Privacy Policy

Last updated: 27 April 2026 — Version 1.6 (V2.4c bidirectional Kombo sync + GDPR Art. 5.1.c minimisation clarifications)

1. Introduction

This Privacy Policy describes how CareerToolbox.AI (hereinafter "we", "our" or "the Service") collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and Belgian law.

We are committed to protecting your privacy and to processing your data in a transparent, lawful and secure manner.

2. Data Controller

Identity: Sivel Labs SRL
Address: La Hulpe, Belgium
BCE No.: BE 1037.283.356
Email: dpo@careertoolbox.ai
DPO: dpo@careertoolbox.ai

3. Data Collected

3.1 Identification data

3.2 Professional data (Candidates)

3.3 Professional data (Recruiters)

3.4 Technical data

3.5 Video data (Simulated interviews — opt-in)

Important:

• This feature is disabled by default — explicit activation by the user is required
• The video stream is analysed locally on the user's device (MediaPipe, Google, open-source) — no video data is transmitted to our servers
• A single image is sent to the server for environment assessment, analysed by the OpenAI Vision API, then immediately deleted (not stored)
• No video recording is performed or retained

3.6 Payment data

Payment data (bank card) is processed directly by Stripe and is not stored on our servers.

3.7 AI Pre-Screening Interview

When a recruiter sends you an invitation to a pre-screening interview:

Data collected: Your voice (real-time audio), the interview transcript, your CV (if available on the platform), and voice analytics (speaking duration, word count).

Processing: An assessment report is generated automatically by artificial intelligence (GPT-5.2). This report includes scores (0-100) on 6 dimensions, a recommendation, and quotes from the interview. This report is sent to the recruiter.

Processors: Your audio data is processed in real time by Google (Gemini Live service, United States). The report is generated by OpenAI (GPT-5.2, United States). These transfers are governed by Standard Contractual Clauses.

Your rights: You can access your assessment report and request rectification or deletion of your data. You have the right to contest a decision based on this report (Art. 22 GDPR).

Retention: Interview data is retained for 6 months after completion. The report is retained for 12 months.

Consent: Before starting the interview, you must accept the conditions for processing your data. You may refuse without consequence.

3.8 Intake Meeting Recorder

When a recruiter records an intake meeting (needs gathering with a hiring manager):

Data collected: Audio recording of the meeting (via browser tab capture, file upload, or microphone dictation), the full transcript with speaker identification, and job fields extracted automatically by AI.

Processing: The audio is transcribed by OpenAI (model gpt-4o-transcribe-diarize) with diarisation. Job fields (title, skills, salary, etc.) are extracted by GPT-5.2. The recruiter reviews and adjusts the data before creating the job description.

Processors: OpenAI (United States) for audio transcription and field extraction. These transfers are governed by the existing Standard Contractual Clauses.

Retention: Audio recordings are retained for 90 days or until deleted by the recruiter. Transcripts and extracted data are retained for the duration of the account.

Legal basis: Legitimate interest (Art. 6.1.f) — optimisation of the recruitment process. The recruiter is responsible for informing meeting participants that the meeting is being recorded.

3.9 Recruitment email sequences (Email Sequences)

When a recruiter uses email sequences to contact candidates automatically:

Data collected: Candidate's email address and name, current step in the sequence, tracking data (email opens via tracking pixel, link clicks, replies received).

Processing: Emails are sent automatically according to a schedule defined by the recruiter. A transparent tracking pixel (1x1 pixel) is embedded to detect opens. Links are wrapped for click tracking. IP addresses are not stored; only a hash is retained in the events.

Unsubscribe: Every email contains a mandatory unsubscribe link (GDPR). Unsubscribing immediately stops the sequence for that candidate.

Retention: Sequence data (enrolments, events) is retained for the duration of the account. Aggregated statistics are anonymised.

Legal basis: Legitimate interest (Art. 6.1.f) — recruitment outreach, with right to object via unsubscribe.

3.10 Interview Scheduling

When a recruiter uses the interview scheduling system:

Data collected: Candidate's name and email address, date and time of the interview, type of interview, video conference link, recruiter's notes, candidate's time zone.

Self-scheduling: When a self-scheduling link is sent, the candidate accesses a public page displaying available slots. Only the name and email are required for booking.

Calendar synchronisation: Interview data may be exported in ICS format or via Google Calendar/Outlook links. No bidirectional synchronisation is performed.

Reminders: Automatic reminders are sent 24 hours before the interview to both parties.

Retention: Interview data is retained for 1 year after the interview date, then anonymised.

