Privacy Policy

The controller under the GDPR is: SkillStamp UG (haftungsbeschränkt) Landstraße 17-19 60325 Frankfurt am Main Germany Represented by the managing directors Paria Firouzpour Email: info@skillstamp.eu Phone: +49 177 8710416

Data protection officer: Erfan Shamabadi

Depending on whether you use SkillStamp as a talent, as an employer or just as a visitor, we process the following data:

• Account data: name, email address, role (talent or employer), language, and the time and version of the terms you accepted. Your password is managed by Amazon Cognito; we do not store it ourselves. If you sign in with Google or LinkedIn, we receive your name and email address from them.
• Profile data (talents): work experience, education, skills, languages, place of residence or preferred work location, job preferences, profile photo, short bio and any links you add.
• CV: the uploaded file and the details automatically extracted from it, which you can review and correct.
• Verification data (talents): your answers in the skills tests (including code) and their scores; technical test events such as tab switches, loss of focus, copy/paste and right-clicks, which we use to protect test integrity; your answers to the work-style and personality questionnaire and the profile calculated from them; your video recording; uploaded evidence such as certificates and diplomas; notes and outcome of the final interview; your verification report.
• Employer data: name and business contact details of the people acting for the employer, company details, job ads and the requirements for the person being sought.
• Matching and application data: matching results, explanations, shortlists, applications, invitations and hire reports.
• Messages: content and timestamps of messages between employers and talents.
• Contact requests: name, email address and content of your request via the contact form or by email.
• Usage and technical data: IP address, browser and device information, access times in server and security logs, and views of public portfolios.
• Cookies and similar technologies: see section 11.

We do not ask for gender, date of birth, ethnic origin, religion, health or disability. Please do not include such details in free-text fields, your CV or your video unless they are needed for your application. A profile photo or video may reveal such characteristics; we do not evaluate them.

• Account, profile, verification, matching, applications, messages, portfolio and service emails: to perform the user agreement and to take pre-contractual steps (Art. 6(1)(b) GDPR).
• Sharing your profile and verification results with employers whose jobs you match or apply to: Art. 6(1)(b) GDPR. This is exactly what you use SkillStamp for.
• Optional analytics (Google Analytics 4) and other non-essential cookies: only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Newsletters and marketing emails also only with consent.
• Strictly necessary browser storage (e.g. sign-in, language, your cookie choice): § 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR.
• IT security, preventing abuse and fraud, test integrity, error analysis and improving our platform: legitimate interests (Art. 6(1)(f) GDPR). Our interest is a secure, fair and working service.
• Invoices and tax-relevant records where paid services (e.g. a success fee) arise: legal obligation (Art. 6(1)(c) GDPR).
• Establishing, exercising and defending legal claims: Art. 6(1)(f) GDPR.

Account data is required to use SkillStamp. We need profile and verification data to verify you and match you with jobs; without it we cannot provide these services. You have no legal obligation to provide it.

We use AI models from Anthropic (Claude) via Amazon Bedrock. Where they are used and where not:

• Skills tests: questions are created with AI, and your answers are scored with AI.
• Work-style and personality questionnaire: a standardised questionnaire based on the International Personality Item Pool (IPIP). It is scored with a fixed formula, without AI.
• Evidence, video and final interview: these steps are reviewed by people on our team.
• A profile only counts as verified once our team has approved all five steps.
• We also use AI to extract details from your CV, draft verification reports and create job ads with employers.

Only verified talents are included in matching. A fixed, rule-based procedure compares your profile with a job's requirements. It considers verified hard skills, work-style and personality fit, work experience, education, soft skills, languages, and location or remote options. For the best-fitting talents, an AI model writes an assessment with reasons.

Before an employer sees an AI-assisted shortlist, a person on our team reviews and approves it. Employers see match tiers and explanations, not raw percentages. Whether an employer contacts, invites or hires you is decided by the employer alone. You can apply to any posted job regardless of matching.

We therefore do not make any decision that has legal effects on you or similarly significantly affects you based solely on automated processing. You can still ask us at any time to explain the reasons for a result, to hear your point of view, to contest a result and to have it reviewed by a person. Write to support@skillstamp.eu.

We use AI systems in the context of employment and recruitment. Regulation (EU) 2024/1689 (AI Act) treats this area as particularly sensitive. That is why AI results are never the sole basis at SkillStamp: people review the verification and every shortlist before it reaches an employer. This page and the platform tell you where AI is involved.

