PairSkill
Build your profile

Data processing agreement

The terms under which PairSkill processes candidate data on behalf of employers (GDPR art. 28).

Last updated October 13, 2026 · version 2026-10

On this page
Draft for review — this text has not yet been checked by a lawyer and is not final.

Parties and roles

For candidate data an employer receives through PairSkill (rankings, profiles revealed after an accepted invitation, conversations), the employer is the controller and PairSkill is the processor. For everything else, PairSkill is an independent controller (see the privacy policy).

What is processed

Subject matter: matching candidates to the employer's roles, invitations, messages and hire records.

Data subjects: candidates who match, are invited by, or talk to the employer.

Data: skills and levels, country and work preferences, name and contact details once shared, messages.

Duration: while the employer's account is active, then deletion within 30 days.

Our commitments as processor

We process candidate data only to provide PairSkill and on your documented instructions; keep it confidential; secure it (encryption in transit and at rest, row-level access control, EU storage); use only the sub-processors listed below and tell you before adding one; help you answer data subject requests; notify you of a personal data breach without undue delay and within 48 hours of becoming aware; delete or return the data when you leave; and make information available to demonstrate compliance.

Your commitments as controller

Use candidate data only to recruit for the role concerned, keep a lawful basis for it, inform candidates about your own processing, make hiring decisions with human review, and don't export data from PairSkill for unrelated purposes.

Sub-processors

Candidate data is stored in the EU. These sub-processors are bound by terms at least as protective as this agreement:

List last changed October 19, 2026. We tell customers before adding a processor.

  • Supabase

    Purpose
    Database, authentication, file storage
    Data
    All account and profile data
    Where
    EU (Frankfurt, eu-central-1)
    Transfer safeguard
    None (stays in the EU)

  • Vercel

    Purpose
    Web hosting and serverless functions
    Data
    Requests and technical logs
    Where
    EU (Frankfurt, fra1)
    Transfer safeguard
    EU–US Data Privacy Framework and Standard Contractual Clauses

  • Stripe

    Purpose
    Payments, invoices, VAT
    Data
    Billing contact, address, VAT ID
    Where
    EU and US
    Transfer safeguard
    EU–US Data Privacy Framework and Standard Contractual Clauses

  • Resend

    Purpose
    Transactional email
    Data
    Email address, notification text
    Where
    EU (Ireland, eu-west-1)
    Transfer safeguard
    EU–US Data Privacy Framework and Standard Contractual Clauses

  • Anthropic via Vercel AI Gateway

    Purpose
    Reading CVs and job ads you upload, profile suggestions
    Data
    Only the text or file you submit
    Where
    US
    Transfer safeguard
    Standard Contractual Clauses; zero data retention (not stored, not used for training)

  • Cloudflare R2

    Purpose
    Encrypted weekly database backups
    Data
    All data, encrypted before upload (the provider cannot read it)
    Where
    EU (jurisdiction-restricted bucket)
    Transfer safeguard
    EU–US Data Privacy Framework and Standard Contractual Clauses

Transfers and liability

Transfers outside the EEA rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. Liability follows the terms of service. This agreement is accepted electronically by the company owner and applies to the whole company team.