1. Initial provisions
1.1 This Privacy Policy is made by explore & beyond s.r.o., having its registered office at Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic, ID No. 09525602, registered in the Commercial Register maintained by the Municipal Court in Prague under No. C 337604 (also “we”, “us” or “our”). We refer to all our products, services, websites, and apps, including in particular (but not limited to) our product “Talentpilot”, collectively as the “Services” in this Privacy Policy.
1.2 We respect the need for privacy and protection of personal information, including but not limited to any personal data.
For the purposes of this Privacy Policy, personal data shall mean any information relating to an identified or identifiable natural person, where an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (the “Personal Data”).
1.3 We always process Personal Data in accordance with this Privacy Policy and applicable legislation, such as Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).
1.4 This Privacy Policy explains how we collect, use and protect Personal Data and the rights available to you.
1.5 We act as a controller where we determine the purposes and essential means of processing Personal Data, including for our own website and business administration and direct personal-use Services where applicable. When we process Personal Data on behalf of a customer using the Services (the “Customer”), we act as a processor or sub-processor under documented instructions and the applicable data processing agreement. The relevant controller’s privacy notice explains that processing.
2. Categories of Personal Data
2.1 Depending on the Services used and your interactions with us, we may process:
- Identification, contact and account information, including names, contact details, account identifiers, and billing and transaction records.
- Professional and organisational information, including CVs, education, employment history, qualifications, roles and team relationships.
- Skills and assessment information, including competencies, preferences, motivations, responses and results from personality, work-culture and other assessments.
- Content and communications, including uploaded documents, messages, prompts, images, transcripts, and audio or video recordings where the relevant feature is used.
- Development and coaching information, including goals, conversations, feedback, plans and progress.
- Generated results and workflow information, including summaries, scores, rankings, recommendations, role matches, application status and actions taken through the Services.
- Technical and usage information, including IP addresses, device and browser information, session identifiers, access logs and activity records.
2.2 These categories include information supplied by you or a Customer, contained in uploaded materials or third-party assessments, or generated through the Services. Such materials and results may also contain or reveal sensitive Personal Data, such as health information, or information about criminal convictions and offences.
3. Purposes of Personal Data processing and data retention
3.1 We obtain, collect and process personal data when:
- you input Personal Data into our Services (such as entering information into forms, uploading your CV, etc.)
- we receive your Personal Data from the Customer, who is acting in a capacity as a data controller of your personal data (in which case we are the processor of Personal Data) or data processor (in which case we are the sub-processor of Personal Data)
3.2 Where we act as a controller, we process Personal Data for the following purposes:
- Providing Services you request, including personal coaching, and managing your account, support and payments, where necessary to perform our contract with you or take steps at your request before entering into it.
- Managing business relationships, responding to enquiries, and maintaining the security and reliability of our Services, based on our legitimate interests in operating and protecting our business, unless your rights and interests override those interests.
- Meeting legal obligations, including applicable accounting and tax requirements.
- Establishing, exercising or defending legal claims, based on our legitimate interest in protecting our rights.
Where processing requires consent, we explain the relevant purpose and obtain consent separately.
3.3 With your consent, we may retain your candidate profile to contact you about similar job opportunities within the scope of that consent, for up to three years from the date you consent. You may withdraw your consent at any time, and we will then stop using your data for this purpose.
3.4 We may process verification information, including video recordings, to check compliance with the terms of use, including anti-cheating checks. We retain it only as long as necessary for verification and no longer than three months after collection. Where we act as a controller, we rely on our legitimate interest in protecting the integrity of the Services, unless your rights and interests override that interest.
3.5 Service data is retained and deleted under the applicable agreement and DPA, including their retrieval and backup deletion provisions. The periods above do not extend any earlier deletion deadline under those documents or applicable law. Records we hold for our own business administration are retained only as long as necessary for the relevant purpose, including applicable accounting requirements and limitation periods for legal claims.
3.6 We use AI agents and third-party models to process Personal Data only to provide, support, maintain and secure the Services, including generating results and checking the quality of the Services provided to you or the Customer. Processing on a Customer’s behalf follows its documented instructions and the applicable DPA.
We do not use Personal Data in uploaded materials, prompts, outputs or logs for model training, fine-tuning or retraining unless separately agreed in writing with the Customer, or with you for direct personal-use Services, and permitted by applicable law. We require providers processing that data for us to comply with the same restriction. The additional restrictions in clause 5.2 apply to Google Workspace API data.
3.7 Depending on the features used, the Services may analyse professional information, skills, assessment results and other relevant inputs to generate profiles, scores, rankings and recommendations. These may influence recruitment, development and internal-mobility opportunities.
Under the GDPR, a fully automated decision that has legal effects or otherwise significantly affects you is permitted only where necessary to enter into or perform a contract with you, authorised by applicable law, or based on your explicit consent, with the required safeguards. Where applicable, you can request human intervention, express your views and challenge the decision.
The relevant controller must explain the decision process, its main factors and likely consequences, and how to exercise your rights. Where we act as controller, we provide that information and handle requests; where we act as processor, we assist the relevant controller under the DPA. You can contact us at dpo@talentpilot.com.
3.8 Our standard Services do not require special categories of Personal Data, such as health information. Such data may nevertheless be contained in information Customers or users provide through the Services, or revealed in results generated from it. We process such data, and data concerning criminal convictions and offences, only as permitted by applicable data-protection law and, where we act on a Customer’s behalf, under the applicable DPA.