Every talent has a public portfolio page at their own address (e.g. name.skillstamp.eu). It goes online when you finish setting up your profile. Anyone can see the details shown there, such as your name, photo, professional summary, location, work experience, education, projects, skills, languages, certificates, profile links and career video, and search engines can find the page. Your verification results (skill levels and badges) appear there only once your verification is complete. Your email address, phone number, CV and job preferences (e.g. salary expectations) are never shown there. The public portfolio is part of our service to talents; the legal basis is Art. 6(1)(b) GDPR. You can change or remove the details on it at any time in your profile. If you delete your account, the page goes offline.

Employers can write to talents through SkillStamp and invite them to jobs; talents can reply. We store the messages so both sides can see the conversation, and we may notify you of new messages by email. We only access message content where needed for support, security or investigating abuse (Art. 6(1)(b) and (f) GDPR).

We use the consent tool CCM19, loaded from consent.blencode.com, to manage your cookie choices. The company BlenCode GmbH is the operator of consent.blencode.com. The tool stores your choice and only loads optional services after you have consented.

Strictly necessary storage covers your sign-in, your language and your cookie choice. Optional is Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for statistical analysis of how our website is used. Google Analytics is only loaded after you consent; before that Google receives no data from us. Data may be transferred to the USA (see section 13).

You can change or withdraw your consent at any time with effect for the future via the cookie settings.

We only share data where this is necessary for the purposes above. We have concluded data processing agreements under Art. 28 GDPR with our processors.

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: operation of the platform in the AWS Frankfurt region (eu-central-1), including hosting (AWS Amplify, AWS Lambda, Amazon API Gateway), database (Amazon Aurora PostgreSQL), cache (Amazon ElastiCache), file storage for CVs, videos and documents (Amazon S3, Amazon CloudFront), sign-in (Amazon Cognito), email delivery (Amazon SES) and logs (Amazon CloudWatch).
• Amazon Bedrock (also AWS): runs Anthropic's AI models through an EU inference profile, i.e. in AWS data centres within the EU. According to AWS, inputs and outputs are neither shared with Anthropic nor used to train the models.
• Google and LinkedIn: only if you sign in with these services. They are independent controllers for this; their privacy notices apply.
• Google Ireland Limited: Google Analytics 4, only with your consent (see section 11).
• Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing, only if paid services are booked. Verification is free during launch, so no payment data is currently processed for it.
• Employers on SkillStamp: receive your profile and verification data as part of matching, applications and messages. They process this data as independent controllers for their own hiring process.
• Authorities and courts: only where we are legally obliged.

We process your data in the EU as a rule. Some service providers belong to groups headquartered in the USA (Amazon, Google, Microsoft/LinkedIn). Access from the USA therefore cannot be fully ruled out, and Google Analytics may transfer data to the USA. These companies are certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); EU standard contractual clauses (Art. 46(2)(c) GDPR) are also in place.

We keep personal data only as long as needed for the purpose or as required by law:

• Account, profile, verification, matching and message data: as long as your account exists. A verification is valid for 12 months; the results stay in your account afterwards until you delete it.
• After you delete your account: your name, email address and profile details are deleted or anonymised immediately. Other content such as uploaded files, videos, test answers and messages is deleted within 30 days at the latest.
• Database backups: overwritten on a rolling basis and deleted after 30 days at the latest.
• Server logs: usually after 7 days; logs of background jobs after 30 days.
• Security and audit logs containing IP addresses: they are removed after 30 days.
• Contact requests: once fully handled, at the latest after 1 year.
• Invoices and tax-relevant records: up to ten years (§ 147 AO, § 257 HGB).

Data is encrypted in transit (TLS). Our database and file storage are encrypted at rest. Only staff who need verification data for the review can access it.

You have the right to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR); you can change most details yourself in your profile
• erasure (Art. 17 GDPR); you can delete your account yourself in your settings
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR); on request you receive your data in a common machine-readable format
• object to processing based on our legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)
• an explanation, to state your point of view and to a human review of AI-assisted results (see section 7)

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Because our registered office is in Frankfurt am Main, the authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1 65189 Wiesbaden, Germany https://datenschutz.hessen.de

You can also contact the authority where you live or work.

We update this privacy policy when our platform or the law changes. The version published here applies; we inform registered users of material changes by email.