Talent Master privacy policy

Talent Master is published by GETPRO SAS, a French simplified joint-stock company registered with the Paris Trade and Companies Register under number 812 105 138, whose registered office is at 117 rue de Charenton, 75012 Paris, France. In this policy, "GETPRO", "we" and "our" refer to that company.

For any question about your personal data, or to exercise your rights, write to our data protection contact, dpo@getpro.fr.

GETPRO's role depends on the data.

• Controller, for users' data. We decide why and how we process the data needed to manage your account, authenticate you, secure the service, bill it and run it. This policy describes that processing.
• Processor, for candidates' data. Each customer is the controller of its candidates' data. It decides which roles to recruit for, which candidates to search for, keep, reject and contact, and what is sent to them. GETPRO processes that data on its behalf and on its instructions, within the meaning of Article 28 GDPR, under the data processing agreement (DPA) the customer accepts when its workspace is created.

The customer informs its candidates itself. For that purpose, Talent Master gives it a default privacy policy in its name, shown to candidates until the customer provides its own. Section 5 summarises what Talent Master does on the customer's behalf.

If a customer authorises GETPRO to use its workspace's decisions to improve the screening (section 4), that reuse serves a purpose of GETPRO's own, for which GETPRO is the controller. It relies on GETPRO's legitimate interest in improving Talent Master's screening, and a candidate can object to it by writing to dpo@getpro.fr.

Users' data (GETPRO as controller)

Workspace data (GETPRO as the customer's processor)

• Role brief: job descriptions, transcripts, links and answers the user gives the agent. They may contain data about people at the company.
• Candidates: identity; professional profile (job titles, employers, work history, education, skills, languages, city and country, links to public profiles such as LinkedIn or GitHub, open-source contributions); email address; the screening's reason, decisions, notes and stage of the application; emails sent and replies; meetings; objections and erasure requests.
• Calendar: the busy slots of the calendars the user picks, to offer free slots.

Talent Master is not meant to process sensitive data (health, origin, religion, opinions…) or data relating to criminal convictions.

The data Talent Master returns to the conversation is processed by your AI assistant's provider, under your own agreement with it. That provider is not our sub-processor.

For the processing GETPRO controls:

The improvement authorisation. At sign-up, a separate, optional box, unticked by default, lets the customer authorise GETPRO to use its workspace's data and hiring decisions to improve Talent Master's candidate screening for all its customers. Without that authorisation, nothing from the workspace feeds a shared model. The customer can withdraw it at any time by writing to dpo@getpro.fr; withdrawal applies from then on: models already improved with that data are not retrained.

For candidates' data, the customer sets the purpose and the legal basis. The default policy Talent Master gives it relies on its legitimate interest in recruiting, and on steps taken at the candidate's request before a contract for booking an interview.

We sell no data and use none for advertising. No decision producing legal or similarly significant effects is taken by automated means alone: a person at the customer reviews every shortlisted profile and approves every message.

If a company contacted you through Talent Master, that company is responsible for your data. GETPRO processes it on the company's behalf. This is what Talent Master does for it.

1. Search. Based on the role's criteria, Talent Master searches for public professional profiles on the web (professional networks, GitHub, company websites), through the providers listed in section 6.
2. AI screening. An AI model compares each profile with the criteria and gives a reason for each profile kept or rejected. Your education dates are not passed to it. Talent Master refuses criteria based on a ground of discrimination the law prohibits, or on a proxy for one: age, year of graduation, name, photograph, address. A person at the company reviews every shortlisted profile and decides whom to contact.
3. Email address. For shortlisted candidates only, and at the company's request, Talent Master looks up your email address with a specialised provider, after checking that you are not on the company's suppression list and have not refused to be contacted.
4. Contact. Emails leave from the company's Gmail mailbox, after a person at the company has approved them. Your replies arrive in that mailbox.
5. Meetings. If you are interested, you pick a slot on a page in the company's branding, and the interview is added to its calendar.

