1. Who is responsible for your data
The controller of your personal data is the operator of the MySkillsSpace service. Its full identification details, registered address and registration numbers are published on the Contact page, which forms part of this notice.
For any question about this notice, or to exercise any of the rights described in section 11, use the contact form. Privacy requests are answered without undue delay and in any event within one month of receipt; if a request is complex, we will tell you within that month and may extend it by a further two months.
No data protection officer has been appointed, because the processing described here does not meet the conditions in Article 37(1) GDPR. If that changes, the officer's contact details will be published here.
2. What this notice covers
This notice covers the MySkillsSpace website and the account area behind it. It describes the service as it actually works today: specialists publish a profile and priced services, on their own or as a team; anyone can browse specialists, services and teams; signed-in companies can save profiles, send messages and recruitment invitations, run a recruitment process, and ask a specialist to take a skills assessment.
There is no job board, no employer directory and no salary tooling in the service you are using unless you can see those sections in the interface; they are switched off by default. There are no payments, no advertising, no sponsored placements and no automated decisions about you.
3. What we collect
Account data, which you must provide to have an account: e-mail address, first and last name, a password (stored only as a bcrypt hash, never in readable form), the role you sign up as, and your interface language. Without these an account cannot be created.
Profile and offer data, all of it optional and all of it written by you: headline, summary, city and country, skills, languages, work history with employer names and dates, education, certifications, achievements, portfolio links, availability, rate expectations, and the services you publish with their descriptions, prices and the contact address you choose to show. You decide which of these are visible and to whom.
Files you upload: CV and other documents, an avatar and a cover image. Uploads are checked against the file type they declare and stored on the service's own server, not with a third-party storage provider.
Activity data created by using the service: conversations and their messages, invitations, notifications and the browser push subscriptions you enable for them, saved searches, saved profiles and services, and, for signed-in companies, the record that a Skills First profile was revealed to them. Teams you create or join: your membership, your role in the team and the invitations and join requests around it. Recruitment processes you take part in: their stages, decisions and activity log. Skills assessments you take: your answers, scores and results, together with the technical events of the session (start, submission, focus and connection changes, timing) that are kept as neutral evidence of how the session ran. When user-written content is shown in another language, the translation of that text is stored so it does not have to be produced again.
Technical data recorded by the server: IP address, browser user agent, request time and outcome in server logs; the IP address and user agent attached to a consent record so it can be proved; and audit entries for security-relevant actions such as sign-in, password change, account deletion and administrative decisions.
Usage data, only if you agree to analytics: pages viewed, actions taken, technical details of the browser and device, a rough location derived from the IP address, and, when you are signed in, your account id and role. This is collected by PostHog on our instructions and is not used to show you ads.
4. Why we use it, and on what legal basis
To provide the service you asked for: creating and running your account, publishing your profile and services, search and browsing, messaging, invitations, notifications and saved items. Legal basis: performance of a contract, Article 6(1)(b) GDPR. If you do not provide the account data in section 3, we cannot provide the service.
To keep the service secure and working: rate limiting, abuse prevention, server and audit logs, and investigating incidents. Legal basis: our legitimate interest in a service that is not abused, Article 6(1)(f) GDPR.
To moderate published content and enforce the Terms, including restricting or removing content and suspending accounts, and telling the person affected why. Legal basis: our legitimate interest in a lawful platform and, where the law requires the action, compliance with a legal obligation, Article 6(1)(f) and 6(1)(c) GDPR.
To answer messages sent through the contact form and to handle complaints. Legal basis: our legitimate interest in answering people who write to us, Article 6(1)(f) GDPR.
To send commercial information by e-mail, where you have separately subscribed. Legal basis: your consent, Article 6(1)(a) GDPR together with Article 398 of the Polish Electronic Communications Law. You can withdraw it at any time using the unsubscribe link, without affecting anything you received before.
To understand how the service is used, when you agree to analytics: which pages are opened, which actions are taken, the device and browser type, and a rough location derived from the IP address. This is done with PostHog. Legal basis: your consent, Article 6(1)(a) GDPR together with Article 399 of the Polish Electronic Communications Law. You can withdraw it at any time from the cookie notice, without affecting anything recorded before.
5. What other people can see
Your profile visibility is yours to set: public, signed-in members only, signed-in companies only, identity hidden, or private. The setting is applied by the server on every route that can return a profile, not only hidden in the interface, and a profile that is not public is refused to visitors who are not entitled to it.
Identity-hidden mode withholds your name, photo, employers, contact details, links, salary expectations and profile handle, and reduces your location and that of every position to the country at most. Inside the text you wrote, the server also replaces your name, any e-mail address, your phone number and any web address before the page is sent. It is a display choice, not a guarantee of unlinkability: what you write about yourself can still identify you if it is distinctive enough, for example an employer named in a description or a narrowly described service. The privacy check in your settings lists what it found in your text; treat identity-hidden mode as showing your work without your name, not as untraceable.
Contact details and CV files are never shown to anonymous visitors. They are shown only if you switch them on, and then only to signed-in companies and administrators. Your public profile is offered to search engines only if you turn indexing on; it is off by default.
6. How results are ordered, and the match percentage
Search results are ordered by the criterion the visitor chooses: most recently published first by default, or by price, or by stated availability. Nobody can pay for a higher position, and there are no promoted or sponsored results.
The percentage shown next to a service is a simple, fixed calculation over information you published yourself - how complete the profile is, whether skills are listed, whether a price and availability are stated. It is arithmetic, not artificial intelligence, it does not change the order of results, and it produces no decision about you. No profiling within the meaning of Article 22 GDPR takes place, and no decision with legal or similarly significant effects is made automatically.
