Privacy Policy
talentshield.app and the TalentShield service · Version 1.2 · Effective 5 October 2026
In short. Team Up Recruitment sp. z o.o. is responsible for the data of people who visit this website, contact us or use the TalentShield dashboard. If you are a job candidate and an employer or agency used TalentShield in a recruitment process you applied to, that employer or agency is responsible for your data and we act on their instructions. Section 2 explains what that means for you.
1. Who we are
TalentShield is a product of Team Up Recruitment sp. z o.o., ul. Sienkiewicza 72, 90-318 Łódź, Poland, NIP PL7252288257, KRS 0000781782 (District Court for Łódź-Śródmieście, XX Commercial Division) ("we", "us"). We are the controller of the personal data described in this Policy, except where Section 2 applies.
Contact for privacy matters: privacy@talentshield.app. We have not appointed a Data Protection Officer; the contact above handles all privacy requests.
2. If you are a candidate, read this first
If an employer or recruitment agency uses TalentShield in a recruitment process you applied to, that employer or agency is the controller of your personal data. TalentShield processes your application data only on their documented instructions, as their processor, under a data processing agreement. We do not make any decision about your application and we do not contact candidates.
What we do on the employer's behalf: we analyse the application materials you submitted (for example the CV file and its technical properties) and, depending on the employer's configuration, publicly available professional profile information, for internal consistency. The result is a set of observations that the employer's recruiters review. Every decision about your application is taken by a person at the employer.
To exercise your rights (access, rectification, erasure, restriction, objection, and the right to obtain human intervention and an explanation), contact the employer or agency you applied to. If you contact us instead, we will forward your request to them within five business days and let you know we have done so.
3. Data we process as controller
| Who | Data | Purpose and legal basis (GDPR) | Retention |
|---|---|---|---|
| Visitors of talentshield.app | IP address, browser and device information, pages visited, referrer, cookie identifiers (Section 7) | Operating and securing the website, understanding how it is used. Art. 6(1)(f) legitimate interest; consent for analytics cookies | Server logs up to 12 months; analytics data per Section 7 |
| People who request a pilot or demo, or contact us | Name, business email, company, role, ATS used, hiring volume, message content | Responding, arranging a pilot or demo, sending information you asked for. Art. 6(1)(b) steps prior to a contract; Art. 6(1)(f) legitimate interest | Until the request is handled and for 24 months after our last contact |
| Contacts at customer and prospective customer organisations | Name, business contact details, role, correspondence, contract and billing information | Negotiating, performing and invoicing the agreement; support. Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (accounting); Art. 6(1)(f) legitimate interest | Term of the agreement plus the limitation period; accounting records as required by Polish law |
| Users of the TalentShield dashboard | Name, business email, role, authentication data, IP address, activity within the service, including manual assessments recorded | Providing the service, security, audit trail, support. Art. 6(1)(b) contract with the customer; Art. 6(1)(f) legitimate interest in security and accountability | Term of the agreement; activity logs up to 12 months |
We collect this data directly from you (forms, email, use of the service), from your organisation when it creates your user account, and automatically from your browser when you use the website or the service. We do not buy personal data and we do not enrich contact data from third-party sources for marketing.
4. Who receives the data
We share personal data only with providers who process it on our behalf under data processing agreements, and with authorities where the law requires. Providers for the data covered by this Policy:
| Provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Hosting of the service and its database | European Union (Frankfurt) |
| Hetzner Online GmbH | Storage of verification reports | Germany |
| Netlify, Inc. | Hosting of the website talentshield.app | Global CDN; United States under Standard Contractual Clauses |
| Formspree, Inc. | Delivery of website form submissions to us | United States under Standard Contractual Clauses |
| Mailgun Technologies, Inc. (Sinch) | Transactional email for the service (invitations, password resets, notifications) | EU region for message data; account data in the United States under Standard Contractual Clauses |
| Microsoft Ireland Operations Ltd. (Azure OpenAI Service) | AI models used by the service for application analysis, with EU data residency; inputs and outputs are not stored and are not used to train models | EU Data Zone (stored data in Sweden) |
| Google Ireland Ltd. (Google Analytics 4) | Website analytics, only with your consent | EU and United States under the EU-US Data Privacy Framework |
| Meta Platforms Ireland Ltd. (Meta Pixel) | Measuring the effectiveness of our advertising, only with your consent | EU and United States under the EU-US Data Privacy Framework |
| Accounting and legal advisers | Invoicing, accounting, legal advice | Poland |
Candidate data processed on behalf of customers goes only to the sub-processors listed in our Data Processing Agreement, which is available to customers and, on request, to candidates.
5. International transfers
We store the data covered by this Policy in the European Economic Area. Where a provider listed above processes data outside the EEA, we rely on a European Commission adequacy decision (for example for Switzerland), on the European Commission's Standard Contractual Clauses or, where the provider is certified, on the EU-US Data Privacy Framework.
6. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The TalentShield service produces information for human review by our customers. It does not make decisions about candidates or users.
7. Cookies
The website uses essential cookies needed for it to function and to remember your cookie choice. These do not require consent.
With your consent, given in the cookie banner, we also use Google Analytics 4 to understand how the website is used and Meta Pixel to measure our advertising. No analytics or marketing cookies are set until you accept. You can withdraw consent at any time via the "Cookie settings" link in the footer, which reopens the banner. Google Analytics data is retained for 14 months.
The TalentShield dashboard uses session cookies required for authentication.
8. Your rights
You have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting processing carried out before withdrawal. Where we rely on legitimate interest, you may object on grounds relating to your particular situation and we will stop unless we have compelling legitimate grounds.
To exercise these rights, write to privacy@talentshield.app. We respond within one month. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority of your habitual residence.
9. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls with multi-factor authentication, logging, and confidentiality obligations for our staff. A description of our measures is available to customers in the Security & Architecture Overview.
10. Changes
We may update this Policy. The current version and its date are always shown on this page. For material changes affecting users of the service, we notify the customer's administrator. Previous versions are available on request.