The notice in the first email. The first email you receive carries a notice the company cannot remove. It says who is writing and why, where your profile was found, how AI was used in shortlisting it, your rights, and a link to a page where you can exercise them.

Objection and erasure. The page that link opens names the company and offers two actions: "Stop contacting me" and "Erase my data". They apply to that company only: Talent Master's other customers are not affected, and your request is not passed on to them.

The suppression list. After an objection, you are not contacted again: your record stays marked as refusing any contact until it is erased. After an erasure, the company keeps only a hash of your email address, your phone number and your profile identifiers. It serves only to avoid finding or contacting you again.

Exercising your other rights. To access your data, have it corrected or ask a question, reply to the email you received or contact the company. You can also write to dpo@getpro.fr: we pass your request on to the company concerned without delay, the company answers it, and we help it do so.

How long. The company keeps your data for as long as the recruitment needs it, and no longer than two years after its last contact with you, unless you are hired or ask for erasure sooner (section 8).

Talent Master's database and servers are hosted in the European Union, in Paris. The providers below receive personal data to run the service. Each is bound to GETPRO by a data processing agreement.

What is not GETPRO's sub-processor. Emails to candidates leave from the customer's Gmail mailbox: Google acts there under the customer's own agreement with them. Likewise, the provider of the customer's AI assistant processes the conversation under the customer's own agreement.

Changes. We inform customers at least 30 days before adding or replacing a sub-processor, by updating this list and by email to the workspace administrators (DPA, section 6.2).

Your data is stored in the European Union. Some providers in section 6, the AI model providers among them, process it outside the European Economic Area, mainly in the United States. The table in section 6 gives each one's location.

Each transfer relies on one of these safeguards:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for a certified recipient;
• failing that, the standard contractual clauses adopted by the European Commission (Decision 2021/914), with any supplementary measures the transfer requires.

You can obtain a copy of these safeguards by writing to dpo@getpro.fr.

We take the following measures to protect the data:

• Encryption. Traffic between users, candidates and Talent Master travels over TLS. The hosting provider encrypts stored data.
• Separation between customers. Each workspace's data is kept apart from other customers' by row-level security in the database, applied to every query.
• Access control. Users sign in with their Google account. Within a workspace, each user has their own permissions. Only the GETPRO staff who need it access production systems, and acting inside a customer's workspace requires an explicit grant, which is recorded.
• Mailbox and calendar. Talent Master accesses them only through the OAuth access the user grants, and sends no email to a candidate without the approval of a person at the customer.
• Minimisation. The candidate's education dates are not passed to the screening model. After an erasure, only a hash is kept.
• Monitoring. Logs, metrics and traces are collected and kept within our own infrastructure on Google Cloud.
• Abuse prevention. Calls to the AI, to the connector and to sign-in are rate-limited per user, per workspace or per IP address.

If a personal data breach occurs, we notify the CNIL within 72 hours where we are the controller and the law requires it, and the people concerned where the risk is high. Where we are a processor, we notify the customer concerned within 48 hours, so that it can do the same.

For the data GETPRO controls, you can ask for access to your data, its rectification or erasure, the restriction of its processing, and its portability. You can object to processing based on our legitimate interest, and give instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).

Write to dpo@getpro.fr. We answer within one month, extendable by two months for a complex request, in which case we tell you. If we have reasonable doubt about your identity, we may ask you to confirm it.

If you are a candidate, you exercise your rights first with the company that contacted you (section 5).

If you believe your rights have not been respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of the EU country where you live or work.

Necessary cookies. Talent Master's web page sets session cookies, which are needed to keep you signed in and to secure your account, and keeps preferences such as your language in your browser. They do not require your consent.

No advertising. We use no advertising or social media cookies.

Audience measurement. No audience measurement tool is loaded by the web page, the booking page or this website.

Technical monitoring. The web page sends traces of its requests to our own infrastructure, to diagnose slowness and errors.

We may change this policy, in particular to reflect a change in the law, in the service or in our sub-processors. Each version is dated. For a significant change, we notify workspace administrators by email before it takes effect.