Privacy policy
Van kracht vanaf 2 november 2026
1. Summary
- Skileo is an online platform that companies use for recruiting, HR and accounting.
- If you are a customer or a user of a customer’s account, Skileo is responsible (as controller) for your account, billing, support and security data. See section 4.1.
- If you are a candidate, Skileo is responsible for your personal candidate account: your login and the profile you reuse to apply. Each company you apply to is responsible for the application it receives. See sections 4.2 and 5.
- If you are an employee or another person whose data a company manages in Skileo, that company is responsible for the data. Skileo processes it on the company’s behalf. See section 5.
- We do not sell personal data and do not use it for third-party targeted advertising.
- Our main hosting is in the European Union. Some service providers may process data outside it, with the safeguards described in section 7.
- Contact: hello@skileo.com.
2. Who we are
Skileo is Skileo Ltd, a company registered in the Bulgarian Commercial Register under UIC 203606546, VAT number BG203606546, with its registered office at 119 Oborishte Str., 1505 Sofia, Bulgaria (“Skileo”, “we”, “us”).
Data protection contact: hello@skileo.com. All data protection questions can be sent to this address.
This policy applies to the Skileo website, web application, mobile applications, public pages hosted by Skileo (careers pages, job offers, shared quotes and invoices), and our customer support.
3. Who is responsible for what
The GDPR distinguishes the controller, who decides why and how personal data is used, from the processor, who handles data on the controller’s behalf. Skileo has both roles, depending on the data.
| Data | Controller | Skileo’s role | Explained in |
|---|---|---|---|
| Customer accounts, subscriptions, billing and support | Skileo | Controller | Section 4.1 |
| Login, authentication and security of all accounts, including employees’ access to the employee area | Skileo, for the security of the Service | Controller | Section 4.1 |
| Visits to our website and public pages | Skileo | Controller | Section 4.1 and Cookie Policy |
| A candidate’s personal account and reusable profile | Skileo | Controller | Section 4.2 |
| Applications received by a company | The company | Processor | Section 5 |
| Employee records and HR data, including what employees enter in the employee area | The company | Processor | Section 5 |
| Clients, suppliers, invoices and bank data of a company | The company | Processor | Section 5 |
Where Skileo acts as a processor, it follows the company’s instructions under the Data Processing Agreement in Annex A of the Terms of Service.
4. Data we process as controller
Where the data comes from. From you when you sign up, use the Service or contact us; from the person who invites you to a Workspace (your name and email); from your device (technical data); and from our payment provider (payment status). Information marked as required is needed to open an account.
Legal basis for business users. Where the customer is an individual, such as a sole trader, we process their account and billing data to perform our contract with them (Art. 6(1)(b) GDPR). Where the customer is a company, its directors and employees are not parties to the contract; we process their data on the basis of our and the customer’s legitimate interest in providing and administering the Service (Art. 6(1)(f)).
4.1 Customers, users and visitors
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Creating and administering accounts, providing the Service | Name, email, phone, job title, company, photo, language, password (stored hashed), permissions | Contract or legitimate interest, as explained above | While the account exists, then deleted after a short period allowing reactivation |
| Subscription, invoicing and payment | Billing contact details, VAT number, plan, invoices, payment status (card details stay with the payment provider) | Contract or legitimate interest; legal obligation for invoices and accounting records (Art. 6(1)(c)) | Accounting and tax documents: for the periods required by Bulgarian accounting and tax law. Other billing data: until the limitation period for claims under the contract expires |
| VAT number checks | Company VAT number and name | Legal obligation | With the billing records |
| Security of the Service and fraud prevention, including for visitors of public pages | IP address, device and browser, login times, two-factor codes, approximate location derived from the IP address, security alerts | Legitimate interest in keeping the Service secure (Art. 6(1)(f)); security obligation (Art. 32) | For the period needed to detect and investigate incidents, then deleted |
| Customer support | Messages, chat history, attachments, account details | Contract or legitimate interest | For the period needed to handle the request and any follow-up, then deleted |
| Service emails (security alerts, billing, changes to terms) | Name, email | Contract or legitimate interest; legal obligation where we must inform you | While the account exists |
| Information about Skileo’s services to existing customers, where we send it | Name, email, company | Legitimate interest, within the limits of applicable e-marketing rules; every email includes an unsubscribe link | Until you unsubscribe or the customer relationship ends |
| Website and app statistics | Pages viewed, device data, pseudonymous identifiers | Consent, collected through the cookie banner; see the Cookie Policy | See the Cookie Policy |
| Improving the Service | Usage events linked to an account, used to produce statistics | Legitimate interest | Identifiable events are kept for a limited period, then deleted or made anonymous. Anonymous statistics are no longer personal data |
| Legal claims and requests from authorities | Data relevant to the claim or request | Legitimate interest in defending our rights; legal obligation | Until the matter is closed and limitation periods expire |
4.2 Candidate accounts
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Creating your account and logging you in | Name, email, password (stored hashed), login and security data | Contract with you, under the terms you accept when creating the account (Art. 6(1)(b)); legitimate interest for security | While the account exists |
| Keeping your profile so you can reuse it to apply | The information you put in your profile: CV, experience, education, skills, contact details, preferences | Contract with you | While the account exists. You can edit or delete it at any time by contacting us |
| Sending an application at your request | The application you choose to send | Contract with you | Once sent, the application is held by the company (section 5) |
| Emails about your account | Name, email | Contract with you | While the account exists |
Who sees your profile. Companies see only the applications you send them. They cannot browse or search candidate accounts.