Legal basis: Legitimate interest (Art. 6.1.f) — organising the recruitment process, with a right to object (Art. 21). Balancing test documented in the records of processing activities (Art. 30) — available to the supervisory authority. The candidate booking a slot via the self-scheduling link relies on this same basis (a voluntary act within the recruitment process).

3.10.bis Public applications via agency storefronts (Public Apply)

When a candidate applies directly from a client agency's public storefront (for example sivel-labs.be), the application is processed under the ATSIQ-for-agency regime.

Responsibility (processing — Art. 28 GDPR): the agency receiving the application is the data controller and Sivel Labs SRL (BCE BE 1037.283.356) acts as a processor (Art. 28 GDPR) for this application flow. The agency determines the purposes and means (selection, the rest of the recruitment); Sivel Labs SRL operates the technical platform (collection, storage, security, transmission) on behalf of and on the instructions of the agency. A joint-controller qualification (Art. 26) does not apply to this application flow: active sourcing follows the same qualification (agency as controller, Sivel Labs SRL as processor — Art. 28).

Essence of the processing arrangement (Art. 28.3): Sivel Labs SRL processes the application data only on the documented instructions of the controller agency, handles collection, storage, security and technical transmission of the application, and does not use that data for any other purpose. The recipient agency remains the data controller for assessment of the application, communication with the candidate and the rest of the recruitment (interview, hiring decision, long-term retention in its talent pool). The candidate may exercise their rights (access, rectification, erasure, restriction, objection) with the controller agency; the point of contact for exercising rights is the brand DPO of the audience: for an application via an agency storefront (ATSIQ context), dpo@atsiq.io (a monitored alias of Sivel Labs SRL's single DPO), who relays the request to the controller agency. A data processing agreement (DPA, Art. 28 GDPR) between Sivel Labs SRL and each agency is being established (an annex to the agency's B2B terms); its applicable version will be communicated once finalised.

Data collected: name, email, phone (optional), CV (PDF/DOCX), cover message, origin page (referer URL), timestamp, hashed IP (anti-abuse audit).

Processing: An application (unified_candidacies) is created in the targeted agency's recruitment pipeline. The recruiter receives an email notification with the CV. The candidate receives a confirmation email. The AI analysis of the CV runs by default under legitimate interest (Art. 6.1.f GDPR); the candidate is informed of it and has a right to object (Art. 21 GDPR), exercisable at any time, without any consequence for their application.

Retention: 2 years after the application is closed (automatic purge). For applications converted into active pipeline follow-up: the duration of the recruitment process.

Legal basis: Pre-contractual measure (Art. 6.1.b GDPR) — storing and transmitting the application to the agency is necessary at the candidate's request (to apply). The box shown before submit is an information / acknowledgement (Art. 13), not a blocking consent: the Art. 6.1.b legal basis is applied and journalled in every case. The AI analysis of the CV, when offered, rests on legitimate interest (Art. 6.1.f GDPR) with information (Art. 13) and a right to object (Art. 21 GDPR), not on opt-in consent.

Rights: Access, rectification, erasure, restriction and objection, exercisable with the brand DPO (dpo@atsiq.io) or the agency's DPO (link in the confirmation email). Response within one month; this period may be extended by two months where the request is complex or numerous, with reasoned information provided within the first month (Art. 12.3 GDPR).

3.10.ter Interest Talent Pool (Interest Pool for positions opening soon)

When an agency has opted in to this flow (administrative toggle), candidates can signal their interest in a position opening soon (placeholder) without creating an official application. As with the public application (§ 3.10.bis), the agency is the data controller and Sivel Labs SRL acts as a processor (Art. 28 GDPR) of this interest signal; the AI scoring described below rests on legitimate interest (Art. 6.1.f) with a right to object (Art. 21), without opt-in.

Data collected: name, email, phone (optional), CV (PDF/DOCX), cover message, origin page, timestamp. On each interest signal, an event is added to the profile history (job concerned, date).

AI processing (high risk Annex III §4): The CV is analysed by AI (Anthropic Claude) to extract technical skills. These skills feed an automatic matching score that helps the recruiter identify profiles matching their open positions. The recruiter can then explicitly invite the candidate to apply officially when a position opens (via a signed email link).

Important: AI scoring assists the recruiter and never excludes a candidate (the AI informs, the recruiter decides). The candidate may object to the AI analysis at any time, without justification and without consequence: their profile stays in the pool and visible to the recruiter. The "Contact us" button remains available for an exchange with no AI processing. This choice is presented clearly before each submit.

Automated decision (Art. 22 GDPR): The AI score is NOT an automated decision — it is decision support. The recruiter makes the final invitation decision. The candidate may contest a score via a support ticket categorised ai_contestation.

