1. Data controller
The controller for this platform is TalentPath, operating at talentpath.eu. TalentPath is an independent project; it is not affiliated with, endorsed by, or accredited by the European Commission or any EU institution. WHEN AN ORGANISATION INVITES ITS STAFF. An organisation that uses the B2B workspace decides whom to invite and why, so it is the controller of its invitation list and of the participation records the workspace keeps for it: which invited staff took part and when. TalentPath processes those records on the organisation's behalf, as its processor, and uses them for nothing else. An organisation that needs a data processing agreement can ask for one at info@talentpath.eu. Each person's own account, assessment result and credential stay theirs, with TalentPath as controller: the organisation never sees a level or score, individual or as a group total. Separately, an organisation may upload its own evidence about its staff's skills to Skills intelligence, identified by a staff number or other code, never a name or e-mail address; it is the controller of that evidence and TalentPath its processor, and only group readings covering at least five people are shown. TalentPath is for people aged 16 or older. Contact for data enquiries: info@talentpath.eu Postal address available on request via email. Response time: within 2 business days for general enquiries; within 30 calendar days for formal GDPR access/erasure/portability requests, as required by law.
2. What we collect
We collect the following personal data: • Your account: e-mail address, name, and a scrambled (hashed) form of your password, never the password itself. Optionally your country, current occupation and the occupation you are aiming for. • Assessment participants: first name, last name, email address, and assessment responses (the option you chose for each question, its score, domain results, timestamps). • Certificate checks: anyone you give a certificate code to can check it and sees your name, overall score, results by area and issue date. When an organisation checks a code from its workspace, we keep a note for that organisation of the code, when it was checked, the holder's name and the score. • B2B organisation users: organisation name, country, VAT number (optional), and admin email address. • Skills Roadmap: the answers you give about your plan and teams (objectives, team names, counts of people), saved to your account, with up to eight earlier versions of the result (so you can see what changed) and any status you set for an action (not started, started, done, dropped). Only you can open, change or delete a roadmap. If you switch on a read-only link, anyone you give it to can read that roadmap, but not change it or see your account; switching it off stops the link at once. We ask you not to type anyone's name, and we do not use these answers for anything else. The worked examples are fictional and need no account. • Staff of an organisation that uses the B2B workspace: an organisation sends its own invite link; TalentPath does not e-mail staff. If you join through that link, the organisation sees your name and your account's e-mail address, and whether and when you took the assessment, never your score or whether you passed. An organisation may also list work e-mail addresses to see who has not joined yet; we send nothing to them, and listing an address shows the organisation nothing about that person unless they join through its link. We keep those entries and any due date it set. • Skills analysis: the job title, location, skills and certifications you enter, and the analysis we return, saved under a link that cannot be guessed so you can come back to it or share it. • Messages you send us through the contact form: your name, e-mail address and message. • Security: to stop abuse we hold your network (IP) address in memory for up to an hour, counting how many requests it makes; it is not written to our database. Our hosting provider keeps short-lived technical logs of requests under its own terms. • Usage data: daily counts of how often each page was viewed and how often each feature was used (for example, "assessment started" or "job search run"). These are bare tallies — a route name or the page's language, a date and a number. No IP address, user agent, cookie, account or other identifier is stored with them, so they cannot tell us who you are or follow you between pages, and they count views rather than visitors. Addresses in a URL that could identify someone, such as a certificate code or a Talent Pool handle, are replaced by the route name before counting. If your browser sends Do Not Track or Global Privacy Control, your page views are not counted at all. We do not use a third-party analytics service. TalentPath is free. We take no payments and hold no payment details.
