Privacy Policy

SUMMARY OF KEY POINTS

1. WHAT INFORMATION DO WE COLLECT?

1.1 Information you provide to us

We collect personal information that you voluntarily provide when expressing an interest in our services, or contacting us directly.

For candidates (job seekers):

• Full name, email address, and phone number
• CV / resume and professional experience
• Job title, desired location, and salary expectations
• Technical skills and stack (programming languages, tools, frameworks)
• LinkedIn profile URL and portfolio links
• Cover letter or personal statement (if needed)

For client companies (recruiters):

• Company name, address, and industry
• Contact person name, job title, and email address
• Job offer details (title, description, requirements, location, salary range)
• Billing information (where applicable)

1.2 Information collected automatically

When you visit our website, we automatically collect through Web analytics tools and Database providers certain technical information, including:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device type and screen resolution
• Cookie data and similar tracking technologies (see Section 7)

This information is used for security, analytics, and platform improvement purposes only.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for the following purposes:

• To match candidate profiles with relevant job opportunities
• To share candidate CVs and profiles with client companies and partners in the context of active recruitment processes
• To respond to your enquiries and provide customer support
• To detect, prevent, and address fraud or security incidents
• To comply with our legal obligations under applicable law

3. LEGAL BASES FOR PROCESSING (GDPR)

For users in the European Union, European Economic Area, or United Kingdom, we process your personal data on the following legal bases:

Consent (Article 6(1)(a) GDPR)

We rely on your explicit consent for: sharing your CV and profile with client companies and recruitment partners; sending aligned offers that match candidate skills; placing non-essential cookies on your device. You may withdraw your consent at any time by contacting us at privacy@yupe.io.

Performance of a contract (Article 6(1)(b) GDPR)

We process your data to fulfil our contractual obligations to you, including delivering the recruitment and talent placement services you have registered for.

Legitimate interests (Article 6(1)(f) GDPR)

We process your data where necessary for our legitimate business interests, including platform security, fraud prevention, service improvement, and analytics, provided these interests do not override your fundamental rights.

Legal obligation (Article 6(1)(c) GDPR)

We process your data where required by applicable law, including tax, accounting, and anti-money laundering obligations.

4. HOW LONG DO WE KEEP YOUR INFORMATION?

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

• Candidate profiles: deleted or anonymised after 24 months of inactivity, in line with CNIL guidance for recruitment data
• Client company data: retained for 5 years after the last transaction for legal and accounting purposes
• Job offer data: retained for 12 months after the position is closed
• Application and communication logs: retained for 3 years
• Financial and billing records: retained for 10 years as required by French accounting law

5. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

Client companies and recruitment partners

With your consent, we share candidate CVs, profiles, and contact details with client companies and partner organisations actively seeking to fill roles. This is the core purpose of Yupe.io.

Service providers

We share data with carefully selected third-party service providers who process it on our behalf, including: cloud hosting providers, email delivery services, analytics tools, and customer support platforms. All service providers are bound by data processing agreements and are prohibited from using your data for any purpose other than delivering services to us.

Business transfers

If Yupe.io is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Legal requirements

We may disclose your data to law enforcement, regulatory authorities, or courts where required by applicable law or to protect the rights and safety of Yupe.io, our users, or third parties.

6. THIRD-PARTY DISCLAIMER (CV AND PROFILE SHARING)

7. DO WE USE COOKIES AND TRACKING TECHNOLOGIES?

Yes. We use cookies and similar tracking technologies to operate and improve our platform. These include strictly necessary cookies (required for the site to function), functional cookies (to remember your preferences), and analytics cookies (to understand how the site is used).

You can control your cookie preferences through our cookie banner or by adjusting your browser settings. For full details, please refer to our Cookie Policy available at https://yupe.io/cookie-policy.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

We implement appropriate technical and organisational security measures to protect your personal data, including:

• HTTPS encryption for all data transmitted between your browser and our servers
• Access controls limiting data access to authorised personnel only
• RLS policies for our database
• Regular security audits and vulnerability assessments

However, no system is entirely secure. In the event of a data breach that is likely to affect your rights, we will notify you and the relevant supervisory authority within the timeframe required by applicable law.

9. DO WE COLLECT INFORMATION FROM MINORS?

No. Yupe.io is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, please do not use our platform or submit any personal data. If you believe we have collected data from a person under 18, please contact us immediately at privacy@yupe.io.

10. WHAT ARE YOUR PRIVACY RIGHTS?

If you are located in the EU, EEA, or UK, you have the following rights under GDPR:

• Right of access: obtain a copy of the personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your personal data (the 'right to be forgotten')
• Right to restriction: limit how we process your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: oppose processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent: at any time, for any consent-based processing

To exercise any of these rights, please contact us at privacy@yupe.io. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority. In France, this is the CNIL — www.cnil.fr.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Some browsers and devices include a Do-Not-Track ("DNT") setting. At present, no uniform standard exists for recognising and responding to DNT signals. We do not currently respond to DNT signals. If a binding standard is adopted in the future, we will update this notice accordingly.

12. DO WE MAKE UPDATES TO THIS NOTICE?

Yes. We may update this privacy notice from time to time. For material changes, we will notify you either by email or by displaying a prominent notice on our website before the changes take effect.

13. HOW CAN YOU CONTACT US?