Retention: 2 years after last activity (last_activity_at), under storage limitation (Art. 5.1.e GDPR); an organisation may shorten this period, never extend it. Daily cron for automatic purge if there is no active candidacy AND no linked CT account.

Legal basis: Legitimate interest of the agency (Art. 6.1.f GDPR) for the AI analysis of the CV and matching — the analysis runs by default, without opt-in. The data subject is informed (Art. 13-14 GDPR) and has a right to object (Art. 21 GDPR), exercisable at any time, without exclusion from the pool.

AI processors: Anthropic (Claude) in the US with a signed DPA (retention 0d, training off). All PII is anonymised before transmission to the AI (emails, phones, URLs, national numbers masked).

Rights: Immediate deletion on request via the "Delete my data" link present on every email (confirmation, invitation, reminder). A dedicated DPIA is available on request to the DPO. See also docs/legal/DPIA-interest-pool.md.

3.11 Application source tracking (Source Tracking)

We record the origin of each application in the recruitment pipeline (e.g. LinkedIn, careers page, referral, job board). This data allows recruiters to analyse the performance of their sourcing channels and optimise their recruitment budget.

Data collected: Origin channel, source detail (job board name, referrer name), cost associated with the channel.

Retention: Duration of the recruiter's account.

Legal basis: Legitimate interest (Art. 6.1.f) — optimisation of the recruitment process.

3.12 Placement and invoicing tracking (Placement & Invoicing)

When a recruiter closes a placement (successful hire), we record the data necessary for invoicing and contract follow-up: fee amount, currency, calculation method, signing fees, guarantee fees, payment terms.

Data collected: Identity of the placed candidate, identity of the employer, job title, start date, fee amount excl. VAT, currency, calculation basis (% of annual salary or fixed amount), guarantee terms, collection status.

Retention: 10 years (Belgian accounting obligation — Code of Economic Law Art. III.86) then anonymised archiving for traffic analysis.

Legal basis: Performance of contract (Art. 6.1.b) + legal accounting obligation (Art. 6.1.c).

3.13 Placement agreements — electronic signatures (E-Signature BYOK)

For placement agreements (tripartite contracts between recruiter / employer / candidate), CareerToolbox offers electronic signature via a third-party provider configured by the agency: Yousign, DocuSign or DocuSeal. CareerToolbox is not the publisher of these services — the recruitment agency contracts directly with the provider (the "BYOK" model, Bring Your Own Key) and supplies its own API key. Signed documents transit directly between CareerToolbox and the provider chosen by the agency, with no intermediary.

Data collected: Document to be signed (DOCX converted to PDF), identity of signatories (first name, last name, email), signing status, URL of the signed document, envelope identifier on the provider side.

Stored API key: Encrypted at rest using Fernet (cryptography lib) with a server-specific derived key. Full audit trail (creation / rotation / revocation) in org_credential_audit_log.

Third-party processors (chosen by the agency): Yousign SAS (FR), DocuSign Inc. (US — SCCs + DPF), DocuSeal Ltd. (UK — self-hosting available).

Retention: As long as the agreement remains active + retention period required by the provider (typically 10 years for Yousign / DocuSign for eIDAS compliance).

Legal basis: Performance of contract (Art. 6.1.b) — electronic signature compliant with EU eIDAS Regulation 910/2014.

3.14 Client portal (Client Portal — read-only access without a CareerToolbox account)

By recruiter invitation, an employer contact can access a read-only portal to view their ongoing placements and invoices, without creating a CareerToolbox account. Access is managed via a unique magic link (256-bit token) sent by email.

Data collected: Email address of the invitation recipient, name (optional), access token, access timestamps (last_accessed_at, access_count) for audit purposes.

Data displayed to the recipient: List of ongoing placements and invoices for their employer organisation only — no access to the placements of other agency clients or to internal data (recruiter notes, margins).

Retention: Token active until expiry (90 days by default) or manual revocation. Audit trail retained for 10 years.

Legal basis: Legitimate interest (Art. 6.1.f) — transparency of the recruitment process toward the end client.

3.15 Placement feedback (Placement Feedback — 30 / 60 / 90 days)

30, 60 and 90 days after a placed candidate's start date, CareerToolbox automatically sends both the candidate AND the line manager a feedback form accessible via a unique magic link (256-bit token, hashed server-side at rest using SHA-256). No CareerToolbox account creation is required — the token IS the authentication boundary ("magic link" model), valid for a single submission, automatically expiring and traceable per-IP + per-User-Agent for audit. The form is optional — the recipient can ignore the email without consequence.

Data collected: Ratings (0-10 scale), free-text comments, "is the candidate still in post?" status, recommendation. The submitter's IP address and User-Agent are recorded in the audit log for compliance (proof of identity for the response).