Inactive accounts. We delete a candidate account after a period of inactivity, after warning you by email.
Deleting your account. If you ask us to delete your account, we delete it and your profile without undue delay, except data we must keep by law. Applications you have already sent stay with the companies that received them; contact them to ask for deletion.
4.3 Automated decisions
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated security controls may temporarily block access, for example after repeated failed logins; you can contact us to have this reviewed by a person.
Where we rely on legitimate interest, you can object at any time (section 9). Data in backups is erased when the backup is overwritten.
5. Data we process on behalf of our customers
5.1 Who is responsible. When a company uses Skileo to manage candidates, employees, clients or suppliers, that company is the controller. It decides what data to collect, why, and for how long. It must inform you and have a legal basis. Skileo processes the data only to provide the Service to that company, under a Data Processing Agreement.
5.2 What data this covers.
| You are | Data the company may hold in Skileo |
|---|---|
| Candidate | Contact details, CV, cover letter, experience, education, skills, languages, certificates, references, links to social profiles, desired salary, work preferences. Optional: date of birth, nationality, gender, social-security number. The company’s own notes: application history, interview notes, ratings, comments, messages. |
| Employee | Position, contract, manager, dates, salary and benefits, working hours, leave and absences, supporting documents (which may include sick notes, i.e. health data), timesheets, emergency contacts, assigned equipment, documents, survey answers and suggestions, departure details. |
| Emergency contact or reference | Name, relationship, contact details. |
| Client or supplier of the company | Name, company, address, email, quotes, invoices, payment status, bank details (IBAN). |
| Counterparty in a bank transaction | Name and reference shown in the company’s bank statement, amount, date. |
| Anyone | Content of messages, comments, free-text fields and uploaded files. |
5.3 How the company obtained your data. As a candidate, you may have applied through a careers page or your candidate account, or the company may have added you itself (manually, by importing a file, or from a sourcing list). If the company added you without an application, it must inform you within a reasonable period and at the latest one month after obtaining your data; earlier if it contacts you (at the latest at that first contact) or discloses your data to another recipient (at the latest when it first does so). As an employee, the data comes from you, your employer and your colleagues who use the Service.
5.4 Applications sent from a candidate account. When you apply from your Skileo candidate account, a copy of your application goes to the company, which becomes its controller. Skileo stores it for the company as its processor. Your account itself remains under Skileo’s responsibility (section 4.2).
5.5 Health data and identification numbers. A company may record health data, for example a medical certificate attached to an absence request. Health data is a special category of data: besides a legal basis, the company needs one of the conditions in Article 9 GDPR, such as obligations under employment or social-security law. A company may also record national identification numbers, such as a social-security number, under the conditions set by national law. The company is responsible for limiting access to these documents to the people who need it.
5.6 How long the data is kept. The company sets the retention period. When a company deletes data or closes its account, Skileo deletes the data as set out in clause 20 of the Terms of Service.
5.7 Your rights over this data. For data described in this section, including applications you sent, contact the company: it is responsible for answering. If you contact Skileo, we forward your request to the company without delay and help it reply. For your candidate account itself, contact Skileo directly (section 9).
