Privacy notice

How we handle personal data in the IdealStaffs talent network, the free CV review, and our contact with companies.

Version v2 · last updated 6 October 2026

Who we are

IdealStaffs-Consulting S.L., CIF B40589459, Calle Cayuco 5, Planta 3, Puerta 5, 46009 Valencia, Spain (“IdealStaffs”, “we”). We are a specialist technology recruitment company. For anything in this notice — including any request about your data — write to [email protected].

In short

• We collect candidate data to find people work, and business contact data to talk to companies about vacancies.
• Candidates register themselves and can see, correct, download or delete their profile at any time through a personal link.
• A human recruiter reviews every assessment before it leaves the building. No decision is made by an algorithm alone.
• We keep candidate data for 12 months of inactivity, with a re-confirmation prompt before anything is erased.
• We do not sell data, we do not buy contact lists, and we run no advertising trackers.

What we collect — candidates

• From you: name, e-mail, phone, city and country, current title, availability, employment preference (permanent or B2B), salary or day-rate expectation, remote preference, work authorisation where a role requires it, and your CV file, which we keep unchanged as uploaded.
• Produced by the platform: the text extracted from your CV; a structured profile (skills, roles, employers and dates, education, certifications, spoken languages) extracted by software and then checked by a recruiter; your consent record (when, to which version of this notice, from which channel); and the history of what we did — who reviewed your file, when we contacted you, what was sent to whom and with your knowledge.
• We do not collect: special categories of data (health, religion, political opinions), photographs or identity documents. Please do not send them.

Why we use it, and on what legal basis

• To assess your profile and propose you for roles — your consent (Article 6(1)(a) GDPR), given at registration. You can withdraw it at any time.
• To keep you in the talent network for future vacancies — your consent, asked separately from the consent to be considered for roles.
• To put you forward to a client for a specific vacancy — your consent, and the steps you ask us to take before any contract with that client.
• To meet legal duties (accounting, contracts, answering authorities) — legal obligation.

Automated processing and AI

Your CV text and, if you use the free CV review, its content are processed by a large-language-model service to extract structured fields and to draft an improved version. What comes back is a draft: a recruiter reads it, corrects it and decides what a client sees. Fields carry their source, and you can see and edit every one of them. We make no decisions with legal or similarly significant effects by automated means, and nobody is rejected automatically (Article 22 GDPR). We do not use your data to train models.

Who sees it

• Our recruiters — a defined list of staff, each with a named account and two-factor authentication.
• A client — only when you are proposed for a defined role, only the material in your candidate file, and we tell you which company before we send it. You can refuse.
• Microsoft (Microsoft 365) — mailboxes and calendar, EU region, for correspondence about you.
• DeepSeek — the large-language-model provider used for CV parsing and the CV review. Our current pilot uses this provider outside the EEA; before we process candidate CVs in production we will either have a written processor agreement with Standard Contractual Clauses in place, or move these two functions to a provider in the European Union (Mistral or an EU-hosted model). This notice names whichever provider is live at the time.
• Our own hosting — a dedicated server in the European Union, for the website, the database and CV storage.

We never sell data and we never share a candidate's identity with a client without telling you first. A client that receives your details for a specific role is a separate controller for its own hiring process.

Client and business contacts

For people at client and prospect companies we hold name, job title, employer, business e-mail and phone, and the record of our correspondence. We obtain these from the person, from the company's own public pages and job adverts, or from professional networks, and we use them to discuss vacancies and our services — our legitimate interest in business-to-business contact (Article 6(1)(f) GDPR). Every message identifies us and carries a working opt-out, and we keep a permanent record of opt-outs so we never contact you again by mistake.

How long we keep it

• Candidate profile and CV — 12 months from your last activity, then erased — the profile, the CV file, the extracted fields, the derived records and the access links, not just what is visible.
• Profile freshness — we ask you to confirm your details after 120 days without activity; if you do not answer within 30 days the profile stops being shown to recruiters, and the retention period above takes it from there.
• Self-service profile links — valid 90 days, and revocable by us at any time.
• Client and business contacts — while the relationship is active, then reviewed. Opt-out records are kept indefinitely, precisely so that an opt-out can be honoured.
• Invoices, contracts and accounting records — as long as Spanish tax and commercial law requires (currently six years).
• Technical logs — sign-in attempts, the anti-abuse records of the public forms, product analytics and finished staff sessions — 12 months, then deleted automatically.
• The audit trail that evidences what we did with your file (who reviewed it, what was sent where, when) is kept while the record it belongs to exists, and is deleted with it when you ask us to erase your profile.

Your rights

• Access — everything we hold is on your own profile page, and we can send you a copy.
• Rectification — correct any field yourself, or ask us to.
• Erasure — delete your profile and CV from your personal link, or by writing to us.
• Restriction and objection, and portability of the data you gave us.
• Withdrawal of consent at any time, without affecting what happened before.
• Complaint to your supervisory authority — in Spain, the AEPD (aepd.es).

We answer requests within one month, free of charge.

Cookies and tracking

The site sets no advertising or analytics cookies. One browser preference — light or dark theme — is stored locally in your browser and never sent to us. We count anonymous product events server-side (for example “registration started” and “registration completed”), with a random identifier, to see whether the process works. Those records cannot identify you and are never combined with a profile.

Security

Access to candidate data requires a named account with two-factor authentication, and every view, edit, export and download is recorded in an audit trail. Sessions expire and can be ended per device. Personal profile links use long random tokens, stored only in hashed form, and can be revoked. CV files sit outside the public website directory and are served only through authenticated endpoints. No passwords are used for staff access — the access codes are stored hashed.

Changes

We version this notice, and the version you accepted is recorded with your consent. If we change anything that matters, we ask you to accept the new version rather than assume it.