Privacy Policy

1. Who we are

This Privacy Policy explains how cvtobrand.com (“CVtoBrand”, “we”) processes personal data on the website cvtobrand.com and in the web app at app.cvtobrand.com (the “Service”). CVtoBrand is the controller for the processing described in section 2.2. Our contact address for all privacy questions and requests is [email protected]. If you want to know the full legal identity (legal name, registration number and address) of the person or entity behind CVtoBrand, ask us at that address and we will tell you without undue delay. We have not appointed a data protection officer.

2. Our two roles

2.1 Processor for our customers. When a customer (a recruitment or secondment agency) uploads CVs, the personal data in those CVs is processed on the customer’s behalf and on its instructions. The customer is the controller; the Data Processing Agreement (DPA) applies. The customer is solely responsible for having a lawful basis, informing candidates and complying with the laws of its own country.

2.2 Controller for our own processing. For the website, customer accounts, communication and billing, CVtoBrand is the controller. That processing is described below.

3. What we process and why

• Website visits: technical data needed to deliver and protect the website, such as IP address, browser type and the requested page, processed by our hosting and network provider. Basis: legitimate interest in a secure, working website. We use analytics cookies only if you consent to them (see section 4), and we do not use advertising cookies.
• Website analytics (only with your consent): if you accept analytics cookies, data about how you use the website, collected with Google Analytics (see section 4). Basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• Accounts and Users: name, business email address, role (admin or recruiter), Workspace and login and usage data. Basis: performance of the contract with the customer and our legitimate interest in providing and securing the Service.
• Contact and demo requests: the details you send us, to answer your request. Basis: legitimate interest, or steps prior to a contract.
• Billing: company and invoice details and payment status. Basis: performance of the contract and legal (tax) obligations.

4. Cookies

The website cvtobrand.com uses strictly necessary storage in your browser’s local storage: your choice of light or dark mode (cvtb-theme), your language choice (cvtb-lang, only if you choose a language yourself) and your cookie choice (cvtb-consent, with the date and version of that choice). If your browser blocks local storage, your language choice and cookie choice are kept in strictly necessary cookies with the same names. This storage does not require consent and is not used to follow you.

Analytics, only with your consent. If you accept analytics cookies, we use Google Analytics 4 to understand how the website is used, for example which pages are visited and how visitors find the website, so that we can improve it. Google Analytics is only loaded after you have given consent: until then, and if you reject analytics, no Google Analytics script is loaded and no analytics cookies are set. We use Google Consent Mode, with all categories set to “denied” by default. We do not use the advertising features of Google Analytics or Google signals, and we do not use analytics data for advertising.

With your consent, Google Analytics sets the cookies _ga (to distinguish visitors) and _ga_<ID> (to keep the session state); by default they expire up to 2 years after your last visit. Google Analytics then processes an online identifier from these cookies, the pages you view, the time and source of your visit, and information about your device, browser and approximate location, derived from your IP address. Event-level data is kept in Google Analytics for the data retention period set in our Google Analytics account; aggregated reports that do not identify you may be kept longer.

The recipient of this data is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which provides Google Analytics; the data may also be processed by Google LLC in the United States. That transfer is covered by the EU-US Data Privacy Framework, under which Google LLC is certified. The legal basis is your consent (Article 6(1)(a) GDPR; for the cookies, Article 11.7a of the Dutch Telecommunications Act). Google Analytics is used only for this website, not for CVs or other customer data in the web app.

On your first visit we ask for your choice; rejecting is as easy as accepting, and analytics stay off unless you accept them. You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of every page; this does not affect processing before the withdrawal. After you withdraw, Google Analytics is no longer loaded and we remove its cookies from your browser; you can also delete cookies yourself in your browser settings. We ask for your choice again after 12 months or when the categories change.

To protect sign-in against abuse, the web app (app.cvtobrand.com) uses Google reCAPTCHA Enterprise via Firebase App Check; this is strictly necessary for security. The web app also uses the cookies and storage that are strictly necessary to sign in and use it.

5. Retention

We keep personal data no longer than necessary for the purposes described above. Specifically:

• CVs and candidate data (as processor): generated CV profiles are kept only for the retention period chosen by the customer’s admin (7 to 90 days; default 14) and are then deleted. We do not store CV source files or photos. See Article 13 of the DPA.
• Accounts and Users: for as long as the customer’s account exists.
• Deleting a customer account: when a customer deletes its account (in the web app or by asking us), or the agreement ends in any other way, a cancellation period of 10 days starts, during which the customer can undo the deletion and export its data. After those 10 days we permanently delete all data of that customer’s Workspace (the account, Users, CV profiles, settings, audit logs and usage data) without undue delay and no later than 30 days later.
• Audit logs (which User performed which action on which item, and when; no CV content): 12 months, and in any case no longer than the customer’s Workspace exists.
• Contact and demo requests: 12 months after our last contact.
• Analytics cookies (only with your consent): see section 4.
• The only exception: invoice and payment records that we must keep under Dutch law (Article 2:10 of the Dutch Civil Code and Article 52 of the General State Taxes Act) are kept for 7 years. We keep only the data needed for that purpose (such as company name, billing details, invoice and payment data), and never CVs or candidate data.
• Back-ups: if back-up or recovery features of our cloud providers hold copies of personal data, those copies are used only to restore the Service after an incident and are deleted or overwritten when their fixed retention period ends. Deleted data may also remain in our providers’ internal back-up systems for a limited period before it is permanently overwritten, in accordance with their terms.
• Technical logs of our hosting, cloud and e-mail providers: kept for the limited retention periods that apply to those logs at our providers, and then deleted.

6. Recipients and sub-processors

We use the following service providers, which process personal data on our behalf: Google (Google Cloud and Firebase: back end, database, sign-in, abuse protection with reCAPTCHA Enterprise, AI processing with Vertex AI, and our support mailbox via Google Workspace), Resend (service e-mails) and Cloudflare (website and app delivery, DNS and network security). Details, locations and safeguards are listed in Annex C to the DPA. Google Analytics (Google Ireland Limited) is used only on the website and only with your consent; see section 4.

7. International transfers

Our back-end functions run in the Google Cloud region europe-west4 (Netherlands) and our AI processing runs in the EU. Some of our providers are, or belong to, US companies, and some data may be processed outside the EEA: in particular, sign-in and abuse protection run on Google’s global infrastructure, Cloudflare runs a global network, Resend stores e-mail metadata and logs in the United States and, if you consent to analytics, Google Analytics data may be processed by Google LLC in the United States. Where personal data is processed outside the EEA, the transfer is covered by the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, as listed in Annex C to the DPA and in section 4.

8. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability, within the limits of the law. You can also lodge a complaint with a data protection authority. If your request concerns a CV that an agency uploaded, please contact that agency; we will support the agency in handling your request.

9. Security

We take appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), separation of customer Workspaces and role-based access.

10. Changes

We may update this Privacy Policy. The date at the top shows the latest version.

11. Contact

Questions about this Privacy Policy or about your rights can be sent to CVtoBrand by email to [email protected]. Privacy requests (for example to exercise your rights) can also be sent to this address.