6. How specific features use data
Login security. Security features include two-factor authentication by SMS or email and alerts when an account is accessed from a new location. The location is approximate (country and city) and derived from the IP address. We do not use GPS or your device’s precise location.
Activity log. The Service records actions taken in a Workspace (who created, changed or deleted what, and when). Users whom the company authorises can view this log. It helps the company investigate errors and misuse, and it is kept and deleted together with the company’s other Workspace data.
AI features. AI features help write job offers, read purchase invoices, and structure postal addresses. When a user chooses to use one, we send the content needed for that task to our AI provider, listed in the Annex: for example the draft job offer, or the uploaded invoice document. The output is a suggestion that the user must review. No AI feature evaluates, ranks, selects or rejects candidates or employees. Our AI provider’s terms for business customers do not allow it to use this content to train its models; it may keep the content for a limited period for abuse monitoring, according to its terms and our configuration. Using AI features is optional.
Anonymous surveys and suggestions. When a survey or the suggestion box is set to anonymous, the Service does not show your employer who wrote an answer. Your answer still counts as personal data: Skileo keeps a technical link between the answer and your account, for example to prevent duplicate answers, and does not use it to identify you unless the law requires it. Your employer may still be able to guess who wrote an answer from its content, from the time it was given, or when a group is very small.
Online invoice payment. If you pay a company’s invoice online, your card payment is handled by Stripe. Skileo does not see or store your full card number. Stripe processes some data on the company’s behalf and acts as an independent controller for its own obligations, such as fraud prevention and anti-money-laundering checks; see Stripe’s privacy policy.
Bank connections. A company can connect its bank accounts through a licensed account information service provider (Powens or GoCardless). You log in directly with your bank; Skileo never receives your bank credentials. Skileo receives the account details and transactions and stores them for the company. These providers act as controllers for their regulated activity; see the Annex for their privacy policies.
Public pages. Careers pages and job offers are public. Quotes and invoices shared by link can be opened by anyone who has the link. We log basic technical data when these pages are viewed, for security.
Support chat. If you use the in-app support chat, it is provided by Crisp, which receives your name, email, company and the content of the conversation.
7. Who receives data, and international transfers
7.1 Within Skileo. Only staff who need access for their job (support, engineering, billing) can access personal data. They are bound by confidentiality. Access to Customer Data is limited to what is needed to provide support or keep the Service running.
7.2 Inside a Workspace. Authorised users of a company see the data their permissions allow. Candidates and employees see what the company shares with them.
7.3 Service providers. We use the providers listed in the Annex. They process data only on our instructions under a written contract, except where the Annex states that a provider acts as an independent controller.
7.4 Other recipients. We disclose data to authorities or courts only where the law requires it, after checking that the request is lawful. If all or part of our business is sold or merged, data may pass to the buyer, which must continue to protect it in accordance with data protection law. We will inform affected customers in advance.
7.5 Where data is stored. The Service, its database and uploaded files are hosted in the European Union. Service providers listed in the Annex may access or process some data in other locations, as stated there.
7.6 Transfers outside the EEA. Some providers are based in, or may access data from, countries outside the European Economic Area, mainly the United States. We transfer data only where one of these safeguards applies, as stated for each provider in the Annex:
- the European Commission has adopted an adequacy decision for the country, or, for the United States, the specific recipient is certified under the EU–US Data Privacy Framework;
- the European Commission’s Standard Contractual Clauses, with additional measures where needed.
You can ask for a copy of the relevant safeguard at hello@skileo.com.
8. Security
We protect data with technical and organisational measures such as encrypted connections, hashed passwords, two-factor authentication, separation of each customer’s data, permissions, logging and backups. The measures are listed in Appendix 1 to the Data Processing Agreement in our Terms of Service. No system is completely secure.
Personal data breaches. If a breach affects data for which Skileo is controller (section 4), we notify the competent supervisory authority within 72 hours where required, and inform you without undue delay if the breach is likely to create a high risk for you. If a breach affects data we process for a company (section 5), we inform that company without undue delay; the company then decides on any notification to the authority and to you.
