, if you choose to record one.
• Minimal technical data attached to facts that have to be provable: the IP address and browser you accepted each consent from, and the same details for whoever opens one of your documents.

Today Talpass does not ask for or store your IBAN, your postal address or your phone number, and therefore does not have them. The system anticipates them for the hiring stage, which does not exist in the product yet; the day they are asked for, this document will say so before you are asked, the IBAN will be stored encrypted. Your IBAN and your address will only be seen by the agency that has hired you, and the section «Who can see your data» explains when.

Nothing is collected by observation: there is no analytics, no cross-site tracking, no advertising profiling. What exists about you is what you have written or uploaded.

What it is used for, and on what legal basis

• Creating and maintaining your account and profile — performance of the contract between you and Talpass, which is the Terms of use (Art. 6.1(b) GDPR).
• Showing your pseudonymised profile to verified agencies — your consent (Art. 6.1(a)), the box you ticked when you signed up, described in the document «How your profile is shared».
• Checking your identity from the documents you upload — performance of the contract: without verification there is no profile an agency can take seriously (Art. 6.1(b)).
• Letting an approved agency listen to your recording in English — your consent (Art. 6.1(a)), optional and withdrawable at any time.
• Handing one of your documents to one specific agency — your explicit consent for that agency and those documents, never a generic one (Art. 6.1(a)).
• Sending you the essential account emails: confirming your registration, recovering access, telling you whether your verification was approved or rejected — performance of the contract (Art. 6.1(b)).
• Keeping proof of what you consented to and when, and of who opened which document — the obligation to be able to demonstrate consent (Art. 7.1) and the legitimate interest in being able to defend or rebut a claim (Art. 6.1(f)).
• Letting the agency that has hired you see your IBAN and your postal address, so it can pay your wages and register you — performance of the employment contract you are party to (Art. 6.1(b)). Only that agency, and only from the moment it hires you.
• Keeping the service secure and preventing abuse — legitimate interest (Art. 6.1(f)).

Who can see your data

This is the part that defines the product, so it goes in detail.

What an agency sees in the talent pool is pseudonymised: your first name and the initial of your surname («Carlos M.»), your age as a calculated number — never your date of birth —, your city, country and nationality, your experience and its sectors, your English level, your availability, whether you need housing or transport, and a set of seals that only say yes or no: identity verified, driving licence verified, tax identifier verified, whether there is a CV and whether there is a recording.

An agency does not see your full surname, your email, your phone, your address, your IBAN or any of your documents. And it is not that the screen hides them: the database gives it no door to those tables at all, not even partial read access. Its only window is the pseudonymised view. Pseudonymisation is applied inside the database, not by filtering in the browser, and that is the difference between a guarantee and a habit.

There is one single exception, and it is for when there is already a job: your IBAN and your postal address are seen by the agency that has hired you, because without them it cannot pay your wages or register you. That agency and no other, and never before it hires you, not even with your permission. Today Talpass does not ask for either of them, so that case does not happen yet.

To see a document of yours, an agency has to ask you, stating which documents it wants. You grant or refuse. If you grant, the access lasts a limited window, you can revoke it before it ends, and the file is served through a signed link that expires within minutes.

Inside Talpass, the controller can see your data and open your documents in order to verify them: that is what makes the «identity verified» seal mean anything. Those openings are logged exactly like an agency's. There is no internal access that leaves no trace.

The access log

Every time somebody opens a document of yours — an agency with your permission, or the controller reviewing it — a row is written recording which document was opened, by whom, when, from which IP address and with which browser.

That row cannot be written or deleted from the application: the server writes it in the same step in which it signs the link, and there is no way to open a document without leaving a trace. It exists so that what happened can be proven, and it is as much on your side as on ours.

You can ask for the access log of your own documents and you will get it.

Who else is involved, and where your data lives

• Supabase — the database, the storage of your files and the account system. The project is hosted in the eu-west-1 region, in Ireland.
• Vercel — the hosting and execution of the site. The code that touches your data runs in Dublin (dub1), the same region as the database.
• Resend — delivery of the account notification emails.

Your data is processed inside the European Union: the database, the files and the code that reads them are in Ireland. When you upload a document, the file passes through the server before reaching storage, and that server is in the EU too.

Were any provider to process data outside the European Economic Area, the transfer relies on the standard contractual clauses approved by the European Commission.

Your data is not sold, not shared for advertising, and not used to train anything. There is no advertising on this site.

How long it is kept

• Your account, your profile and your documents: for as long as the account exists. When you ask for them to be deleted, they are deleted within 30 days at most.
• The record of what you consented to and when, and the document access log: three years from the closure of the account. It is the proof that the processing was legitimate and of who opened what; deleting it along with the account would leave both sides with nothing to show. It is kept without the name of whoever no longer exists.
• The log of emails sent: one year. It keeps the address it was sent to even after the profile is gone.

These periods are enforced by hand: the project is small and does not yet have a scheduled deletion job that runs them on its own. That changes who enforces them, not the periods themselves. If you believe something of yours should already have been deleted, write and it gets fixed.

Your rights, and where you exercise them

• Access everything held about you.
• Correct whatever is wrong.
• Erase your data.
• Restrict or object to a processing operation.
• Receive your data in a readable file and take it elsewhere.
• Withdraw a consent you have given.
• Complain to a supervisory authority.

Inside the product, right now and without writing to anybody: in «My account» you can correct your name, date of birth, city, English level and experience; withdraw the consent for the English recording with a button; pause your profile so it stops appearing in the pool without deleting anything; and re-upload a document that was rejected.

By email, to kayaosv@gmail.com: full access, portability, deletion of the account, and withdrawal of the mandatory consents — which means closing the account, because without them there is no service left to provide. You get an answer within one month at most.

There is no button yet to delete your account from inside the product. It is pending, and this document will say so the day it exists; until then it is done by email and within the same deadline.

Withdrawing a consent does not make what was done while it was in force unlawful, and it does not delete the row proving you gave it: what is kept is that you granted it and that you withdrew it, with both dates.

You can complain to the data protection authority that covers you. The controller's is the Lower Saxony authority (Die Landesbeauftragte für den Datenschutz Niedersachsen). If you live in Spain, the Agencia Española de Protección de Datos.

Cookies

Talpass uses no analytics, advertising or tracking cookies. That is why you will not see a cookie consent banner: there is nothing to consent to, and putting up a banner asking permission for something that does not happen would be theatre.

The only cookies set are your session cookies, and only once you log into your account: they are what keeps you logged in as you move between pages. Without them there can be no session at all, so they are strictly necessary in the sense of the law.

The public pages of this site set no cookies whatsoever. They are served from cache without ever checking whether you have a session, and they do not even store a language cookie: the language lives in the page address.

Automated decisions

There are no automated decisions and no profiling within the meaning of Article 22 GDPR. Whether a document of yours is valid is decided by a person, and whether you get contacted is decided by an agency.

Minors

This service is not aimed at minors and cannot be used before the age of 18.

When this text changes

Every version of this document carries its date, the one shown at the top. When something changes that affects what you consented to, the version goes up and you are asked again.

Earlier versions are not deleted from the record: what is kept about you is not «accepted the policy», it is which text you accepted and when.