2a. The Talent Pool
Listing yourself in the Talent Pool is optional and separate from everything else here. This section describes it in full, because it processes more of your data than any other part of the platform. WHAT IS PUBLISHED. Your listing is shown under a handle such as TP-7K2M9X. It carries: your headline, the occupation you want and its ISCO-08 occupation group, years of experience, country of residence, the EU countries you would move to, sectors, languages and self-assessed CEFR levels, availability, your right-to-work status, your written summary, your work history (job titles, kind of organisation, sector, country, years and the achievements you list), your self-declared skills, your qualifications (level and subject), driving licences, your contract, working-time and remote preferences, the date you last updated the listing, whether you hold a TalentPath digital-skills credential, and which DigComp areas you have passed and at what level. Your assessment scores are never published, and neither is any area you attempted but did not pass. Your pay expectation is published ONLY if you tick the box to publish it. WHAT IS NEVER PUBLISHED. Your name, your e-mail address, your assessment scores, your certificate codes, your LinkedIn link, your portfolio link, your photograph, your date of birth, your nationality, the names of your employers and the names of your schools. Employer names and institution names are not published because we do not ask for them at all: a job title with an employer and a date identifies almost anyone. WHO CAN SEE IT. Anyone on the internet can browse the pseudonymous listings without an account. Individual candidate pages are marked "noindex" so search engines are asked not to index them, and they are not in our sitemap — but we cannot guarantee the behaviour of every crawler, and you should assume a listing is public. HOW YOUR IDENTITY IS RELEASED. An employer must hold an account with a confirmed e-mail address and send you a request describing the role. You see the request and decide. Only if you approve does the platform e-mail your name, e-mail address, LinkedIn link and portfolio link to that one employer. Declining shares nothing. We do not verify employers, and we tell you so at the moment you decide. LEGAL BASIS. Publishing your listing and releasing your identity rest on your consent (GDPR Art. 6(1)(a)), and on your explicit consent under Art. 9(2)(a) so far as the combination of details in a listing may reveal special-category data. You can withdraw consent at any time by unlisting or deleting your listing, which is as easy as giving it. Holding your account rests on performance of a contract (Art. 6(1)(b)). HOW LONG IT IS KEPT. Your listing stops appearing in the pool after 18 months without you using it, and is deleted with its contact history after 24 months. Signing in and saving your listing starts the clock again. This follows the reference period the French supervisory authority sets for holding candidate data in a recruitment pool. You can unlist or delete at any time; deleting removes the listing and its contact requests entirely. SPECIAL CATEGORIES. We do not ask for anything in Art. 9 — no health, religion, politics, trade-union membership, ethnic origin, sexual orientation or biometrics — and we do not scan your writing for them. Please do not volunteer them in your summary: the form warns you of this where you write it. TRANSFERS OUTSIDE THE EU. Employers who browse the pool, and employers whose requests you approve, may be located outside the EU or EEA. Where you approve a request from such an employer, your identity is transferred to them on the basis of your explicit consent to that specific transfer (Art. 49(1)(a)), and you should understand that a country outside the EEA may not offer equivalent protection. NO AUTOMATED DECISIONS. Candidates are not scored, ranked or matched by any algorithm. Searching and filtering compare exactly what candidates entered, and results are ordered by when a listing was last updated. There is no profiling within the meaning of Art. 22, and no AI system is used to evaluate candidates. CONTACT REQUESTS. When an employer contacts you we store their name, organisation, stated reply-to address, role title and message, together with the account that sent it. A request you answered is part of the record of your decision and is deleted with your listing. A request nobody ever answered is deleted after 6 months, because it holds the employer's personal data and keeping it longer serves no one. TAKING YOUR DATA WITH YOU. From your listing page you can download everything you gave us, and every contact request you received, as a JSON file (Article 20). Verification results we produced about you are observations rather than data you provided, so they are not in that export — ask us and we will send them under your right of access (Article 15). EVIDENCE OF CONSENT. When you list yourself we record the moment you did and which version of this notice was in force, so that we can show what you agreed to (Article 7(1)). Unlisting does not erase that record of the agreement it withdraws; deleting your listing does.
3. Why we collect it (legal basis)
• To deliver the assessment service and issue certificates: performance of a contract (GDPR Art. 6(1)(b)). • To send assessment result emails: performance of a contract. • To save and show your skills roadmaps and skills analyses: performance of a contract (GDPR Art. 6(1)(b)). • To keep the platform secure and stop abuse (limiting requests per address and per account): legitimate interest (GDPR Art. 6(1)(f)). • To answer and keep a record of requests you make under the GDPR, and of any personal-data breach: legal obligation (GDPR Art. 6(1)(c), Art. 5(2) and 33(5)). • To operate the B2B workspace: performance of our contract with the organisation. For the staff records described in section 1, we act on the organisation's instructions as its processor (GDPR Art. 28). • To maintain aggregate analytics for platform improvement: legitimate interest (GDPR Art. 6(1)(f)). • To check that each question works (how often it is answered correctly, which options people choose, whether it behaves the same for different groups) and to decide which trial questions may count: legitimate interest (GDPR Art. 6(1)(f)). This uses your answers under a code that changes every time the statistics are run, with no name, e-mail address or date, and it is never used to make any decision about you. We do not use your data for advertising, profiling, or automated decision-making with legal effects.