Retention: All feedback-related data (qualitative responses + IP + User-Agent + submission timestamp) is purged 18 months after submission (or 18 months after token expiry for unanswered requests) by the daily cron POST /api/cron/feedback-purge — constant _RETENTION_DAYS = 540 in api/routes/placement_feedback.py. This duration applies the storage limitation principle (Art. 5(1)(e) GDPR): short enough to avoid indefinite accumulation, long enough to enable retroactive analysis of placement incidents (guarantee disputes, candidate challenges) which generally arise within 12 months of the start date. After purge, individual data is permanently and irreversibly deleted — the recruiter dashboard computes its indicators (NPS, 90-day retention rate, etc.) only on feedback still present within the 18-month retention window.

Phishing resilience: If the token is leaked (e.g. forwarded email), CareerToolbox applies two complementary protections: (a) feedback submission is single-shot — the token is automatically invalidated after the first valid submission (completed_at lock in the database), no overwriting of the legitimate response is possible; (b) a rate limit of 10 submissions per hour per token, plus 30 reads per hour per IP, mechanically limits abuse attempts in the event of a leak. The legitimate recipient may nevertheless contact dpo@careertoolbox.ai to request a new token in the event of a confirmed incident.

Legal basis: Legitimate interest (Art. 6.1.f) — improving placement quality, measuring retention. Explicit right to object via unsubscribe link in every email.

3.16 Kombo ATS Synchronisation (Kombo BYOK)

If the agency connects its applicant tracking system (ATS — Greenhouse, Lever, Workable, etc.) via Kombo, CareerToolbox synchronises candidates and job openings daily between the two systems to avoid double data entry. As with electronic signing, the agency holds the Kombo API key (BYOK model) — CareerToolbox does not store any candidate data inside Kombo, but can read the agency's ATS data.

Synchronised data (strict allowlist — minimisation Art. 5.1.c): For candidates: identity (name, email), pipeline status, job title, ATS-side update date. For job openings (V2.4c, since 2026-04-27): title, job description (max. 5,000 characters), status (open/closed), location. No compensation information, no internal notes, no sensitive data (GDPR Art. 9). Any other Kombo field is ignored by CareerToolbox.

Synchronisation direction (V2.4c bidirectional): (1) The daily cron POST /api/cron/kombo-sync triggers a pull Kombo → CareerToolbox for the candidates and job openings of every client organisation with active credentials. (2) The webhook POST /api/webhooks/kombo receives in real time the events candidate.created/updated and (V2.4c) job.created/updated and applies the configured conflict policy. No CareerToolbox data is automatically pushed to Kombo — the synchronisation direction is read-only from Kombo.

Conflict policy: Default manual_review — any discrepancy between the ATS and CareerToolbox is queued (kombo_sync_conflicts) for admin decision via the daily email digest (template kombo_conflicts_digest). Alternative policies: kombo_wins (UPDATE applied automatically on the CareerToolbox side — traceable via kombo_audit_log) or ct_wins (Kombo modification ignored). For new job openings (never seen on the CareerToolbox side), the rule is always kombo_wins (automatic creation — no overwrite risk).

Traceability: Every automatic update applies the suffix "system_kombo" in creator_id + an entry in kombo_audit_log with UTC timestamp, record identifier and a summary of changed fields. Manually resolved conflicts retain the identifier of the admin who decided.

Processor: Kombo SAS (FR) — https://kombo.dev/privacy.

Legal basis: Legitimate interest (Art. 6.1.f) — data consistency between recruitment tools used by the same team. Balancing test documented in the records of processing activities (Art. 30) — available to the supervisory authority.

3.17 Timesheets (Timesheets — temporary / contracting placements)

For temporary or contracting placements, the recruiter records the candidate's hours, client billing rate and internal cost rate weekly. This data feeds weekly / monthly invoicing.

Data collected: Week start date, hours worked, hourly rate (charge / cost), calculated margin, status (draft / submitted / approved / invoiced / paid), reason for rejection where applicable.

Audit: Each state transition (submission, approval, rejection) writes an audit entry with timestamp, actor identity, IP address and User-Agent — compliance with Belgian temporary employment law (Belgian Act of 24 July 1987 on temporary employment).

Retention: 10 years (accounting obligation + employment law).

Legal basis: Performance of contract (Art. 6.1.b) + legal obligation (Art. 6.1.c).

3.18 Temp→perm conversion (Phase 13 V2.2)

When a temporary placement is converted to a permanent contract, CareerToolbox calculates an additional fee using a method negotiated with the client (five methods: prorated_months, hours_credit, margin_offset, flat_fee, free) and issues a placement_conversion invoice. A guarantee period restarts according to the configured basis (from the conversion date / from the original temp start / no guarantee).

