Privacy Policy

Protecting your personal data is a priority for Hiring For Good and for Profilr. Whether you are a candidate, a customer, a user of our SaaS software or a prospect, we undertake to handle your information with care, in compliance with applicable law, notably the French “Informatique et Libertés” Act of 1978 and the General Data Protection Regulation (GDPR) of 27 April 2016.

Article 1 — Data controller

For Hiring For Good:

Hiring For Good SAS — RCS Saint-Malo B 902 930 437, 99, rue du HAN — 35120 Cherrueix, France. Contact email: contact@hiringforgood.com

For Profilr:

Profilr — a trade name owned by Hiring For Good SAS — RCS Saint-Malo B 902 930 437, 99, rue du HAN — 35120 Cherrueix, France. Contact email: dpo@profilr.eu

Article 2 — Data we collect

Personal data is data that identifies an individual, directly or by cross-referencing with other data. We may collect personal data in the following categories:

• Identification data: surname, first name, postal address, email address, phone number;
• Professional data: your company, position / role, career history, skills, information from your CV (for Hiring For Good) or professional information made public by the individuals themselves and indexed by Profilr;
• Data provided voluntarily: any information shared in an email, at an event or through our respective websites;
• Browsing data: information collected when you visit our sites or use the Profilr software (for example: IP address, browser type).

Profilr does not intentionally collect or process any data falling within the special categories referred to in Article 9 of the GDPR (origin, opinions, health, orientation, etc.).

Article 3 — When do we collect your data?

For Hiring For Good:

Your personal data may be collected when:

• You sign up for our newsletters or events;
• You apply for a job or take part in a recruitment process;
• You contact us through our platforms or social networks;
• We identify potential candidates through publicly accessible sources.

For Profilr:

Your personal data may be collected when:

• You create an account on the SaaS platform;
• Profilr indexes professional information made public on the web (building the index database);
• You use the platform’s features (multi-criteria search, outreach, on-demand contact enrichment);
• You subscribe to our newsletter on the website;
• You interact with our support teams or our marketing communications.

Article 4 — Purposes and legal bases of processing

How the search tools work

Profilr provides recruiters with multi-criteria search and outreach features designed to help them identify relevant profiles.

These features rely on objective criteria defined by the user, such as job titles, skills, professional experience or location. They do not give individuals any score or assessment intended to judge their aptitude, and do not establish any merit ranking.

No automated decision produces legal or similarly significant effects on data subjects within the meaning of Article 22 of the GDPR. Artificial-intelligence assistance features (help writing messages, organising profiles) produce suggestions that a human must validate before any action.

Data subjects may at any time obtain an explanation of the general logic of the processing and exercise their right to object.

Purposes

For Hiring For Good, personal data is used to:

• Identify and shortlist candidates for professional opportunities;
• Manage applications and assess the fit of profiles;
• Respond to information or contact requests;
• Develop our business.

For Profilr, personal data is used to:

• Provide secure access to the SaaS software and its features;
• Manage subscriptions, billing and communications related to user accounts;
• Build and maintain an index database of professional profiles from information made public on the web;
• Enrich, at the customer’s request, the professional contact details of an identified profile, through a specialised provider established in the European Union;
• Improve the user experience and the relevance of the features;
• Send targeted marketing communications (with prior consent).

Legal bases

• Legitimate interest (Art. 6-1-f GDPR): for open-web sourcing and building the index database of professional profiles, as well as for improving the services and managing the business. This legitimate interest is subject to a formalised assessment (balancing against individuals’ rights), available on request;
• Performance of a contract: for providing the Profilr service and managing recruitment processes;
• Consent: for marketing communications and the use of non-essential cookies;
• Legal obligation: to respond to administrative, tax or regulatory requests.

Article 5 — Processors and service providers

We use third-party providers, carefully selected to guarantee a high level of personal data protection, with whom a data processing agreement (DPA) is concluded when they process data on our behalf.

Providers processing data as part of the platform:

• AWS (Amazon Web Services, Europe) — Secure hosting and storage of data, within the European Union;
• Contact-enrichment provider — A single provider, established in France and processing data within the European Union, enriches professional contact details at the customer’s request;
• Stripe — Payment management and secure transactions;
• Pennylane — Invoice management and issuance.

Tools that do not process data of indexed candidates:

• HubSpot — Sales relationship and newsletter management (Profilr prospects, customers and subscribers only);
• Google Analytics — Website audience measurement (with IP address anonymisation).

These last two tools do not process the data of the professional profiles indexed by Profilr; they concern only the visitors of our sites, our newsletter subscribers and the relationship with our customers and prospects.