7. Who else receives data
Other users, but only within the limits you set: what your visibility setting allows, the contents of conversations you take part in, and invitations you receive. Administrators of the service can see account and content data where that is needed for moderation and support.
Service providers acting on our instructions: cyber_Folks S.A., which hosts the server the service runs on; Resend, which sends account e-mail such as password resets and verification links; Cloudflare, Inc., which provides the domain's DNS, sits in front of the service as a reverse proxy so requests pass through it, and provides the object storage (Cloudflare R2) that holds our encrypted off-site backup copies; and PostHog, Inc., which provides product analytics, only after you agree. No advertising network, payment provider or artificial intelligence provider receives your data, because the service uses none.
Google is a recipient in two situations. If you sign in with Google, Google handles that sign-in and returns your e-mail address, name and profile picture to us. If a user signed up that way, their picture is served from Google, so your browser contacts Google to display it. Separately, opening the map loads tiles from OpenStreetMap, which receives your IP address. City suggestions are searched in our own database, so typed city queries are not sent to an external geocoding provider.
If you agree to analytics, your browser sends usage events to our own origin and we forward them to PostHog's European cloud. PostHog then sees the pages you visit, the actions you take, your IP address, browser and device information, and a random identifier. If you are signed in, we attach your account id and role, not your e-mail address or name. PostHog does not receive the contents of messages, passwords, or files you upload. You can stop this at any time from the cookie notice; we then stop sending events and tell PostHog to forget the identifier used in this browser.
8. Transfers outside the European Economic Area
The service, its database and uploaded files are held on a server in Poland. Encrypted backup copies are stored in a Cloudflare R2 bucket created with the European Union jurisdiction restriction, so they stay in data centres within the EU. Analytics events that you have agreed to are processed in PostHog's European Union cloud. Cloudflare and Resend operate globally distributed infrastructure, and Google and PostHog, Inc. are established outside the European Economic Area, so some processing by them may take place outside it.
Where that happens, the transfer relies on the safeguards in our agreement with that provider, such as an adequacy decision, a certification, or standard contractual clauses approved by the European Commission. You can ask which applies to a particular provider using the contact form, and we will tell you.
9. How long we keep it
Account, profile, offer and file data: for as long as the account exists. When you delete your account, the account record and everything on your profile is anonymised immediately, uploaded files are deleted from the server, work history, published services, documents and saved items are removed, and all sessions are ended. An anonymised, empty record of the account is kept so that other people's conversations and records do not break; it contains no data that identifies you.
Messages you sent to another user stay in that person's conversation after your account is gone, shown against an anonymised account. They are that person's record as much as yours, which is why they are not deleted with your profile.
Server and audit logs and consent records: kept for security and accountability. Consent records are kept for as long as they may be needed to prove the consent and to defend against claims; audit entries for account actions are kept for the same reason.
Contact form messages: kept for as long as needed to deal with the matter and any follow-up.
Backups: a copy of the database is taken on the server every day and the newest 14 copies are kept there. Once a day the newest copy, together with an archive of uploaded files, is encrypted and sent to the off-site store described in sections 7 and 8, where the last 14 daily, 4 weekly and 6 monthly copies are kept and older ones are deleted automatically. A backup contains everything the database and the file store hold at that moment, including data of accounts that were later deleted, which is why deleted data can remain in a backup for up to six months before the last copy containing it is rotated out. Backups exist only to restore the service after a failure; we do not restore a backup in order to reinstate deleted data.
10. How the data is protected
Passwords are stored only as bcrypt hashes. Traffic is served over TLS. Sessions use short-lived access tokens and a refresh token held in a cookie that JavaScript cannot read; ending a session or changing a password invalidates the tokens immediately rather than letting them run out.
Access to another user's data is refused by the server on every route, uploads are checked against the file type they declare, and requests are rate limited. Administrative actions are recorded in an audit log.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority and, where the law requires it, you.
Backup copies are encrypted on our server before they leave it, with a key that only we hold; the storage provider receives only encrypted files and cannot read them. Access to the backups is limited to the people who operate the service, the store keeps previous versions of each file so that a copy cannot be silently destroyed, and restores are tested so that a backup is something we can actually rely on.
11. Your rights
You have the right of access to your data and to a copy of it, to rectification, to erasure, to restriction of processing, to object to processing based on our legitimate interests, and to data portability. Where processing is based on your consent, you may withdraw it at any time; that does not affect processing carried out before you withdrew it.
Several of these you can exercise yourself, immediately: edit or correct anything on your profile in the account area, change your visibility, download a copy of your data as a file from the account settings, withdraw the newsletter consent from the unsubscribe link, and delete your account from the account settings after confirming your password.
For anything else - restriction, objection, or a question about how a right was handled - use the contact form. We will ask for enough information to be sure the request comes from you, and we will not charge for it unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with the supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. If you live or work in another EEA country, you may complain to the supervisory authority there instead.
13. Age
MySkillsSpace is a service for people offering professional services and for the companies looking for them. It is not directed at children and accounts are intended for people aged 16 or over. If you believe a child has created an account, tell us through the contact form and we will remove it.
14. Changes to this notice
This notice may change when the service changes or the law does. The version in force is identified by the effective date shown at the top of this page.
If a change materially affects how your data is used, account holders will be told before it takes effect, by an e-mail or a notice in the service, rather than by a silent edit.