Data collected: Conversion method, top-up rate, calculated amount, guarantee basis, identifier of the approving manager (if the dual-validation threshold is exceeded), transition history.

Retention: 10 years (accounting obligation).

Legal basis: Performance of contract (Art. 6.1.b) + legal obligation (Art. 6.1.c).

3.19 Inter-agency cooperation and fee split (Phase 14)

CareerToolbox enables two recruitment agencies to cooperate on the same placement via a fee split agreement. One agency (the Lead Agency) holds the contract with the end employer, the other (the Source Agency) provides the candidate. Fees are shared according to a negotiated percentage.

GDPR qualification — EDPB Article 26: Both agencies are qualified as joint controllers (Article 26 GDPR). There is no controller / processor relationship under Article 28 between the agencies. For this fee-split sub-flow only, Sivel Labs SRL (operating the CareerToolbox.AI / ATSIQ brands) acts as an Article 28 processor for each agency on the fee split. This is a distinct and named flow: it must not be confused with the public application flow (§ 3.10.bis), where Sivel Labs SRL is a processor (Article 28) for the controller agency.

Transmission of candidate data — named consent: When the Source Agency transmits a candidate's data to the Lead Agency, the candidate must give explicit, named consent (Article 6(1)(a) GDPR). The notice mentions the name of the recipient Lead Agency and the specific position. Standard wording: "Your data will be transmitted to Lead Agency XYZ for the position ABC". The candidate may withdraw consent at any time via the dedicated portal.

Data collected: Partner agency identifier, VAT number, IBAN, primary contact, jurisdiction, share percentages, billing mode (strict NPA / flexible co-billing), guarantee mode, NDA cascade visibility mode, documented Article 26 arrangement between the two agencies.

Cross-tenant Cooperation Token: If both agencies are CareerToolbox customers, a UUID v4 Cooperation Token (30-day validity, single use) allows the second agency to mirror the agreement in its tenant. Strict anti-forge + anti-self-accept + anti-replay.

Intra-EU VAT invoicing: For inter-agency intra-EU invoices, the mandatory mention "Reverse charge VAT — Article 196 Directive 2006/112/EC" is added automatically (4 languages). Invoices are issued excluding VAT — the recipient (Lead Agency) reverse-charges the VAT in its own return.

Retention: 10 years (accounting obligation + employment law). Withdrawal of candidate consent cascades to delete consent_records.consent_type='fee_split_transmission' records.

Legal basis: Performance of contract (Art. 6.1.b) between the agencies + explicit named consent (Art. 6.1.a) for candidate data transmission. Dedicated Phase 14 DPIA validated by the internal DPO.

3.20 Career Star Map / Career Discovery

Purpose: The "Career Star Map" feature uses AI to suggest an interactive visualisation of your possible career trajectories, based on the skills extracted and the role inferred from your CV. You can explore 5 sectors (Dev / Data / DevOps / Cyber / Product) and up to 15 personalised target roles.

Data processed: skills (skill_graph — names and proficiency scores extracted from your CV), inferred role, generated trajectories (target role titles, compatibility scores, narratives, suggested skill gaps, recommended certifications, anonymised salary ranges based on market aggregates), preferences (active target path active_target_path_id + milestone log path_progress_json if you activate a goal).

Automated decision (Art. 22 GDPR): generation is AI-automated (gpt-5.2). However, no irreversible legal or contractual decision is taken automatically: trajectories are informational and every concrete action (apply, take a course, mock interview, set a primary goal) remains at your initiative. You can request a human review via support at any time — a human Sivel Labs Talents mentor will respond within 48 working hours.

Article 50 EU AI Act transparency: on every generation, a visual notice (ai-disclaimer) reminds you the content is AI-generated. The "Why this suggestion?" button in the Path Detail drawer exposes the compatibility formula (50% skill_match + 30% exp_match + 20% market_align) and the detailed breakdown.

External sub-processors: OpenAI Inc. (USA) — for narrative + skill_gaps + cert_recs generation. Data transmitted: skills (anonymised names), target role, inferred role, locale. No identification data (email, name, phone, address) is transmitted. Safeguards: OpenAI DPA + EU Standard Contractual Clauses (SCCs), see SUBPROCESSORS.md § OpenAI.

Retention: active Star Maps 12 months after last activity ; history (superseded versions) 5 years ; automatic purge beyond ; cascade purge on account deletion.

Your rights: access (Art. 15) via /api/account/gdpr/export · rectification (Art. 16) by regeneration (max 3 / hour) · erasure (Art. 17) on account deletion or explicit request · restriction (Art. 18) candidate-controllable feature flag · portability (Art. 20) JSON export · objection (Art. 21) — the Star Map is NOT created until you click "Generate my Star Map" · automated decision (Art. 22) human review via support.