The distinction between the sources of professional information (profiles made public on the web, see Article 8) and the contact-enrichment provider (a single supplier) is essential: they are two separate mechanisms.

Article 6 — Data retention

Profilr keeps personal data only for as long as strictly necessary to achieve the purposes for which it was collected, in accordance with Article 5.1.e of the GDPR.

1. Professional profile data (Profilr index database)

Profiles obtained through open-web sourcing are kept for a maximum of 30 days. The index database is entirely deleted and then re-indexed every month. No historical stock is kept beyond 30 days.

This very short period guarantees the freshness and accuracy of the information, and automatically respects individuals’ choices: a profile removed from the web or whose public visibility has been turned off disappears from the database in the next re-indexing cycle.

2. Applications received directly (Hiring For Good)

Kept for 24 months after the last exchange, unless the candidate requests otherwise, in accordance with CNIL recommendations (deliberation no. 2012-209).

3. Profilr platform user data

• Active accounts: kept for the whole duration of the subscription, then deleted or anonymised 12 months after the account is closed;
• Connection logs and technical data: kept for 12 months for security, traceability and fraud-prevention reasons.

4. Commercial and contractual data

• Invoicing and accounting records: kept for 10 years in accordance with Article L.123-22 of the French Commercial Code;
• B2B prospects: kept for 3 years from the last contact, in accordance with CNIL doctrine.

5. Marketing data and cookies

• Marketing consents: kept for 3 years after the last interaction (or withdrawal of consent);
• Analytics and technical cookies: kept for a maximum of 13 months, in accordance with CNIL guidelines.

6. Deletion or anonymisation

When the stated periods expire, data is either deleted or irreversibly anonymised. Data subjects may at any time request the deletion or restriction of their data, in accordance with Article 17 of the GDPR. People who have exercised their right to object are placed on a permanent suppression list that prevents any later re-indexing.

Article 7 — Data security

We implement rigorous technical and organisational measures to guarantee the security, confidentiality and integrity of your data, including:

• Encryption: AES-256 for data at rest (keys managed by AWS KMS), TLS 1.2 or higher in transit;
• Access control: mandatory multi-factor authentication (MFA) for access to production environments, role-based access control (RBAC) and the principle of least privilege;
• Monitoring: AWS Security Hub and GuardDuty enabled to detect anomalies and threats;
• Development security: systematic code review before release, automated analysis of dependencies and vulnerabilities;
• Backups: automatic encrypted backups and regularly tested restores.

Logs and metadata: connection and activity logs are kept for a maximum of 12 months, for security and fraud-prevention purposes.

Breach notification: in the event of a personal data breach presenting a risk to individuals’ rights and freedoms, Profilr and Hiring For Good undertake to notify the competent authority (CNIL) within 72 hours, as well as the data subjects where necessary. Profilr ensures that all its providers offer equivalent guarantees of security and confidentiality.

Article 8 — Sources of professional data and indexing

Profilr builds an index database of professional profiles from information made public by the individuals themselves.

1. Sources and types of data

Sources include publicly accessible professional platforms and spaces (professional networks, portfolio platforms such as GitHub, Dribbble or Behance, personal websites, company websites, public professional directories, public databases, professional forums and communities).

The data concerned is exclusively professional information made public by the individuals themselves: identity, position, company, career history, skills, links to public profiles or professional work. The index database does not contain contact details (email, phone).

2. Collection mechanism

Profilr:

• only accesses pages that are freely accessible to the public, without creating or using an account, without authentication and without circumventing technical access measures (paywall, login, captcha);
• does not collect any data whose initial collection would be unlawful;
• carries out an annual review of the compliance of its sources and providers.

3. Respecting individuals’ visibility choices

Profilr only indexes profiles whose owners have chosen to make their information publicly visible, including outside the original platforms. Most professional networks let everyone control this visibility from their account settings.

If a person restricts the visibility of their profile or removes it from the web, it automatically disappears from the Profilr database in the next re-indexing cycle, i.e. within thirty (30) days at most, without any action being required on their part.

4. On-demand contact enrichment

Enrichment of professional contact details (for example obtaining a professional email address) takes place only at a customer’s request, through a single provider established in the European Union. This enrichment is distinct from the indexing described above.

5. User responsibility

When users connect their own accounts or third-party services (for example an ATS or CRM integration), they remain responsible for the compliance of that access. Profilr then acts as a technical processor, with no autonomy over the collection or the purposes pursued.

Article 9 — Informing data subjects

Profilr index database

The Profilr index database does not contain contact details (email, phone). With no means of contacting the indexed individuals directly, individual information within the meaning of Article 14(1) of the GDPR proves impossible and would require disproportionate effort within the meaning of Article 14(5)(b) of the GDPR.

