Privacy policy

1. Who we are

DonkeyTalent is a web service that reads CVs in PDF format, compares them with a job offer and sends by email a report that ranks the candidates. This policy explains which personal data we process, why, for how long and what rights you have.

For the data of the person who buys the service, the data controller is DonkeyTalent. You can write to us at any time at info@donkeytalent.com.

2. What data we process and why

Data	Purpose	Legal basis
Name and email address of the buyer	To provide the service, send the report and answer your questions.	Performance of the contract (Art. 6(1)(b) GDPR).
Amount, date and reference of the payment	To manage the charge and meet tax and accounting obligations. We never see or store your card number: Stripe processes the payment.	Performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).
IP address and technical access logs	To keep the service secure and detect abuse.	Legitimate interest (Art. 6(1)(f) GDPR).
The messages you send us	To reply to you.	Legitimate interest and performance of the contract.

3. The CVs you upload

CVs contain personal data of the candidates. For that data, you are the data controller and DonkeyTalent acts as data processor: we process it only on your behalf and following your instructions. This section and the terms and conditions form the data processing agreement required by Article 28 of the GDPR.

• Subject matter and purpose: to read each CV, extract its data, compare it with your offer, score and summarize it, and produce and send you the report.
• Duration: from the moment you upload the files until they are deleted as described in section 6.
• Data and people concerned: whatever each CV contains (identification, contact details, education, experience, languages and other professional data) about the candidates.
• Instructions: we process the CVs only to produce your report. We do not use them for any other purpose, we do not sell them, we do not disclose them to third parties and we do not use them to train our own models.
• Confidentiality and security: access is limited to those who need it to provide the service, and we apply the measures in section 8.
• Sub-processors: we use the providers described in section 5, under contracts that require the same level of protection.
• Candidates' rights: we will help you, as far as we can, to answer candidates' requests. If a candidate contacts us, we will pass the request on to you.
• End of the service: we delete the data within the periods in section 6 and, if you ask earlier by email, as soon as possible.
• Information and audits: on request, we will provide the information needed to show that we meet these obligations.

Your responsibilities as a customer: you must have a legitimate reason to process those CVs, have informed the candidates where the law requires it, and not upload data you do not need for the selection process.

4. Automated analysis

To produce the report, the CVs are analyzed by automated systems, including artificial intelligence, which extract data, calculate a score from 0 to 100 and write a summary.

The report is an aid, not a decision. DonkeyTalent does not make decisions about any candidate: the hiring decision is always taken by a person, who should not base it solely on the score. The automatic score may contain errors, so it is advisable to review the CVs of the candidates you are interested in.

5. Who we share data with

We do not sell personal data. To provide the service we rely on providers that act as data processors, in these categories:

• hosting and computing infrastructure;
• file storage;
• email delivery;
• payment processing (Stripe);
• automated analysis of the CVs.

Some of these providers may be located outside the European Economic Area. In that case, the transfer relies on a European Commission adequacy decision or on standard contractual clauses. We may also disclose data to the authorities when the law requires us to.

6. How long we keep the data

• CVs, the data extracted from them and the report: deleted 30 days after we send you the report.
• If you do not complete the payment: the offer and the CVs you uploaded are deleted within 7 days at most.
• Your name, your email and the payment record: kept for the periods required by tax and commercial law and deleted afterwards.
• Your messages: for as long as needed to answer them.

7. Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection by writing to info@donkeytalent.com. We reply within one month at most.

If you are a candidate and your data appears in a CV uploaded by the person or company evaluating you, please contact them first: they are responsible for your data. If you write to us, we will tell you how to do it and pass your request on to them.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the authority of your country of residence.

8. Security

We protect data with appropriate technical and organizational measures: encrypted connections (HTTPS), private storage of files, restricted access and automatic deletion within the periods stated above. No system is completely invulnerable, but we will act quickly and inform you if a breach affects your data.

9. Cookies

We only use technical cookies, which are essential for the site to work. That is why we do not show a consent banner.

Cookie	What it is for
csrftoken	Protects the forms against unauthorized submissions.
django_language	Remembers the language you chose.

We do not use analytics, advertising or tracking cookies. Stripe's payment page is a third-party site and may use its own cookies, as described in its policy.

10. Minors

The service is intended for people aged 18 or over.

11. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date.