Costs and quotas: 5 credits per generation (3 if skill_graph is fresh < 30 days, smart cache). Rate-limit: 3 regenerations / hour / user (LLM abuse prevention ; average cost ≈ €0.001 per generation).

Legal basis: Performance of contract (Art. 6.1.b) + explicit consent (Art. 6.1.a) — you trigger generation yourself. Dedicated Career Discovery DPIA drawn up (Art. 35 GDPR) and kept internally: copy available on motivated request to dpo@careertoolbox.ai.

4. Purposes of Processing

We process your data to:

1. Provide the Service: Create and manage your account, deliver features
2. Improve the Service: Analyse usage, fix bugs
3. Communicate: Send notifications, respond to your requests
4. Bill: Manage subscriptions and payments
5. Secure: Detect fraud, protect against abuse
6. Comply with the law: Legal obligations, requests from authorities

5. Legal Bases

6. Recipients of Data

6.1 Technical processors

Internal self-hosted tools: CareerToolbox.AI may process usage, diagnostic or log data in internal tools operated by us on our OVH infrastructure. These tools are not third-party recipients: no data is sent to the software publishers when the instance is self-hosted. The relevant external processor for this hosting remains OVH, already listed above.

Note on the BYOK (Bring Your Own Key) model: for Yousign / DocuSign / DocuSeal / Kombo, the client agency contracts directly with the provider and supplies its API key to CareerToolbox. CareerToolbox stores this key encrypted at rest (Fernet) and uses it solely to transmit documents / synchronise data on behalf of the agency. CareerToolbox does not bill these providers and does not act as a commercial intermediary — the contractual relationship remains between the agency and the provider.

6.2 Audio transcription (cloud API)

Transcription and diarisation are performed via the OpenAI cloud API (model gpt-4o-transcribe-diarize). Audio data transits OpenAI's servers in the United States, under the existing DPA (Data Processing Agreement) with OpenAI. OpenAI does not retain audio data and does not use it to train its models (API usage policy).

6.3 Client-side AI models (processing on the user's device)

These models run entirely on the user's device (browser). No video data is transmitted to our servers or to Google. Activation is optional (explicit opt-in).

6.4 Transfers outside the EU

Some processors are located in the United States. These transfers are governed by:

• The European Commission's Standard Contractual Clauses
• Additional security measures

6.5 Document OCR (images)

When a user uploads a document as an image (JPEG, PNG, WebP), the image is sent to the OpenAI Vision API for text extraction (OCR). This processing is identical to sending text extracted from PDF/DOCX files — the document content transits OpenAI under the existing DPA (Data Processing Agreement). The image is processed and not retained by OpenAI.

6.6 Data transmitted to OpenAI — Transparency

Texts (CVs, transcripts, job descriptions): Text extracted from your documents (PDF, DOCX) is processed before being sent to OpenAI — email addresses, phone numbers, LinkedIn and GitHub profile URLs, IBAN numbers, social security numbers and national ID numbers are automatically masked, then restored in the final result.

Documents uploaded as images (JPEG, PNG, WebP): When a document is uploaded as an image, the image is transmitted in full to the OpenAI Vision API for text extraction (OCR). The image is not anonymised before being sent — personal data visible on the document (name, contact details, photo, etc.) is transmitted as is. This transmission is necessary because text extraction can only be performed from the original image.

All these transmissions are governed by the DPA (Data Processing Agreement) signed with OpenAI. In accordance with OpenAI's API usage policy, data transmitted via the API is not retained by OpenAI and is not used to train its models.

7. Retention Period

At the end of these periods, data is deleted or anonymised irreversibly.

Integrity hash of deleted PII: to prove that an erasure request (Art. 17) has been executed, we retain a cryptographic hash (SHA-256) of the deleted data in our audit logs. The hash does not allow the original data to be reconstructed — it serves only as proof of integrity in case of a subsequent audit.

7.bis AI-assisted decisions (EU Regulation 2024/1689 — AI Act)

Our platform uses artificial intelligence models (OpenAI, Anthropic) to assist recruiters in certain decisions:

• CV pre-screening: skills extraction, position fit scoring
• AI Screening interview rating: transcript analysis and report generation
• Placement suggestions: candidate-job matching
• B2B enrichment of employer contacts: automated lookup of public professional contact details (see § 7.ter below)
• Structured extraction of inbound jobs: parsing of emails and webhooks to automatically create job openings from client data (from Sprint 4 / Phase 4)

In accordance with EU Regulation 2024/1689 on AI (effective 2026), we inform you that:

• No final recruitment decision is made automatically by AI — a human recruiter systematically validates
• You may request an explanation of AI recommendations concerning you (dpo@careertoolbox.ai)
• You may object to an automated decision that has legal effects (Art. 22 GDPR) by contacting our DPO
• AI processors are listed at /legal/subprocessors.html with their jurisdiction and the legal basis of the transfer

7.ter Automated sourcing and enrichment of contacts (indirect sources)

Purpose: (a) candidate sourcing — identify relevant public professional profiles for a position and find a professional email address to make contact; (b) enrichment of employer contacts — allow agencies subscribed to the Enterprise Premium plan to pre-fill employer-client contact records (HR managers, hiring managers) from a public professional database.