4. How long we keep your data
• Your account: until you delete it, which you can do yourself from your profile page, or three years after you last signed in, when it is erased with everything filed under it. • Assessment results and certificates: 2 years from the date of issue, then deleted. • Staff invitations and participation records: 2 years after the person completed the assessment or, if they never did, 2 years after the invitation. Certificate checks an organisation made: 2 years. The organisation account itself: until the organisation closes it or asks us to delete it. • Contact and support emails: 1 year. • Skills roadmaps: 12 months after you last opened one, at once when you delete it, or with your account. • Skills analyses: 12 months after they were made. • Reports of abuse and our decisions on them: 24 months after the decision. Our log of administrative actions: 36 months. Requests you make under the GDPR: 36 months after we closed them. Records of personal-data breaches: 60 months after they were closed. Skill evidence an organisation uploads to Skills intelligence: 60 months after the date of the event it records. You can request deletion at any time (see Your Rights below). One exception to deletion: if an account we suspended for breaking our rules is deleted, we keep a scrambled, keyed fingerprint of its e-mail address — never the address itself — so that the same address cannot be used to register again and repeat the harm. We keep it for as long as it serves that purpose (GDPR Art. 6(1)(f), preventing fraud against the people who use the Talent Pool).
5. Who we share data with
We share data only with processors required to run the platform: • Vercel Inc. (United States) — hosting. Our server functions run in its Frankfurt region. • Neon — database (EU region, encrypted at rest). • Site.nl (the Netherlands) — hosts our e-mail: messages you send to info@talentpath.eu, and, once switched on, the account, password and result e-mails we send. • Groq, Inc. (United States) — runs, on its own servers, the open-weight AI model that writes the text (currently gpt-oss-120b; nothing is sent to the model's original developer) on /readiness, /intelligence, /company and the skills analysis on the results page. What you enter on those pages is sent to Groq to produce the answer, under Groq's terms for its API. We keep the skills analysis as described above and do not store what you enter on the other pages. No AI is used to score assessments or to produce any number about you. • European Commission (ESCO service) — when our own occupation data has no match, the job title you entered is looked up in the public ESCO service. • Hugging Face, Inc. (United States) — when switched on, the job title and skills you enter on /portability and /intelligence are turned into numbers by its service to match them to ESCO. We do not keep them. • OpenStreetMap Foundation (United Kingdom) — the place names you type into a location field on /portability are looked up in its Nominatim service, through our server, so it does not see your IP address. Maps on /market and on portability results pages load their map images straight from OpenStreetMap's tile servers, which do see your IP address, as with any website you visit. The UK has an EU adequacy decision. We do not sell data to third parties.
6. Cookies
We use a session cookie to keep you signed in (NextAuth.js). Your browser's local storage keeps two things on your own device: an unfinished assessment so you can resume it, and which organisation you last opened in the B2B workspace. All of these are needed for something you asked for, so we do not ask for consent to them. We do not use advertising or tracking cookies, and our usage counts set no cookie and use no local storage. If you block cookies you cannot sign in.
7. Your rights under GDPR
You have the right to: • Access the personal data we hold about you. • Correct inaccurate data. • Request deletion ("right to be forgotten"). • Ask us to restrict processing while a question about your data is settled. • Request data portability (receive your data in a machine-readable format). • Object to processing based on legitimate interest. • Withdraw consent at any time (where consent is the legal basis). If you have an account, you can download a copy of your data and delete your account yourself, from your profile page. To exercise any of these rights otherwise, email info@talentpath.eu. We will respond within 30 days. If you believe we are not handling your data correctly, you have the right to lodge a complaint with your national data protection authority.
8. International transfers
Our database is in the European Economic Area (EEA) and our server functions run in Frankfurt. Some providers are companies based in the United States (Vercel, Groq and Hugging Face) and may process data there, for example technical logs or, for Groq, the text you enter on the pages named in section 5. For those transfers we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
9. Changes to this policy
The date at the top of this page shows the last update. If we change how we use your data in a way that matters, we will e-mail account holders before the change takes effect. Where something rests on your consent, such as a Talent Pool listing, we will ask again rather than treat continued use as agreement.