4. Transfer of Personal Data
4.1 We and our service providers may process Personal Data outside your country. Where we transfer Personal Data outside the European Economic Area (EEA), including through remote access from outside the EEA, we rely on an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, with any required transfer assessments and supplementary measures.
For Personal Data processed on a Customer’s behalf, transfers and access from outside the EEA also require the prior written approval specified in the applicable DPA.
You can request information about these transfers and a copy of the applicable safeguards by contacting dpo@talentpilot.com.
5. Disclosure of Personal Data
5.1 Where necessary for the purposes described in this Privacy Policy, we may disclose Personal Data to:
- The relevant Customer and its authorised users, where you participate in that Customer’s recruitment or other organisational workflows, subject to applicable access permissions.
- Service providers supporting hosting, AI processing, communications, customer support, analytics, security and payment processing.
- Professional advisers, courts, regulators and other authorities where necessary for professional advice, legal compliance, legal claims or protecting the security of the Services.
- Parties and advisers involved in a proposed or completed merger, acquisition or sale of our business, subject to appropriate confidentiality safeguards.
For Personal Data processed on a Customer’s behalf, disclosures remain subject to the applicable DPA. Our subprocessor register lists the providers engaged for that processing; their appointment and replacement follow the DPA.
5.2 Google Workspace API Data and AI Services
If you connect your Google account, we use data obtained through Google Workspace APIs, including derived data, only to provide, support and secure the user-facing features you enable, such as interview scheduling, candidate communications and summarisation. Processing on a Customer’s behalf remains subject to its documented instructions and the applicable DPA.
We use Google Cloud Vertex AI / Gemini as a managed AI service for this integration. We do not use an in-house, self-hosted or offline model for it. We do not sell this data, use it for advertising, or use or allow providers to use it to train, fine-tune or retrain general-purpose AI or machine-learning models.
Our use and sharing of this data comply with the Google API Services User Data Policy and the Google Workspace user data and developer policy, including their Limited Use requirements. Human access and transfers are limited to cases permitted by those policies. Any transfer as part of a merger, acquisition or sale of assets requires your prior explicit consent.
You can revoke access through your Google Account permissions or, where available, by disconnecting the integration in Talentpilot. Revoking access does not automatically delete data already obtained; retention and deletion follow Section 3.
6. Security
6.1 We maintain technical and organisational measures appropriate to the risks of processing Personal Data. These include access controls, encryption at rest and during transmission over public networks, security logging, vulnerability management, backups and incident response procedures. Access is limited to authorised personnel and providers who need it for permitted purposes and are subject to confidentiality obligations.
6.2 We hold ISO/IEC 27001 certification covering Talentpilot. Where we process Personal Data on a Customer’s behalf, our security obligations are further described in the applicable DPA.
6.3 Please keep your account credentials confidential. No system or method of transmitting or storing data is completely secure.
6.4 If we become aware of a Personal Data breach affecting data processed on a Customer’s behalf, we notify that Customer without undue delay and within 48 hours, in accordance with the applicable DPA.
Where we act as controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to pose a risk to individuals’ rights and freedoms. If the breach is likely to pose a high risk to affected individuals, we also notify them without undue delay, subject to the exceptions in Article 34 GDPR.
7. Your rights
7.1 Subject to the conditions under applicable data-protection law, you have the right to:
- Access your Personal Data and receive a copy and information about its processing.
- Correct inaccurate Personal Data and complete incomplete data.
- Request erasure of your Personal Data or restriction of processing.
- Object to processing based on legitimate interests or a public-interest task for reasons relating to your particular situation, and object to direct marketing at any time.
- Receive Personal Data you provided in a structured, commonly used and machine-readable format where processing is automated and based on consent or a contract with you, and have it transferred directly to another controller where technically feasible.
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- Exercise the rights relating to automated decisions described in clause 3.7.
Requests are generally free of charge. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, as permitted by applicable law.
7.2 To exercise your rights or ask about our processing of Personal Data, contact dpo@talentpilot.com.
Where we act as controller, we respond without undue delay and within one month of receiving your request. Where necessary because of the complexity or number of requests, we may extend this period by up to two further months, explaining the extension within the initial month. If we have reasonable doubts about your identity, we may request information necessary to verify it.
Where we process data on a Customer’s behalf, we forward requests concerning that data to the Customer without undue delay and assist the relevant controller under the applicable DPA.
7.3 You may lodge a complaint with any competent supervisory authority.
8. Surveys and testimonials
8.1 Participation in our surveys about your experience of the Services is voluntary. We use the responses and any contact or professional details you choose to provide to understand user satisfaction and improve the Services, based on our legitimate interest in obtaining feedback, unless your rights and interests override that interest. We send you survey results only if you request them.
8.2 We may publish testimonials or quotes you share through our surveys. You can request correction or removal by contacting hello@talentpilot.com.
9. Final provisions
9.1 Our Services may contain links to third-party websites. Please review their privacy policies before providing Personal Data through those websites.
9.2 Individuals registering for personal use must be at least 18 years old. Where we process Personal Data about minors on a Customer’s behalf, that processing follows the applicable DPA and data-protection law. If you have concerns about a minor’s Personal Data, contact dpo@talentpilot.com.
9.3 We may update this Privacy Policy to reflect changes in our Services, practices or legal requirements. We will publish the updated version with its effective date and notify you of material changes by email or another appropriate means before they take effect.
9.4 If you have any questions about this Privacy Policy or our privacy practices, please contact us by e-mail at dpo@talentpilot.com.
9.5 In the event of any differences between the language versions of this Privacy Policy, the English language version shall prevail.