As a compensating measure, Profilr implements the following:

• publication of this privacy policy, which is publicly accessible;
• an objection and deletion form available to anyone, without creating an account;
• retention strictly limited to 30 days and monthly re-indexing;
• a permanent suppression list for people who have exercised their right to object.

Data enriched at a customer’s request

When a Profilr customer requests the enrichment of a profile’s contact details in order to contact them, that customer acts as data controller. It is for the customer to inform the data subject in accordance with Article 14 of the GDPR, within a maximum of 60 days. Profilr provides its customers with a dedicated information tool (a message template containing the mandatory Article 14 information) to make compliance easier.

Article 10 — Transfers outside the European Union

Profilr processes and hosts data mainly within the European Economic Area. Hosting (AWS) and contact enrichment are carried out within the European Union.

Some technical providers (notably the generative AI model providers used for writing assistance) may be located outside the European Union.

Each transfer of data outside the EU relies on one of the following safeguards:

• European Commission adequacy decision (notably the Data Privacy Framework for transfers to the United States);
• Standard contractual clauses (SCCs) adopted by the European Commission;
• Complementary security mechanisms (encryption, pseudonymisation, access restriction).

Profilr carries out an annual review of its suppliers. The up-to-date list of processors and the associated transfer mechanisms can be obtained on request from dpo@profilr.eu.

Article 11 — Withdrawal of consent

Where processing is based on consent (marketing communications, non-essential cookies), users may withdraw it at any time, without justification and without affecting the lawfulness of processing carried out before the withdrawal. This right is exercised:

• by contacting us at dpo@profilr.eu;
• by clicking the unsubscribe link in each marketing communication;
• or by deleting their account directly from the platform interface.

Article 12 — Individuals’ rights and portability

In accordance with Articles 12 to 23 of the GDPR, data subjects have the following rights:

• Right of access: obtain confirmation that processing is taking place and access the data concerned, as well as its source;
• Right to rectification: correct inaccurate or incomplete information;
• Right to erasure (“right to be forgotten”): request the deletion of data;
• Right to restriction: request the temporary suspension of processing;
• Right to object: object at any time to processing based on legitimate interest, notably open-web sourcing;
• Right to portability: receive the data in a structured, commonly used and machine-readable format;
• Right not to be subject to an automated decision: Profilr takes no automated decision producing legal or similarly significant effects.

These rights may be exercised at any time by email at dpo@profilr.eu or through the dedicated form available on profilr.eu. Profilr may ask for proof of identity to verify the legitimacy of the request. All requests are handled within a maximum of one month of receipt, in accordance with Article 12(3) of the GDPR.

Data subjects may also lodge a complaint with the CNIL.

Article 13 — Data protection contact

Profilr has appointed a data protection contact, reachable at dpo@profilr.eu, responsible for ensuring that data protection rules are properly applied and for answering the questions or requests of data subjects.

Article 14 — Cookie policy

For Hiring For Good: no cookie is used to collect personal data. If this policy changes, this document will be updated and submitted for new consent where applicable.

For Profilr: Profilr uses cookies and similar technologies to ensure the technical operation and security of the site, improve the user experience and measure audience. Non-essential cookies are placed only after consent is obtained through the information banner shown on the first visit. Users may change or withdraw their consent at any time.

On www.profilr.eu, the following trackers are only placed with your consent:

• Audience measurement — Google Analytics (Google Ireland Limited): _ga and _ga_NEZMYC4BWV cookies, kept for 13 months at most, and a _gcl_ls entry in the browser storage. They count visits and show how the site is used. Google may transfer this data to the United States under the EU–US Data Privacy Framework.
• Live chat — Crisp (Crisp IM SAS, France): a crisp-client session cookie kept for 6 months and entries in the browser storage, so that you can find your conversation again.
• Referral — Viral Loops: an entry in the browser storage that keeps the referral code you arrived with.
• Booking calendar — Google Calendar (Google Ireland Limited): the calendar on the home page only loads if you click “Show the booking calendar”; Google then sets its own cookies.

Your choice is stored in your browser storage (profilr-consent entry) for 6 months, after which you are asked again. You can change or withdraw it at any time with the “Cookie settings” link at the bottom of every page: the trackers you refuse are then deleted. Refusing does not prevent you from using the site.

Article 15 — Changes to the policy

We may change this policy at any time. Any significant change will be communicated to users.

Article 16 — Contact

Hiring For Good — 99, rue du HAN — 35120 Cherrueix, France. Email: contact@hiringforgood.com

Profilr — 99, rue du HAN — 35120 Cherrueix, France. Email: dpo@profilr.eu