Active processors: Coresignal (Coresignal UAB, EU/Lithuania) — aggregation of public professional profiles for candidate sourcing; hosted in the EU, no transfer outside the EU. Hunter.io (France/USA) — professional email lookup from a name + company; the transfer to the US component is governed by the Standard Contractual Clauses (SCCs). Apollo.io, Inc. (United States), initially considered for employer-contact enrichment, is currently inactive (deferred — multi-tenant ToS) and is not used for any production processing. In accordance with EU AI Act 2024/1689 Article 13 (transparency), these operations may constitute AI-assisted processing; see /legal/subprocessors.html for the DPAs and transfer details.

Collection sources for candidate profiles — the list below is the system's provider registry, and it is exhaustive: a source that is not listed here cannot be queried. GitHub (GitHub, Inc., United States) — active: read access to the public GitHub API, on developer profiles the person has made public themselves; no personal data about them is transmitted to that service. Coresignal (Coresignal UAB, EU/Lithuania) — active. Stack Overflow — inactive (removed from the registry; the system no longer queries it). Apollo.io, Inc. (United States) — inactive (deferred — multi-tenant ToS). Hunter.io (France/United States) is not a profile source: it only performs professional email enrichment. The source that concerns you is the one behind YOUR collection, and it is that one — and only that one — that is named to you in the Art. 14 notice you receive.

Enriched data (from the contact's name + company):

• Professional contact details: email, direct phone (if available), LinkedIn profile
• Job title, department, seniority
• Public company contact details: registered office, sector (NACE), size, social profiles

Data explicitly EXCLUDED (data minimisation Art. 5.1.c): no government identifier, no biometric data, no inferable health data, no private non-professional data.

Legal basis: legitimate interest (Art. 6.1.f GDPR) for candidate search and regulated B2B outreach (professional recruitment). The person has a right to object (Art. 21 GDPR) exercisable at any time via dpo@careertoolbox.ai — an objection (Art. 21) causes the record to be deleted; a retention opt-out, which is a different request, causes it to be anonymised, with the return key preserved.

Information to the person (Art. 14 GDPR): on the first transactional email sent to the person, a link to this policy is included, mentioning the actual source of the data for that person — the one that was in fact used for their collection, among the sources listed above, and not a list of providers — together with the right to object.

Reserved for recruiter Premium plans: the feature is included for Freelance Premium and Enterprise Premium. No credit charge is applied — usage is included in the subscription, within provider quotas and the applicable fair use.

Impact assessment (DPIA, Art. 35 GDPR): dedicated impact assessments are documented for candidate sourcing (DPIA_AUTO_SOURCING) and for employer-contact enrichment (/docs/audits/2026-04-26-ws024-dpia-apollo.md) — available on request from the DPO.

Retention: enrichment data is stored in the enrichment_data_json field of the record. Upon an erasure request (Art. 17), this field is cleared together with the other PII (GDPR cascade).

Retention — candidate profile obtained through sourcing: three periods, and it is the stage the profile has reached that decides which one applies — never the recruiter's interest. (a) For as long as the profile is linked to no job — it has merely been collected — it is kept for 30 days by default ("inform or anonymise", Art. 14(3)(a)): that is a configuration value and not a cap — it is bounded between 7 and 365 days, which is the longest this rail can ever reach. That rail is effective: a profile nobody links to a job is anonymised at its term. (b) As soon as the profile is linked to a live job — added to a role's pipeline, "considered for a job", consolidated from a non-terminal candidacy, or retained for a role — it is that link, not the issuing of a notice nor its delivery, that moves the profile onto the 2-year talent-pool rail (730 days) from the DATE OF THE LINKING GESTURE (the date the person was attached to the job), applied extend-only — an already later deadline is never shortened. The Art. 14 notice informs; it decides no duration, and the absence of a channel never withholds retention. (c) A unilateral outreach left unanswered opens no longer period: it moves the profile's deadline to 180 days where that deadline is shorter, a value bounded in code between 30 and 180 days — no setting can exceed it. It applies extend-only: an already later deadline is never shortened, so a profile already LINKED TO A LIVE JOB — or already carrying a later deadline — stays on the 730-day talent-pool rail described in (b). The talent-pool clock is renewed only by a signal from the person themselves (a reply to an outreach, an application, the granting of a representation mandate): the recruiter's internal activity — viewing, shortlisting, adding to a list — never moves the clock. Automatic anonymisation on expiry — identifying data is erased, the record is never deleted; the right to object (Art. 21) may be exercised at any time.