9. Your rights
Under the GDPR, you have the right to:
- access your data and receive a copy;
- correct inaccurate or incomplete data;
- delete your data, in the cases set out in Article 17 GDPR;
- restrict processing in certain cases;
- object to processing based on legitimate interest, and to direct marketing at any time;
- receive data you gave us in a structured, commonly used format and have it sent to another controller, where processing is based on consent or contract and carried out by automated means;
- withdraw your consent at any time, without affecting earlier processing.
Who to contact.
- For your customer account, your user account or your candidate account (section 4): email hello@skileo.com from the address linked to your account, or write to our postal address. You can also update most details yourself in your settings.
- For data a company holds about you, including applications you sent to it (section 5): contact the company.
We will reply within one month. We may extend this by two further months for complex or numerous requests, and will tell you why. We may ask you to confirm your identity. Requests are free, unless they are manifestly unfounded or excessive.
Complaints. You can complain to the data protection authority of the EU country where you live or work, or where an alleged breach took place. Skileo’s lead authority is the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg. We would appreciate the chance to address your concern first.
10. Children
Candidate accounts are for people aged 16 or over. If we learn that a candidate account belongs to someone younger, we will close it and delete it. Where a company holds data about a minor in its Workspace, for example an apprentice, the company is responsible for that data under section 5.
11. Cookies
We use cookies and similar technologies on our website and in the Service. Non-essential cookies are used only with your consent. See the Cookie Policy.
12. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. We will inform account holders of significant changes by email or in the Service before they take effect. Previous versions are available on request.
13. Contact
Skileo Ltd, 119 Oborishte Str., 1505 Sofia, Bulgaria · hello@skileo.com
This policy is written in English. Translations are provided for convenience; if they differ, the English version prevails.
Annex — Service providers and sub-processors
As of November 2026. Some providers are used only when the related feature is enabled, or as a backup provider.
Processors — they act only on Skileo’s instructions.
| Provider | Purpose | Data location | Safeguard outside the EEA |
|---|---|---|---|
| OVHcloud | Hosting of the application, database and files | European Union | Standard Contractual Clauses for limited remote maintenance access |
| Bird (Bird B.V., Netherlands) | Sending emails (SparkPost) and SMS login codes | European Union; email may be processed in the United States depending on the service region | Standard Contractual Clauses; EU–US Data Privacy Framework (Bird.com Inc.) |
| Twilio (Twilio Ireland Limited) | Sending SMS login codes | United States | EU–US Data Privacy Framework (Twilio Inc.); Binding Corporate Rules; Standard Contractual Clauses |
| OpenAI (OpenAI Ireland Ltd.) | AI features | United States | Standard Contractual Clauses |
| geoPlugin (GEOPLUGIN SAS, France) | Approximate location from IP address at login | France and Netherlands | Not applicable |
| Crisp (Crisp IM SAS, France) | In-app support chat | Netherlands and Germany | Not applicable for stored data |
| Google Analytics (Google Ireland Limited) | Website and app statistics, with consent | EU collection servers; Google LLC, United States | EU–US Data Privacy Framework (Google LLC); Standard Contractual Clauses |
| Google Fonts (Google) | Web font delivery; receives the visitor’s IP address | United States | EU–US Data Privacy Framework (Google LLC) |
Independent controllers — they decide on their own use of the data, under their own privacy policies.
| Provider | Purpose | Data location | Safeguard outside the EEA |
|---|---|---|---|
| Powens (Powens SAS, France) | Bank account connection, as a licensed account information service provider | European Union | Not applicable |
| GoCardless Bank Account Data (GoCardless SAS, France) | Bank account connection, as a licensed account information service provider | United Kingdom and other locations used by its providers | EU adequacy decision for the United Kingdom; other safeguards under GoCardless’s privacy policy |
Provider with both roles
| Provider | Purpose | Data location | Safeguard outside the EEA |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Limited, Ireland) | Processor for Skileo’s subscription billing and for online payment of customers’ invoices; independent controller for its own regulatory obligations, such as fraud prevention and anti-money-laundering | European Union and United States | EU–US Data Privacy Framework (Stripe, LLC); Standard Contractual Clauses |
Public authority. To check customers’ VAT numbers, Skileo queries the European Commission’s VIES service. The Commission is not a Skileo provider and is governed by Regulation (EU) 2018/1725.
Customers are informed of new or replacement sub-processors as set out in clause 7.4 of the Terms of Service.