Our commitment to EU data protection · Last reviewed: 26 June 2026
SkillFlug Talent Hub is fully compliant with the EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and the German Federal Data Protection Act (BDSG neue Fassung).
Data Minimisation
We collect only the personal data strictly necessary for recruitment purposes.
Purpose Limitation
Data is used only for the specific purpose it was collected — equestrian talent placement.
Lawful Basis
Every processing activity has a documented legal basis under Art. 6 GDPR.
Security by Design
End-to-end encryption, access controls, and regular security audits.
Storage Limitation
Data is deleted or anonymised when no longer needed for its original purpose.
Accuracy
Processes in place to keep personal data accurate and up to date.
| Activity | Data Categories | Legal Basis | Retention |
|---|---|---|---|
| Employer Registration | Business & contact data | Contract (Art. 6(1)(b)) | 7 years |
| Candidate Profiles | Identity, professional, biometric | Consent (Art. 6(1)(a)) | 3 years |
| Document Storage | Passports, certificates | Contract (Art. 6(1)(b)) | 6 months post-placement |
| Email Communications | Email address, content | Contract (Art. 6(1)(b)) | 3 years |
| Platform Analytics | Usage data (anonymised) | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Financial Records | Invoice, payment data | Legal obligation (Art. 6(1)(c)) | 10 years |
Access Request (Art. 15)
Email privacy@skillflug.com with subject "Data Access Request". We provide a full data export within 30 days at no charge.
Erasure Request (Art. 17)
Email privacy@skillflug.com with subject "Erasure Request". We delete all data within 30 days, except where legal retention obligations apply.
Rectification (Art. 16)
Update your profile directly in the platform, or email us for data we hold that you cannot self-edit.
Data Portability (Art. 20)
Request a machine-readable export (JSON/CSV) of your personal data via email.
Withdraw Consent (Art. 7(3))
Withdraw consent for any consent-based processing at any time via your account settings or by email.
Object to Processing (Art. 21)
Object to processing based on legitimate interests by emailing privacy@skillflug.com with your specific objection.
Where personal data is transferred outside the EU/EEA, we ensure adequate protection through:
Standard Contractual Clauses (SCCs)
EU Commission-approved SCCs are in place with all non-EU processors (e.g., email service providers).
EU Data Residency
Primary database (Supabase) stores data within the EU. No candidate data is stored outside the EU without explicit consent.
Adequacy Decisions
Where available, we rely on EU adequacy decisions for third-country transfers.
In the event of a personal data breach, SkillFlug will:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2–4, 40213 Düsseldorf, Germany
Website: www.ldi.nrw.de
You have the right to lodge a complaint with this authority if you believe your data protection rights have been violated.
Response Times
Data subject requests: 30 days
Breach notifications: 72 hours
General enquiries: 5 business days