8. Your Rights (GDPR)

• Right of access (Art. 15): Request a copy of your data
• Right to rectification (Art. 16): Correct your data
• Right to erasure (Art. 17): Request deletion ("right to be forgotten")
• Right to portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interest
• Right to restriction (Art. 18): Request suspension of processing in certain cases

Exercising your rights

Online: From your account, "My data" section
By email: dpo@careertoolbox.ai
By post: Sivel Labs SRL, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium
Response time: 30 days. For complex requests, this period may be extended by 60 days.

Complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (APD):

• Website: www.autoriteprotectiondonnees.be
• Email: contact@apd-gba.be

9. Cookies

Essential cookies

These cookies are necessary for the operation of the Service (GDPR legal basis: contract performance — Art. 6.1.b):

• ct_session: Authentication (legacy cookie; expiry: 7 days)
• ct_access_token: OAuth 2.1 authentication (HttpOnly, SameSite=Lax; expiry: 7 days during transition)
• ct_refresh_token: Authentication token rotation (HttpOnly, SameSite=Strict, scope: /api/auth/; expiry: 30 days)
• csrf_token: CSRF protection (expiry: 24 hours)

OAuth 2.1 refresh tokens (since 5 May 2026)

To improve account security, CareerToolbox.AI uses the OAuth 2.1 protocol with automatic access token rotation. Concretely:

• Maximum lifetime: 30 days after your last sign-in. Beyond that you must re-authenticate with your password.
• Automatic rotation: every authentication request mints a fresh token and invalidates the previous one. This limits the blast radius of any potential compromise.
• Theft detection (family compromise): if an already-consumed token is presented again (a signature of theft), the ENTIRE family of sessions is auto-revoked and you are signed out.
• Storage: only an HMAC-SHA256 hash of the token is kept server-side; the plaintext token is never stored.
• User-controlled revocation: you can review and revoke active sessions at any time from "Settings > Security > Active sessions".

Analytics cookies (PostHog self-hosted, strict opt-in)

Since May 2026, CareerToolbox.AI uses a self-hosted PostHog instance for product analytics. No data is transmitted to any third party; the PostHog server is operated by Sivel Labs SRL on the same infrastructure as the Service.

• GDPR legal basis: explicit consent (Art. 6.1.a) — strict opt-in via the cookie banner.
• Cookie set on consent: ct-cookie-consent (JSON {essential, analytics, session_replay, consented_at}, expires after 12 months).
• PostHog cookie (if analytics enabled): ph_* (pseudonymised identifier, expires after 12 months).
• Collection configuration: IP masked (mask_ip=true), Do Not Track respected, autocapture limited to clicks and page changes, event retention 12 months maximum.
• "Session replay" category (additional opt-in): if enabled, PostHog records the navigation sequence without capturing input field contents (the maskAllInputs:true option replaces all <input>, <textarea> and elements marked .pii with asterisks). Retention: 30 days.
• No third-party sharing: no data is sold, shared, or transmitted to ad platforms or data brokers.

You can withdraw consent at any time via the "Cookies" link in the footer: opting out immediately stops collection and removes the ph_* cookies from your browser.

Cookie management

You can manage your cookie preferences from the "Cookies" button in the footer, or directly from your browser settings. Note: deleting essential cookies signs you out immediately.

10. Data Security

Technical measures

• TLS encryption in transit (HTTPS)
• Hashed passwords (bcrypt)
• Secure session tokens
• Firewall and DDoS protection (Cloudflare)
• Regular encrypted backups

Organisational measures

• Access on a need-to-know basis
• Employee training
• Strong password policy
• Access logging

Breach notification

In the event of a data breach likely to result in a high risk, we will inform you within 72 hours in accordance with Article 34 GDPR.

11. Minors

The Service is not intended for persons under 16 years of age. We do not knowingly collect data from minors.

12. Modifications

We may modify this policy at any time. Material changes will be notified by email or via the interface. The date of the last update is shown at the top of this document.

13. Contact

Data Protection Officer
Email: dpo@careertoolbox.ai
Address: Sivel Labs SRL, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium

Annex: Records of Processing Activities (Summary)

Document version 1.6 — 27 April 2026