Privacy Policy

1. Who we are

SkillsFound is operated by Hire Away d.o.o., a company registered in Croatia with registered address at Bijankinijeva 8, Split, Croatia (OIB: 20142368767). References to "we", "us", or "our" in this policy refer to Hire Away d.o.o.

We are the data controller for personal data collected through the SkillsFound platform at skillsfound.com. If you have any questions about this policy or how we handle your data, please contact us at [email protected].

2. What data we collect

We collect the following categories of personal data:

Account data: your name, email address, and account type (candidate or employer), collected when you register.

Candidate profile data: your location, work preferences, employment type preferences, skills, bio, years of experience, qualifications and certifications, and CV document, provided by you when building your profile.

Employer data: your name, company name, company location, and job post details including role descriptions, required skills, salary information, and custom questions.

Application data: when you apply to a role, we store your application, any answers to custom questions, and the match status.

Payment data: we do not store payment card details. Payments are processed by Stripe, Inc. We retain only the outcome of a transaction (paid or not paid) and a Stripe customer reference for subscription management. Stripe's privacy policy is available at stripe.com/privacy.

Usage data: standard server logs including IP address, browser type, and pages visited. We use this solely for security and platform maintenance.

Cookie data: we use only essential session cookies required to keep you logged in. We do not use advertising or tracking cookies.

3. How we use your data

We process your personal data for the following purposes:

To provide the platform: to operate your account, display your profile to relevant employers, match candidates to job posts, and facilitate the hiring process.

To process payments: to manage employer subscriptions and pay-per-post transactions via Stripe.

To communicate with you: to send email confirmations, match notifications, and platform updates. We do not send marketing emails without your consent.

To maintain platform integrity: to detect and prevent fraud, investigate reports of suspicious activity, and enforce our Terms and Conditions.

To comply with legal obligations: to meet our obligations under EU law including GDPR, Croatian company law, and any applicable employment or tax regulations.

Our legal bases for processing under GDPR are: performance of a contract (operating your account and providing the service), legitimate interests (fraud prevention, platform security, and improving the service), and legal obligation where applicable.

4. Who we share your data with

We do not sell your personal data to any third party.

We share data with the following categories of service providers who process it on our behalf:

Supabase, Inc. (United States): database and authentication infrastructure. Data is stored on servers in the EU where available. Supabase acts as a data processor under a data processing agreement.

Stripe, Inc. (United States): payment processing. Stripe is an independent data controller for payment data. Refer to Stripe's privacy policy for details.

Cloudflare, Inc. (United States): website hosting, deployment infrastructure, and DNS management.

Resend, Inc.: transactional email delivery (confirmation emails and notifications).

All third-party providers are subject to data processing agreements and are required to process data only as instructed by us and in accordance with applicable data protection law.

Candidate contact details and CVs are shared with employers only at the point of match, as described in our How It Works page. Employer contact details are never shared with candidates through the platform.

5. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or tax compliance purposes (typically up to 7 years for financial records).

CVs uploaded to the platform are stored until you replace them with a new upload or delete your account. Only the most recent version of your CV is retained.

Fraud reports are retained for up to 3 years for platform integrity purposes.

6. Your rights under GDPR

As a data subject in the European Union, you have the following rights:

Right of access: you can request a copy of the personal data we hold about you.

Right to rectification: you can correct inaccurate data directly through your account settings, or by contacting us.

Right to erasure: you can request deletion of your account and all associated personal data. We will action this within 30 days subject to any legal retention requirements.

Right to restriction: you can ask us to restrict processing of your data in certain circumstances.

Right to data portability: you can request a copy of your data in a structured, machine-readable format.

Right to object: you can object to processing based on our legitimate interests.

Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) at azop.hr, or with any EU supervisory authority.

7. Cookies

We use only essential cookies required to operate the platform. These include session cookies that keep you logged in while you use the site.

We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

You can decline non-essential cookies via the cookie banner when you first visit the site. Declining cookies will not prevent you from using the platform, but you will need to log in each session.

8. International data transfers

Some of our service providers are based outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or reliance on providers certified under equivalent adequacy frameworks.

9. Security

We take reasonable technical and organisational measures to protect your personal data, including encrypted data storage, access controls, and secure HTTPS connections. However, no system is completely secure and we cannot guarantee absolute security of your data.

Payment data is handled entirely by Stripe and is never transmitted to or stored on our servers.

10. Children

SkillsFound is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us at [email protected] and we will delete the account promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are significant, we will notify registered users by email. The date at the top of this page indicates when the policy was last updated. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

12. Contact us

For any privacy-related questions, requests, or complaints:

Hire Away d.o.o. Bijankinijeva 8, Split, Croatia OIB: 20142368767 Email: [email protected]