Data protection

Privacy Notice

This notice explains how Talbio processes personal data in accordance with the General Data Protection Regulation (GDPR).

1. Controller

No data protection officer has been appointed because Talbio is not currently legally required to appoint one.

2. Data we process

Candidates

Account and contact details, professional title, summary, region, experience, salary threshold, availability, language levels, selected expertise, telephone number, optional LinkedIn URL, employer blocks, connection requests and responses.

Employers

Account and contact details, current title, company name, company website, hiring needs, opportunity details, messages and connection-request history.

Technical data

Authentication identifiers, necessary cookies, security events, timestamps, IP and device/browser information contained in operational logs.

Please do not provide special-category data such as health information, ethnicity, religion, political opinions, trade-union membership, genetic or biometric data.

3. Purposes and legal bases

• Creating accounts, reviewing profiles, providing dashboards and operating the matching workflow: Article 6(1)(b) GDPR.
• Verifying users, preventing abuse, securing the service and maintaining reliable records: Article 6(1)(f) GDPR. Talbio’s legitimate interests are platform security, fraud prevention and service integrity.
• Complying with legal obligations and establishing, exercising or defending legal claims: Articles 6(1)(c) and 6(1)(f) GDPR.
• Revealing a candidate’s identity and contact information to a particular employer for a particular opportunity: Article 6(1)(a) GDPR, based on the candidate’s specific confirmation. Consent may be withdrawn before disclosure by contacting Talbio. Withdrawal does not affect earlier lawful processing and cannot reverse information already lawfully disclosed.

4. Anonymous profiles and disclosure

Verified employers initially receive only structured professional information under an anonymous identifier. A candidate’s full name, email, telephone number and optional LinkedIn URL are stored separately and are disclosed to the requesting employer only after the candidate approves that employer’s specific opportunity and confirms representation. A blocked employer cannot view that candidate’s anonymous profile or submit requests.

5. Recipients and service providers

Personal data may be processed by Talbio and by contracted infrastructure providers required to operate the service, currently Supabase (database and authentication) and Vercel (hosting and deployment). Candidate identity and contact information is also received by the specific employer approved by the candidate. Data is not sold.

6. International transfers

Talbio selects European hosting regions where available. Some providers or their subprocessors may nevertheless process data outside the European Economic Area. Where required, transfers are protected through an adequacy decision, the EU–US Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses and supplementary safeguards.

7. Cookies

Talbio uses technically necessary authentication and security cookies to keep users signed in and protect accounts. These are required to provide the requested service. Talbio does not currently use advertising cookies or behavioural advertising. If optional analytics or marketing technologies are introduced, this notice and the consent mechanism will be updated before activation.

8. Retention

Account and profile data is retained while the account is active. On account closure, operational profile data will be deleted or anonymised unless continued retention is necessary for legal obligations, security incidents or legal claims. Connection, representation and transaction records may be retained for up to three years after the end of the relevant relationship in line with the regular German limitation period. Records subject to statutory commercial or tax retention duties may be retained for the legally required period. Provider security logs are retained according to the applicable provider settings and contracts.

9. Required and optional information

Fields marked as required are necessary to create, verify or operate the relevant account. Without them, Talbio cannot provide access. LinkedIn is optional. Candidates decide separately whether to approve each identity disclosure.

10. Your rights

Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time. Contact ouda@oudagamal.com. You also have the right to complain to a supervisory authority.

11. Supervisory authority

12. Automated decisions

Talbio does not currently make decisions producing legal or similarly significant effects solely by automated means. Vetting and approvals involve human review.

13. Changes

This notice may be updated when the service, providers or legal requirements change. Material changes will be communicated appropriately.

Version 1.0 · 13 July 2026